# MediaChunks

chunk_text:
be plugged into this MDPS. 1225.10s - 1227.62s | And I mean, if you look this up online, you're 1227.62s - 1231.50s | going to see a slew of papers because this is the low-hanging fruit. 1231.50s - 1235.18s | Again, human carpentry, everyone's going for this. 1235.18s - 1238.70s | First place, automatic segmentation. 1238.70s - 1242.70s | Have a mask, highlight the defect, give you recommendations on the defect. 1242.70s - 1246.78s | The radiologist, the surgeon, or whomever can look at that 1246.78s - 1249.02s | and give yes or no feedback. 1249.02s - 1254.86s | The next place is the design. 1254.86s - 1260.10s | You can have all of your data from your field feedback 1260.10s - 1262.70s | from the designs that exist that are standard 1262.70s - 1264.30s | to automatically generate design. 1264.30s - 1268.82s | And all the designer has to do is say go, no go. 1268.82s - 1271.34s | And the physician have their inputs as well. 1271.34s - 1274.46s | And you can use LLMs to generate the surgical technique, which 1274.46s - 1276.46s | is also considered part of the labeling, which 1276.46s - 1280.10s | is part of the design of the device. 1280.10s - 1286.10s | Finally, the demand planning, the design transfer. 1286.10s - 1290.38s | You can have multiple products in the queue. 1290.38s - 1294.10s | And you can determine, hey, this device needs 1294.10s - 1295.98s | to be manufactured in this zone. 1295.98s - 1298.58s | But this patient is suicidal, so they're a higher risk. 1298.58s - 1301.30s | So that would adjust the demand planning. 1301.30s - 1303.90s | And that's something, again, you need good connection 1303.90s - 1308.66s | with the physician and the health HCPs to determine what's correct. 1308.66s - 1312.66s | And then, of course, the enabling of manufacturing with ML 1312.66s - 1314.42s | is already in progress. 1314.42s - 1316.66s | And they're just going to miniaturize that. 1316.66s - 1318.90s | And it would make everything more visible. 1318.90s - 1324.18s | And you can monitor the manufacturing in real time. 1324.18s - 1328.30s | So I can't stress enough that maybe 1328.30s - 1330.90s | with the high-level schemas that I presented to everybody, 1330.90s - 1333.78s | you might kind of detect that we, again, 1333.78s - 1336.74s


chunk_text:
part of the design of the device. 1280.10s - 1286.10s | Finally, the demand planning, the design transfer. 1286.10s - 1290.38s | You can have multiple products in the queue. 1290.38s - 1294.10s | And you can determine, hey, this device needs 1294.10s - 1295.98s | to be manufactured in this zone. 1295.98s - 1298.58s | But this patient is suicidal, so they're a higher risk. 1298.58s - 1301.30s | So that would adjust the demand planning. 1301.30s - 1303.90s | And that's something, again, you need good connection 1303.90s - 1308.66s | with the physician and the health HCPs to determine what's correct. 1308.66s - 1312.66s | And then, of course, the enabling of manufacturing with ML 1312.66s - 1314.42s | is already in progress. 1314.42s - 1316.66s | And they're just going to miniaturize that. 1316.66s - 1318.90s | And it would make everything more visible. 1318.90s - 1324.18s | And you can monitor the manufacturing in real time. 1324.18s - 1328.30s | So I can't stress enough that maybe 1328.30s - 1330.90s | with the high-level schemas that I presented to everybody, 1330.90s - 1333.78s | you might kind of detect that we, again, 1333.78s - 1336.74s | are not ready for this, but the technology is getting there. 1336.74s - 1338.46s | And we need it. 1338.98s - 1340.86s | Now we need it yesterday. 1340.86s - 1344.50s | And so medical device manufacturers 1344.50s - 1347.98s | need to start being aware of the three customers down the road 1347.98s - 1352.14s | so that we can have safe and effective products that 1352.14s - 1358.22s | are consented, that are safe, that have encrypted or private. 1358.22s - 1360.42s | And that's not something medical device manufacturers 1360.42s - 1362.50s | are always mindful of. 1362.50s - 1368.34s | We are really in a next-gen humanity moment here. 1368.34s - 1372.46s | Here's an example of 3D printing autologous bone. 1372.46s - 1374.18s | So you have a defect. 1374.18s - 1377.70s | Instead of a joint implant, you 3D print 1377.70s - 1379.86s | a mold that's based off the defect. 1379.86s - 1382.70s | And then you use a bioreactor to print your bone. 1382.70s - 1384.22s | It's not just orthopedics. 1384.22s - 1385.74s | It's just the low-hanging fruit. 1385.74s - 1387.34s | I mean, the application is huge. 1387.34s


chunk_text:
| are not ready for this, but the technology is getting there. 1336.74s - 1338.46s | And we need it. 1338.98s - 1340.86s | Now we need it yesterday. 1340.86s - 1344.50s | And so medical device manufacturers 1344.50s - 1347.98s | need to start being aware of the three customers down the road 1347.98s - 1352.14s | so that we can have safe and effective products that 1352.14s - 1358.22s | are consented, that are safe, that have encrypted or private. 1358.22s - 1360.42s | And that's not something medical device manufacturers 1360.42s - 1362.50s | are always mindful of. 1362.50s - 1368.34s | We are really in a next-gen humanity moment here. 1368.34s - 1372.46s | Here's an example of 3D printing autologous bone. 1372.46s - 1374.18s | So you have a defect. 1374.18s - 1377.70s | Instead of a joint implant, you 3D print 1377.70s - 1379.86s | a mold that's based off the defect. 1379.86s - 1382.70s | And then you use a bioreactor to print your bone. 1382.70s - 1384.22s | It's not just orthopedics. 1384.22s - 1385.74s | It's just the low-hanging fruit. 1385.74s - 1387.34s | I mean, the application is huge. 1387.34s - 1390.78s | And the MDPS is going to be amazing. 1390.78s - 1395.10s | So we are in a deus ex-human moment. 1395.10s - 1398.02s | This is something I stole from my friend Nina. 1398.02s - 1399.46s | And it's true. 1399.46s - 1401.10s | We are making new humans. 1401.10s - 1403.58s | And so how are we going to do this safe? 1403.58s - 1406.30s | I encourage everyone to go to the resources I pointed out, 1406.30s - 1407.46s | kind of look at the schema. 1407.46s - 1409.30s | What can you do to encourage this 1409.30s - 1413.26s | and where we can all have a better future and better 1413.26s - 1416.06s | health care practice and better standard of care? 1416.06s - 1417.98s | So I appreciate everyone. 1417.98s - 1419.74s | Thank you.


chunk_text:
- 1390.78s | And the MDPS is going to be amazing. 1390.78s - 1395.10s | So we are in a deus ex-human moment. 1395.10s - 1398.02s | This is something I stole from my friend Nina. 1398.02s - 1399.46s | And it's true. 1399.46s - 1401.10s | We are making new humans. 1401.10s - 1403.58s | And so how are we going to do this safe? 1403.58s - 1406.30s | I encourage everyone to go to the resources I pointed out, 1406.30s - 1407.46s | kind of look at the schema. 1407.46s - 1409.30s | What can you do to encourage this 1409.30s - 1413.26s | and where we can all have a better future and better 1413.26s - 1416.06s | health care practice and better standard of care? 1416.06s - 1417.98s | So I appreciate everyone. 1417.98s - 1419.74s | Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=Lxg9YyFJ8s0", "title": "DEF CON 32 - Attacks on GenAI data & using vector encryption to stop them - Patrick Walsh, Bob Wall", "description": "As the adoption of GenAI tools has soared, security has done little to keep up. New classes of data, and especially vector data, is flooding into new and untested data stores. Vector databases are getting copies of health data, financial data, HR data, emails, and everything else, but they have no intrinsic security. What's worse, the vectors themselves can be reversed in embedding inversion attacks that turn those vectors back into faces, sentences, and even pictures. We discuss these new attacks and a new branch of cryptography, vector encryption, which allows for privacy preserving searches to happen over the encrypted vectors. We'll discuss the benefits, trade-offs, and current state of the field and the open source software we've built to meet the new need.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1578, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.16s | This text was transcribed using whisper model: large-v2 Welcome, this is the attacks on Gen AI data and using vector encryption to stop 5.16s - 10.68s | them talk. I'm Patrick Walsh, this is Bob Wall, we're the co-founders of IronCore 10.68s - 15.12s | Labs, where we help people protect data in their cloud applications by making 15.12s - 22.24s | application layer encryption more easy and practical and usable. So this talk is 22.24s - 26.08s | going to be about the ecosystems around LLMs, but we'll start by talking about 26.08s - 33.20s | LLMs specifically, and in particular some limitations of LLMs, right? When an LLM is 33.20s - 38.44s | trained, it's trained to predict a plausible completion to a prompt, and 38.44s - 42.32s | that means it can sometimes make stuff up that sounds good but isn't necessarily 42.32s - 46.80s | right. It's also trained on what, by the time it's released, is typically stale 46.80s - 50.76s | data, because it takes a long time to train it, to test it, to fine-tune it, etc. 50.76s - 56.00s | And then finally, it hopefully hasn't been trained on your data, and therefore 56.00s - 59.92s | if you want it to do things that are cool across, you know, your corporate data, 59.92s - 63.84s | your personal data, or something like that, it's not going to


chunk_text:
we're the co-founders of IronCore 10.68s - 15.12s | Labs, where we help people protect data in their cloud applications by making 15.12s - 22.24s | application layer encryption more easy and practical and usable. So this talk is 22.24s - 26.08s | going to be about the ecosystems around LLMs, but we'll start by talking about 26.08s - 33.20s | LLMs specifically, and in particular some limitations of LLMs, right? When an LLM is 33.20s - 38.44s | trained, it's trained to predict a plausible completion to a prompt, and 38.44s - 42.32s | that means it can sometimes make stuff up that sounds good but isn't necessarily 42.32s - 46.80s | right. It's also trained on what, by the time it's released, is typically stale 46.80s - 50.76s | data, because it takes a long time to train it, to test it, to fine-tune it, etc. 50.76s - 56.00s | And then finally, it hopefully hasn't been trained on your data, and therefore 56.00s - 59.92s | if you want it to do things that are cool across, you know, your corporate data, 59.92s - 63.84s | your personal data, or something like that, it's not going to work. And to fill 63.84s - 68.04s | those gaps, there's a thing called RAG, or Retrieval Augmented Generation. 68.04s - 72.68s | Terrible name, basically means stuff extra stuff into the prompt so the LLM 72.68s - 77.32s | can answer questions better. And it works a lot like this. You have a chat app, it 77.32s - 80.48s | doesn't have to be a chat app, it's just like the most common thing to use, right? 80.48s - 85.44s | A user asks a question, and now instead of passing that question to the LLM, the 85.44s - 90.40s | first thing it does is a search. And that search is to find relevant documents 90.40s - 94.76s | related to the query. That all gets jammed together into a prompt, which then 94.76s - 99.32s | goes to the LLM. That's it, that's RAG in a nutshell, you get it. Here's a kind of 99.32s - 103.20s | more practical example of what that looks like. There's a system prompt, 103.20s - 107.28s | there's a history of the previous questions and answers from the chat, and 107.28s - 112.08s | then there's the current, the most


chunk_text:
work. And to fill 63.84s - 68.04s | those gaps, there's a thing called RAG, or Retrieval Augmented Generation. 68.04s - 72.68s | Terrible name, basically means stuff extra stuff into the prompt so the LLM 72.68s - 77.32s | can answer questions better. And it works a lot like this. You have a chat app, it 77.32s - 80.48s | doesn't have to be a chat app, it's just like the most common thing to use, right? 80.48s - 85.44s | A user asks a question, and now instead of passing that question to the LLM, the 85.44s - 90.40s | first thing it does is a search. And that search is to find relevant documents 90.40s - 94.76s | related to the query. That all gets jammed together into a prompt, which then 94.76s - 99.32s | goes to the LLM. That's it, that's RAG in a nutshell, you get it. Here's a kind of 99.32s - 103.20s | more practical example of what that looks like. There's a system prompt, 103.20s - 107.28s | there's a history of the previous questions and answers from the chat, and 107.28s - 112.08s | then there's the current, the most recent question, and then stuffed in with that 112.08s - 117.68s | is any documents or web pages or whatever it is that might be related to 117.68s - 121.56s | what the question was. In this case it's about, hey what's that draft 10Q, 121.56s - 126.12s | it's a private document that's not public, and that's how it all gets in to 126.12s - 130.48s | the LLM so it can answer questions on that private data. It's fundamental to 130.48s - 135.04s | basically how everyone is using these stuff today, if you're using chat inside 135.04s - 140.28s | an app. And to make all this work you need to have some type of more 140.28s - 144.52s | intelligent search than what we typically do. Call it AI search, call it 144.52s - 148.32s | semantic search or whatever you want to, and there's a bunch of ways to do this. 148.32s - 152.28s | The most popular right now is an approach called vector search. It's kind 152.28s - 155.48s | of what everyone is doing, although it's not the only way to do it. 155.48s - 161.16s | And vector search and actually


chunk_text:
recent question, and then stuffed in with that 112.08s - 117.68s | is any documents or web pages or whatever it is that might be related to 117.68s - 121.56s | what the question was. In this case it's about, hey what's that draft 10Q, 121.56s - 126.12s | it's a private document that's not public, and that's how it all gets in to 126.12s - 130.48s | the LLM so it can answer questions on that private data. It's fundamental to 130.48s - 135.04s | basically how everyone is using these stuff today, if you're using chat inside 135.04s - 140.28s | an app. And to make all this work you need to have some type of more 140.28s - 144.52s | intelligent search than what we typically do. Call it AI search, call it 144.52s - 148.32s | semantic search or whatever you want to, and there's a bunch of ways to do this. 148.32s - 152.28s | The most popular right now is an approach called vector search. It's kind 152.28s - 155.48s | of what everyone is doing, although it's not the only way to do it. 155.48s - 161.16s | And vector search and actually all of those AI search type techniques are 161.20s - 164.92s | important because they, they differentiate between different 164.92s - 168.68s | meanings of words, they can understand a sentence in context, they can understand 168.68s - 172.80s | when arm means a division of an organization versus when arm is a body 172.80s - 179.16s | part or, or even a verb, right. And in practice how these types of vector 179.16s - 184.48s | search works is you start with some input document, and that input, do we lose 184.48s - 188.56s | it, and that input document then gets chunked up into pieces. Sometimes it's by 188.56s - 193.24s | sentence, sometimes it's sets of, call it 30 words, or it can be any strategy and 193.24s - 198.04s | often overlapping. But each of those pieces gets run through something that's 198.04s - 203.56s | very similar to an LLM, that sucks, that's very similar to an LLM, but is in fact 203.56s - 209.04s | called a text embedding model. And a text embedding model, unlike an LLM, produces 209.04s - 214.52s | something called a vector embedding. That's not great. 215.52s - 219.80s


chunk_text:
all of those AI search type techniques are 161.20s - 164.92s | important because they, they differentiate between different 164.92s - 168.68s | meanings of words, they can understand a sentence in context, they can understand 168.68s - 172.80s | when arm means a division of an organization versus when arm is a body 172.80s - 179.16s | part or, or even a verb, right. And in practice how these types of vector 179.16s - 184.48s | search works is you start with some input document, and that input, do we lose 184.48s - 188.56s | it, and that input document then gets chunked up into pieces. Sometimes it's by 188.56s - 193.24s | sentence, sometimes it's sets of, call it 30 words, or it can be any strategy and 193.24s - 198.04s | often overlapping. But each of those pieces gets run through something that's 198.04s - 203.56s | very similar to an LLM, that sucks, that's very similar to an LLM, but is in fact 203.56s - 209.04s | called a text embedding model. And a text embedding model, unlike an LLM, produces 209.04s - 214.52s | something called a vector embedding. That's not great. 215.52s - 219.80s | Produces something called a vector embedding. And the vector embedding is 219.80s - 224.76s | basically just a long list of very small numbers. And those small numbers can be 224.76s - 229.40s | hundreds or thousands in length. And we'll get into what they mean in a 229.40s - 232.76s | minute here, but to give you some intuition on these, we'll take, look at a 232.76s - 236.00s | list, like a vector that's only three long, right, because you can graph this in 236.00s - 239.04s | 3D space and you can understand it better. And if we have a bunch of 239.04s - 243.32s | different vectors, let's say we have A and B and we have C, we can kind of look 243.32s - 246.60s | at this visually and say, oh look, A and B kind of look like they're close 246.60s - 251.24s | together and A and C look like they're far apart. And in fact, if we run a 251.24s - 255.76s | distance comparison operation like this one, Euclidean distance, although there's 255.76s - 259.12s | a bunch of different ones, they all have the same kind of effect,


chunk_text:
| Produces something called a vector embedding. And the vector embedding is 219.80s - 224.76s | basically just a long list of very small numbers. And those small numbers can be 224.76s - 229.40s | hundreds or thousands in length. And we'll get into what they mean in a 229.40s - 232.76s | minute here, but to give you some intuition on these, we'll take, look at a 232.76s - 236.00s | list, like a vector that's only three long, right, because you can graph this in 236.00s - 239.04s | 3D space and you can understand it better. And if we have a bunch of 239.04s - 243.32s | different vectors, let's say we have A and B and we have C, we can kind of look 243.32s - 246.60s | at this visually and say, oh look, A and B kind of look like they're close 246.60s - 251.24s | together and A and C look like they're far apart. And in fact, if we run a 251.24s - 255.76s | distance comparison operation like this one, Euclidean distance, although there's 255.76s - 259.12s | a bunch of different ones, they all have the same kind of effect, you can see that 259.12s - 264.72s | you know A and B are 2.2 apart, whereas A and C are 5.6 apart. And the way this 264.72s - 269.60s | works with search is we take a query, right, it's a sentence, and we reduce it 269.60s - 273.84s | to, let's say, A. A is a vector representation of what we queried, and 273.84s - 277.20s | then we search across all our vectors and we say, give me anything that's 277.20s - 281.64s | similar to A, and then hopefully, if it does it right, it returns B but not C. 281.64s - 286.60s | That's it. That's what vector search is doing. It's the whole shebang. The vector 286.60s - 291.68s | represents the meaning of the content. And to make that work, we have this kind 291.68s - 295.72s | of new concept, or at least new to a lot of us, at least to me, although I guess 295.72s - 299.40s | it's been around for quite a while, and that's called a vector database. And a 299.40s - 302.84s | vector database's purpose is to be able to do these nearest neighbor or


chunk_text:
you can see that 259.12s - 264.72s | you know A and B are 2.2 apart, whereas A and C are 5.6 apart. And the way this 264.72s - 269.60s | works with search is we take a query, right, it's a sentence, and we reduce it 269.60s - 273.84s | to, let's say, A. A is a vector representation of what we queried, and 273.84s - 277.20s | then we search across all our vectors and we say, give me anything that's 277.20s - 281.64s | similar to A, and then hopefully, if it does it right, it returns B but not C. 281.64s - 286.60s | That's it. That's what vector search is doing. It's the whole shebang. The vector 286.60s - 291.68s | represents the meaning of the content. And to make that work, we have this kind 291.68s - 295.72s | of new concept, or at least new to a lot of us, at least to me, although I guess 295.72s - 299.40s | it's been around for quite a while, and that's called a vector database. And a 299.40s - 302.84s | vector database's purpose is to be able to do these nearest neighbor or 302.84s - 306.96s | approximate nearest neighbor searches across the large amounts of data very 306.96s - 311.00s | quickly. And there are a lot of these companies now that are doing this. In 311.00s - 315.20s | fact, last year we saw hundreds of millions of VC money go into the 315.20s - 318.28s | startups that are building vector databases. Startups like Pinecone and 318.28s - 324.20s | Weaviate and Quadrant. And despite that, the idea of a vector database is already 324.20s - 328.44s | eroding away to nothing because classic databases like Mongo and Postgres and 328.52s - 332.32s | Oracle are all adding vector capabilities to their existing databases. So you're 332.32s - 335.68s | getting these type of vector comparison nearest neighbor search capability 335.68s - 340.24s | pretty much everywhere that you have a database now. Okay, changing tracks for a 340.24s - 345.96s | second. We started thinking to ourself, who's using this stuff? Well, we looked at 345.96s - 351.92s | the top 10 SaaS companies and we thought, how many of them are doing adding LLM 351.92s - 355.12s | capabilities over private data? Which means that they're almost certainly


chunk_text:
302.84s - 306.96s | approximate nearest neighbor searches across the large amounts of data very 306.96s - 311.00s | quickly. And there are a lot of these companies now that are doing this. In 311.00s - 315.20s | fact, last year we saw hundreds of millions of VC money go into the 315.20s - 318.28s | startups that are building vector databases. Startups like Pinecone and 318.28s - 324.20s | Weaviate and Quadrant. And despite that, the idea of a vector database is already 324.20s - 328.44s | eroding away to nothing because classic databases like Mongo and Postgres and 328.52s - 332.32s | Oracle are all adding vector capabilities to their existing databases. So you're 332.32s - 335.68s | getting these type of vector comparison nearest neighbor search capability 335.68s - 340.24s | pretty much everywhere that you have a database now. Okay, changing tracks for a 340.24s - 345.96s | second. We started thinking to ourself, who's using this stuff? Well, we looked at 345.96s - 351.92s | the top 10 SaaS companies and we thought, how many of them are doing adding LLM 351.92s - 355.12s | capabilities over private data? Which means that they're almost certainly 355.20s - 359.72s | using RAG. The answer is 100%. Then we said, well what about security companies? 359.72s - 363.28s | They wouldn't jump on to just using all this new technology that we don't know 363.28s - 368.44s | how to secure yet, would they? No, 100% of them too. Also adding LLM capabilities on 368.44s - 373.64s | top of private data. Think about that for a moment, right? It means that these AI 373.64s - 377.64s | systems, whatever cloud services and things you're using, they are hoovering 377.64s - 381.84s | up this data. Probably copies of it are going into the vector databases as 381.88s - 387.92s | vectors and among other places, which I'll talk about ever so briefly later. So 387.92s - 393.72s | do these vectors matter? I was talking to the CEO of one of the vector database 393.72s - 397.20s | companies who's raised tens of million dollars last year and he told me that a 397.20s - 400.68s | vector was like a hash and it was basically meaningless, except for 400.68s - 404.84s | comparison purposes. So which my first thought is, well you clearly don't know


chunk_text:
355.20s - 359.72s | using RAG. The answer is 100%. Then we said, well what about security companies? 359.72s - 363.28s | They wouldn't jump on to just using all this new technology that we don't know 363.28s - 368.44s | how to secure yet, would they? No, 100% of them too. Also adding LLM capabilities on 368.44s - 373.64s | top of private data. Think about that for a moment, right? It means that these AI 373.64s - 377.64s | systems, whatever cloud services and things you're using, they are hoovering 377.64s - 381.84s | up this data. Probably copies of it are going into the vector databases as 381.88s - 387.92s | vectors and among other places, which I'll talk about ever so briefly later. So 387.92s - 393.72s | do these vectors matter? I was talking to the CEO of one of the vector database 393.72s - 397.20s | companies who's raised tens of million dollars last year and he told me that a 397.20s - 400.68s | vector was like a hash and it was basically meaningless, except for 400.68s - 404.84s | comparison purposes. So which my first thought is, well you clearly don't know 404.84s - 411.24s | how people abuse hashes. And my second thought is, you're wrong. So that isn't 411.28s - 416.04s | how it works at all. If you look at taking a phrase and you reduce it to an 416.04s - 420.80s | embedding vector, an embedding model into a vector, okay, it looks pretty 420.80s - 426.32s | meaningless to us. But then again, so does an animated GIF like this cat if you 426.32s - 430.00s | look at it in a text editor, right? It just because it's meaningless to us to 430.00s - 434.36s | look at doesn't mean it is meaningless to a computer or in this case to an AI 434.36s - 440.04s | model. And so the way you go back from a vector to the original text or 440.08s - 443.92s | something approximating it is using something called an inversion model. An 443.92s - 447.96s | inversion model is just a model that's trained on vectors to sentences so that 447.96s - 452.56s | it can make that same prediction. In this case it comes close. It's our 452.56s - 456.60s | income is down instead of our earnings is


chunk_text:
404.84s - 411.24s | how people abuse hashes. And my second thought is, you're wrong. So that isn't 411.28s - 416.04s | how it works at all. If you look at taking a phrase and you reduce it to an 416.04s - 420.80s | embedding vector, an embedding model into a vector, okay, it looks pretty 420.80s - 426.32s | meaningless to us. But then again, so does an animated GIF like this cat if you 426.32s - 430.00s | look at it in a text editor, right? It just because it's meaningless to us to 430.00s - 434.36s | look at doesn't mean it is meaningless to a computer or in this case to an AI 434.36s - 440.04s | model. And so the way you go back from a vector to the original text or 440.08s - 443.92s | something approximating it is using something called an inversion model. An 443.92s - 447.96s | inversion model is just a model that's trained on vectors to sentences so that 447.96s - 452.56s | it can make that same prediction. In this case it comes close. It's our 452.56s - 456.60s | income is down instead of our earnings is down, right, in this example. 100% 456.60s - 462.20s | match on meaning, not 100% match on words. There are some tens of thousands of 462.20s - 467.12s | papers on this at this point. It's heavily studied in academia, not widely 467.24s - 472.84s | known, I don't think, broadly. Best paper we've seen for text inversions, and it's 472.84s - 475.68s | not just text that vectors represent, I'll talk about that in a second, 475.68s - 482.56s | recovers 92% of exact words. That means full names, everything coming right back 482.56s - 487.12s | out exactly as it went in on the text, okay? The other 8% is basically 487.12s - 493.28s | effectively the same anyway. So are these attacks hard? Could, you know, what's the 493.28s - 497.96s | skill level for doing this kind of attack? The answer is most of these 497.96s - 502.08s | papers have accompanying open-source software on GitHub, and so really you 502.08s - 504.84s | just need someone who can run the software, not someone who knows how to 504.84s - 509.64s | build the software, which means it's script kitty level. And on that note, we


chunk_text:
down, right, in this example. 100% 456.60s - 462.20s | match on meaning, not 100% match on words. There are some tens of thousands of 462.20s - 467.12s | papers on this at this point. It's heavily studied in academia, not widely 467.24s - 472.84s | known, I don't think, broadly. Best paper we've seen for text inversions, and it's 472.84s - 475.68s | not just text that vectors represent, I'll talk about that in a second, 475.68s - 482.56s | recovers 92% of exact words. That means full names, everything coming right back 482.56s - 487.12s | out exactly as it went in on the text, okay? The other 8% is basically 487.12s - 493.28s | effectively the same anyway. So are these attacks hard? Could, you know, what's the 493.28s - 497.96s | skill level for doing this kind of attack? The answer is most of these 497.96s - 502.08s | papers have accompanying open-source software on GitHub, and so really you 502.08s - 504.84s | just need someone who can run the software, not someone who knows how to 504.84s - 509.64s | build the software, which means it's script kitty level. And on that note, we 509.64s - 512.72s | actually ran some of these attacks ourselves. We posted some blogs you can 512.72s - 516.72s | check out. We did one on, so I mentioned vectors can represent different things. 516.72s - 520.28s | They can represent images for image search. They can represent faces or 520.32s - 524.96s | voice prints or other things for that. We did one against facial recognition. That 524.96s - 527.72s | doesn't use an inversion model. That's a different technique, by the way. It's, so 527.72s - 530.56s | it's kind of interesting for that purpose, and we did one on text 530.56s - 536.36s | inversions. Really good results. Like, you can really get all the stuff back out or 536.36s - 542.57s | very, very near approximations of the inputs. Alright, so let's talk about 542.57s - 547.25s | these new vector database companies. They probably have good security, right? 547.29s - 552.53s | Actually, no. Super immature. They'll fix it over time. It'll be fine, but if you 552.53s - 558.77s | look closely at these as we have, two of them have no default, no authentication 558.77s - 562.53s | required by default, right?


chunk_text:
509.64s - 512.72s | actually ran some of these attacks ourselves. We posted some blogs you can 512.72s - 516.72s | check out. We did one on, so I mentioned vectors can represent different things. 516.72s - 520.28s | They can represent images for image search. They can represent faces or 520.32s - 524.96s | voice prints or other things for that. We did one against facial recognition. That 524.96s - 527.72s | doesn't use an inversion model. That's a different technique, by the way. It's, so 527.72s - 530.56s | it's kind of interesting for that purpose, and we did one on text 530.56s - 536.36s | inversions. Really good results. Like, you can really get all the stuff back out or 536.36s - 542.57s | very, very near approximations of the inputs. Alright, so let's talk about 542.57s - 547.25s | these new vector database companies. They probably have good security, right? 547.29s - 552.53s | Actually, no. Super immature. They'll fix it over time. It'll be fine, but if you 552.53s - 558.77s | look closely at these as we have, two of them have no default, no authentication 558.77s - 562.53s | required by default, right? Making the mistakes of Elasticsearch and MongoDB of 562.53s - 568.69s | years past, but not learning. One of them has services that are meant to be 568.69s - 572.53s | internal services, and that, you know, there's no protection or authentication 572.53s - 576.09s | on them, so that if someone goes to access that because the firewall 576.09s - 580.37s | neglected to block a port, direct access back to the data without any 580.37s - 584.17s | authentication. Two of them claim to have end-to-end encryption when they only 584.17s - 590.37s | have TLS in transport, and more. I could go on. It doesn't matter. The point is 590.37s - 593.81s | that these vector database systems, and for that matter the chat apps, either way 593.81s - 599.09s | are like total treasure troves of information, and even if you don't use it 599.09s - 603.05s | and invert it, they're, they're at least treasure maps of information because 603.05s - 606.01s | they point back to the data, and you can, you can query it, and if you think about 606.01s - 610.93s | that for a second, imagine that you're in a CTF


chunk_text:
Making the mistakes of Elasticsearch and MongoDB of 562.53s - 568.69s | years past, but not learning. One of them has services that are meant to be 568.69s - 572.53s | internal services, and that, you know, there's no protection or authentication 572.53s - 576.09s | on them, so that if someone goes to access that because the firewall 576.09s - 580.37s | neglected to block a port, direct access back to the data without any 580.37s - 584.17s | authentication. Two of them claim to have end-to-end encryption when they only 584.17s - 590.37s | have TLS in transport, and more. I could go on. It doesn't matter. The point is 590.37s - 593.81s | that these vector database systems, and for that matter the chat apps, either way 593.81s - 599.09s | are like total treasure troves of information, and even if you don't use it 599.09s - 603.05s | and invert it, they're, they're at least treasure maps of information because 603.05s - 606.01s | they point back to the data, and you can, you can query it, and if you think about 606.01s - 610.93s | that for a second, imagine that you're in a CTF competition in that corner of this 610.93s - 614.33s | thing, and you know, you get into a machine, cool, but now you have to get the 614.33s - 617.29s | flag, and it's in a database, you have to get into the database, and now you have 617.29s - 622.25s | to reverse the schema, and you know, figure out a query, and find the flag. It 622.25s - 625.97s | ain't as easy as it sounds, right? It's a lot of expertise and time to do that, 626.09s - 635.01s | versus, you know, give me that data. It is like incredibly far, far easier to attack 635.01s - 641.01s | these systems because you can do it in natural language. So what do we think 641.01s - 645.09s | about bringing AI into our infrastructure? Maybe we should pause for 645.09s - 647.77s | a moment and think a little bit about it, or if it's in there, maybe if you're a 647.77s - 650.77s | hacker in the audience, you should think about, holy shit, there's a lot here. Let 650.77s - 655.37s | me give you some ideas. Obviously everyone knows about prompt injections. 655.37s


chunk_text:
competition in that corner of this 610.93s - 614.33s | thing, and you know, you get into a machine, cool, but now you have to get the 614.33s - 617.29s | flag, and it's in a database, you have to get into the database, and now you have 617.29s - 622.25s | to reverse the schema, and you know, figure out a query, and find the flag. It 622.25s - 625.97s | ain't as easy as it sounds, right? It's a lot of expertise and time to do that, 626.09s - 635.01s | versus, you know, give me that data. It is like incredibly far, far easier to attack 635.01s - 641.01s | these systems because you can do it in natural language. So what do we think 641.01s - 645.09s | about bringing AI into our infrastructure? Maybe we should pause for 645.09s - 647.77s | a moment and think a little bit about it, or if it's in there, maybe if you're a 647.77s - 650.77s | hacker in the audience, you should think about, holy shit, there's a lot here. Let 650.77s - 655.37s | me give you some ideas. Obviously everyone knows about prompt injections. 655.37s - 659.01s | Maybe you don't, haven't thought so much about the fact that you can put a prompt 659.01s - 662.17s | injection in the documents being searched, and they get pulled into the 662.17s - 667.17s | prompt, and you can poison the prompt that way. Logs are everywhere. If you're 667.17s - 670.53s | putting private data into the things that go to the LLMs, and the LLMs log it, 670.53s - 675.01s | that's a problem, but also the prompt firewalls, if you're using those, are 675.01s - 678.81s | logging that stuff too, so the data is kind of exploding, and don't even get me 678.81s - 682.25s | started on agents. Talk to me after if you want to hear about my thoughts on 682.25s - 686.61s | that, but if you're generating code to run to query a database, you're, you're 686.61s - 691.17s | beyond hope. Today though, we're not going to talk about any of that. We're going to 691.17s - 695.33s | talk specifically about this vector stuff, and how to protect it. So basically 695.33s - 698.89s | today, the way to protect that is to encrypt it, and


chunk_text:
- 659.01s | Maybe you don't, haven't thought so much about the fact that you can put a prompt 659.01s - 662.17s | injection in the documents being searched, and they get pulled into the 662.17s - 667.17s | prompt, and you can poison the prompt that way. Logs are everywhere. If you're 667.17s - 670.53s | putting private data into the things that go to the LLMs, and the LLMs log it, 670.53s - 675.01s | that's a problem, but also the prompt firewalls, if you're using those, are 675.01s - 678.81s | logging that stuff too, so the data is kind of exploding, and don't even get me 678.81s - 682.25s | started on agents. Talk to me after if you want to hear about my thoughts on 682.25s - 686.61s | that, but if you're generating code to run to query a database, you're, you're 686.61s - 691.17s | beyond hope. Today though, we're not going to talk about any of that. We're going to 691.17s - 695.33s | talk specifically about this vector stuff, and how to protect it. So basically 695.33s - 698.89s | today, the way to protect that is to encrypt it, and there's two approaches to 698.89s - 702.57s | this, at least in academia, that you could do. One is fully homomorphic encryption, 702.57s - 707.81s | and the other is partially homomorphic. So fully homomorphic encryption, there's 707.81s - 710.45s | actually quite a few papers on this, and they're fairly interesting. There's a lot 710.45s - 714.33s | of different approaches. Some of them require sending all the vectors to the 714.33s - 718.05s | server, or some require some other stuff. They typically suffer from being slow, 718.05s - 722.25s | and you would have to build your own vector database, and be another logo on 722.25s - 725.65s | that wall, and compete with all the other vector databases on every other thing. 725.65s - 730.29s | The other option is partially homomorphic encryption, and the idea here 730.29s - 734.21s | is that something that's partially homomorphic is, is able to do some 734.25s - 738.53s | operations, but not arbitrary operations. And in this case, we're talking about 738.53s - 744.49s | optimizing for that nearest neighbor search type of operation. Okay, so in this, 744.49s - 749.37s | in this example, partially homomorphic, specific


chunk_text:
there's two approaches to 698.89s - 702.57s | this, at least in academia, that you could do. One is fully homomorphic encryption, 702.57s - 707.81s | and the other is partially homomorphic. So fully homomorphic encryption, there's 707.81s - 710.45s | actually quite a few papers on this, and they're fairly interesting. There's a lot 710.45s - 714.33s | of different approaches. Some of them require sending all the vectors to the 714.33s - 718.05s | server, or some require some other stuff. They typically suffer from being slow, 718.05s - 722.25s | and you would have to build your own vector database, and be another logo on 722.25s - 725.65s | that wall, and compete with all the other vector databases on every other thing. 725.65s - 730.29s | The other option is partially homomorphic encryption, and the idea here 730.29s - 734.21s | is that something that's partially homomorphic is, is able to do some 734.25s - 738.53s | operations, but not arbitrary operations. And in this case, we're talking about 738.53s - 744.49s | optimizing for that nearest neighbor search type of operation. Okay, so in this, 744.49s - 749.37s | in this example, partially homomorphic, specific to nearest neighbor searches. 749.37s - 754.65s | And to talk more about this paper, and the work that we've done around it, I'm 754.65s - 765.24s | going to turn it over to Bob. All right, we found this paper about a way to 765.48s - 770.76s | encrypt vectors, and you can see the title, Approximate Distance Comparison 770.76s - 778.16s | Preserving Symmetric Encryption. So that's a mouthful, but the, this algorithm 778.16s - 782.48s | is a type of property preserving encryption, which means it's kind of like 782.48s - 786.76s | order preserving encryption, or maybe deterministic encryption, if you've heard 786.76s - 790.88s | of those. The property that this algorithm is preserving, though, is 791.28s - 797.56s | distance comparison instead of equality or order. And so if you can preserve the 797.56s - 802.28s | ability to compare the distance between two vectors after they've been encrypted, 802.60s - 807.00s | that means your vector database continues to work on the encrypted vectors just as 807.00s - 812.92s | well as it did on the original vectors. So like deterministic and order preserving 812.92s - 819.56s | encryption, there's a trade off.


chunk_text:
to nearest neighbor searches. 749.37s - 754.65s | And to talk more about this paper, and the work that we've done around it, I'm 754.65s - 765.24s | going to turn it over to Bob. All right, we found this paper about a way to 765.48s - 770.76s | encrypt vectors, and you can see the title, Approximate Distance Comparison 770.76s - 778.16s | Preserving Symmetric Encryption. So that's a mouthful, but the, this algorithm 778.16s - 782.48s | is a type of property preserving encryption, which means it's kind of like 782.48s - 786.76s | order preserving encryption, or maybe deterministic encryption, if you've heard 786.76s - 790.88s | of those. The property that this algorithm is preserving, though, is 791.28s - 797.56s | distance comparison instead of equality or order. And so if you can preserve the 797.56s - 802.28s | ability to compare the distance between two vectors after they've been encrypted, 802.60s - 807.00s | that means your vector database continues to work on the encrypted vectors just as 807.00s - 812.92s | well as it did on the original vectors. So like deterministic and order preserving 812.92s - 819.56s | encryption, there's a trade off. The more secure you make it, the less well the 819.56s - 824.76s | compare, the property is preserved, and so the less well queries might work on 824.76s - 828.88s | the data. So you can kind of make a, you have a decision to make about whether 828.88s - 832.72s | you want a lot of security, and you can tolerate maybe a little less accuracy on 832.72s - 836.44s | queries, or you want a lot of accuracy on the queries, and maybe you'll have a 836.44s - 843.16s | little bit less protection of the data. But the system works by, if you've got a 843.16s - 847.08s | system that's ingesting data, and it's making these vectors, putting them into a 847.08s - 851.96s | vector database, it's easy to add this encryption. You just, in the system 851.96s - 856.16s | that's already there, after you've taken the data and run it through the 856.16s - 859.32s | embedding model and generated the vector embedding, you run it through this 859.32s - 864.24s | algorithm and encrypt it, it's still a vector, it looks similar enough to the 864.24s - 869.64s | original vector


chunk_text:
The more secure you make it, the less well the 819.56s - 824.76s | compare, the property is preserved, and so the less well queries might work on 824.76s - 828.88s | the data. So you can kind of make a, you have a decision to make about whether 828.88s - 832.72s | you want a lot of security, and you can tolerate maybe a little less accuracy on 832.72s - 836.44s | queries, or you want a lot of accuracy on the queries, and maybe you'll have a 836.44s - 843.16s | little bit less protection of the data. But the system works by, if you've got a 843.16s - 847.08s | system that's ingesting data, and it's making these vectors, putting them into a 847.08s - 851.96s | vector database, it's easy to add this encryption. You just, in the system 851.96s - 856.16s | that's already there, after you've taken the data and run it through the 856.16s - 859.32s | embedding model and generated the vector embedding, you run it through this 859.32s - 864.24s | algorithm and encrypt it, it's still a vector, it looks similar enough to the 864.24s - 869.64s | original vector that the vector database is gonna take it and be happy with it. So 869.64s - 873.84s | you, you'd use a secret key, you encrypt the vector, you throw it in the vector 873.84s - 879.96s | database. So very simple change to the system to be able to do that. Now most of 879.96s - 884.32s | these vector database systems support storing metadata along with the vectors, 884.32s - 889.44s | and that metadata might have some sensitive data in it too, so you might 889.44s - 892.92s | want to consider encrypting that, that's a whole different thing, we're just gonna 892.92s - 897.54s | focus on the vectors for right now. So once you've got all of these vectors 897.54s - 902.04s | encrypted, you've loaded them into your vector database, when it's time to do a 902.08s - 906.84s | query, it's also pretty simple. Again, you, you know, the normal process would be to 906.84s - 910.56s | take the query, run it through the embedding model, get a vector, so then you 910.56s - 915.28s | just encrypt that vector with the same key and the same algorithm, and then you 915.28s


chunk_text:
that the vector database is gonna take it and be happy with it. So 869.64s - 873.84s | you, you'd use a secret key, you encrypt the vector, you throw it in the vector 873.84s - 879.96s | database. So very simple change to the system to be able to do that. Now most of 879.96s - 884.32s | these vector database systems support storing metadata along with the vectors, 884.32s - 889.44s | and that metadata might have some sensitive data in it too, so you might 889.44s - 892.92s | want to consider encrypting that, that's a whole different thing, we're just gonna 892.92s - 897.54s | focus on the vectors for right now. So once you've got all of these vectors 897.54s - 902.04s | encrypted, you've loaded them into your vector database, when it's time to do a 902.08s - 906.84s | query, it's also pretty simple. Again, you, you know, the normal process would be to 906.84s - 910.56s | take the query, run it through the embedding model, get a vector, so then you 910.56s - 915.28s | just encrypt that vector with the same key and the same algorithm, and then you 915.28s - 919.12s | do your normal search. And because the algorithm, the encryption, preserves 919.12s - 923.76s | distance comparison, that means that when you give that encrypted query to the 923.76s - 928.24s | vector database, it's gonna return the encrypted vectors that are closest to 928.24s - 933.60s | the encrypted query, and those are gonna correspond to the decrypted vectors, the 933.60s - 938.08s | original vectors, that are closest to the original query. So you get the same 938.08s - 944.52s | results out, pretty much, and once you get them out, you can maybe decrypt the 944.52s - 948.36s | vectors if you need to, or maybe you've got some metadata that lets you look up 948.36s - 955.04s | the associated data in a database or something else. So without the key, an 955.04s - 960.28s | attacker can't really understand the queries. They're, they are enough different 960.28s - 964.32s | that they can't look at that and kind of know what the query was. They can't 964.32s - 968.48s | invert the data that's in the database, even if they hacked it, exfiltrated all 968.48s - 975.04s | the data, they can't


chunk_text:
- 919.12s | do your normal search. And because the algorithm, the encryption, preserves 919.12s - 923.76s | distance comparison, that means that when you give that encrypted query to the 923.76s - 928.24s | vector database, it's gonna return the encrypted vectors that are closest to 928.24s - 933.60s | the encrypted query, and those are gonna correspond to the decrypted vectors, the 933.60s - 938.08s | original vectors, that are closest to the original query. So you get the same 938.08s - 944.52s | results out, pretty much, and once you get them out, you can maybe decrypt the 944.52s - 948.36s | vectors if you need to, or maybe you've got some metadata that lets you look up 948.36s - 955.04s | the associated data in a database or something else. So without the key, an 955.04s - 960.28s | attacker can't really understand the queries. They're, they are enough different 960.28s - 964.32s | that they can't look at that and kind of know what the query was. They can't 964.32s - 968.48s | invert the data that's in the database, even if they hacked it, exfiltrated all 968.48s - 975.04s | the data, they can't easily invert it. The results are still fairly accurate. Again, 975.04s - 980.12s | that's a trade-off between the security and the accuracy of their searches. The 980.12s - 985.04s | whole thing is, it introduces a negligible penalty in terms of 985.04s - 991.16s | performance. The encryption process is fast, so you can add this in and not add 991.16s - 996.12s | a lot of time to your process. So I'm gonna talk a little bit more about this 996.12s - 1002.44s | encryption function. So it's a function, it maps inputs to outputs, and it does it 1002.44s - 1007.44s | such that for any distance function, the margin of error that you get when you 1007.44s - 1012.00s | compare two encrypted vectors will be within some factor, we'll call that beta, 1012.00s - 1017.16s | the approximation factor, of the original distance. And so if you can build a 1017.16s - 1021.24s | function that preserves that for any pair of vectors that you give 1021.24s - 1026.48s | as an input, then you have a distance comparison preserving encryption 1026.48s - 1031.84s | function. So in real systems, we kind of talked about


chunk_text:
easily invert it. The results are still fairly accurate. Again, 975.04s - 980.12s | that's a trade-off between the security and the accuracy of their searches. The 980.12s - 985.04s | whole thing is, it introduces a negligible penalty in terms of 985.04s - 991.16s | performance. The encryption process is fast, so you can add this in and not add 991.16s - 996.12s | a lot of time to your process. So I'm gonna talk a little bit more about this 996.12s - 1002.44s | encryption function. So it's a function, it maps inputs to outputs, and it does it 1002.44s - 1007.44s | such that for any distance function, the margin of error that you get when you 1007.44s - 1012.00s | compare two encrypted vectors will be within some factor, we'll call that beta, 1012.00s - 1017.16s | the approximation factor, of the original distance. And so if you can build a 1017.16s - 1021.24s | function that preserves that for any pair of vectors that you give 1021.24s - 1026.48s | as an input, then you have a distance comparison preserving encryption 1026.48s - 1031.84s | function. So in real systems, we kind of talked about this, the comparison 1031.84s - 1035.48s | function is used for nearest neighbor and approximate nearest neighbor 1035.56s - 1040.76s | searches, which is what all these vector databases are doing. So, you know, if we 1040.76s - 1044.56s | can build, and we can, we've built this function that preserves distance 1044.56s - 1050.08s | comparison so we can use it to encrypt these vectors. So the paper introduced 1050.08s - 1055.00s | this scale and perturb algorithm, and I won't go into a lot of details about how 1055.00s - 1061.52s | it works, but I will give you a few key points about it. So there's a scale 1061.60s - 1066.56s | factor, when you, when you set up the algorithm, you randomly choose this scale 1066.56s - 1075.94s | factor and you choose a random key. And so there's also, when you go to encrypt 1075.94s - 1081.94s | an individual vector, you generate an initialization vector, an IV value, just 1081.94s - 1085.90s | the same as you might if you're doing symmetric encryption on data with, 1085.90s - 1092.98s | you know, a normal symmetric algorithm. And you perturb each element of the 1092.98s


chunk_text:
this, the comparison 1031.84s - 1035.48s | function is used for nearest neighbor and approximate nearest neighbor 1035.56s - 1040.76s | searches, which is what all these vector databases are doing. So, you know, if we 1040.76s - 1044.56s | can build, and we can, we've built this function that preserves distance 1044.56s - 1050.08s | comparison so we can use it to encrypt these vectors. So the paper introduced 1050.08s - 1055.00s | this scale and perturb algorithm, and I won't go into a lot of details about how 1055.00s - 1061.52s | it works, but I will give you a few key points about it. So there's a scale 1061.60s - 1066.56s | factor, when you, when you set up the algorithm, you randomly choose this scale 1066.56s - 1075.94s | factor and you choose a random key. And so there's also, when you go to encrypt 1075.94s - 1081.94s | an individual vector, you generate an initialization vector, an IV value, just 1081.94s - 1085.90s | the same as you might if you're doing symmetric encryption on data with, 1085.90s - 1092.98s | you know, a normal symmetric algorithm. And you perturb each element of the 1092.98s - 1099.06s | vector using that key in that initialization vector randomly. So every 1099.06s - 1101.94s | element in the vector is going to get wiggled around a little bit, and that 1101.94s - 1106.22s | amount that it gets wiggled around depends on that value beta, that 1106.22s - 1111.98s | approximation value, and that's how it limits the change in the distance that 1111.98s - 1120.14s | you can get. So the paper had this idea of perturbing the vectors as well, and 1120.14s - 1123.74s | they basically had this idea of shuffling. If you had all of the vectors 1123.74s - 1128.82s | you would shuffle the order of them before you encrypted them, and we wanted 1128.82s - 1133.26s | an online algorithm so that you could, you know, you just encrypted the vectors 1133.26s - 1138.90s | as you saw them. So we didn't find that shuffling to be beneficial, but we did 1138.90s - 1143.70s | add a shuffle where we took the elements of the vector and shuffled them up. So we 1143.70s - 1147.74s | randomly changed the order, and it's a deterministic shuffling based on the key. 1147.74s -


chunk_text:
- 1099.06s | vector using that key in that initialization vector randomly. So every 1099.06s - 1101.94s | element in the vector is going to get wiggled around a little bit, and that 1101.94s - 1106.22s | amount that it gets wiggled around depends on that value beta, that 1106.22s - 1111.98s | approximation value, and that's how it limits the change in the distance that 1111.98s - 1120.14s | you can get. So the paper had this idea of perturbing the vectors as well, and 1120.14s - 1123.74s | they basically had this idea of shuffling. If you had all of the vectors 1123.74s - 1128.82s | you would shuffle the order of them before you encrypted them, and we wanted 1128.82s - 1133.26s | an online algorithm so that you could, you know, you just encrypted the vectors 1133.26s - 1138.90s | as you saw them. So we didn't find that shuffling to be beneficial, but we did 1138.90s - 1143.70s | add a shuffle where we took the elements of the vector and shuffled them up. So we 1143.70s - 1147.74s | randomly changed the order, and it's a deterministic shuffling based on the key. 1147.74s - 1153.26s | So when you get done, all of the elements in the vector have been scaled, and then 1153.26s - 1157.38s | they get shifted around, which makes it even harder if, even if you knew what the 1157.38s - 1161.78s | algorithm, what the embedding model was, all of the elements of the vector are in 1161.78s - 1165.54s | different places, which makes it a lot harder to look at it and try to even 1165.54s - 1173.68s | guess how it corresponds to the original vectors. So to give a little bit of a more 1173.68s - 1178.88s | intuition about this, you can think about these vectors, I mean, a vector is a line 1178.88s - 1184.22s | from the origin to some point, and the point is defined by the elements in the 1184.22s - 1190.30s | vector, right? Those are the coordinates of that point. And so the beta basically 1190.30s - 1196.70s | defines a sphere in n-dimensional space around that point. And so as we perturb 1196.70s - 1202.06s | the elements of the vector, the resulting point is somewhere within that sphere, and 1202.06s - 1206.30s | the size of


chunk_text:
1153.26s | So when you get done, all of the elements in the vector have been scaled, and then 1153.26s - 1157.38s | they get shifted around, which makes it even harder if, even if you knew what the 1157.38s - 1161.78s | algorithm, what the embedding model was, all of the elements of the vector are in 1161.78s - 1165.54s | different places, which makes it a lot harder to look at it and try to even 1165.54s - 1173.68s | guess how it corresponds to the original vectors. So to give a little bit of a more 1173.68s - 1178.88s | intuition about this, you can think about these vectors, I mean, a vector is a line 1178.88s - 1184.22s | from the origin to some point, and the point is defined by the elements in the 1184.22s - 1190.30s | vector, right? Those are the coordinates of that point. And so the beta basically 1190.30s - 1196.70s | defines a sphere in n-dimensional space around that point. And so as we perturb 1196.70s - 1202.06s | the elements of the vector, the resulting point is somewhere within that sphere, and 1202.06s - 1206.30s | the size of that sphere is governed by that beta value, the approximation 1206.30s - 1212.42s | factor. So you can see that if you, if you bound the amount that you can move the 1212.42s - 1216.58s | point around, and you've bound the amount that you've moved another point around, 1216.58s - 1221.30s | the distance between those is bounded too. So that's how it manages to preserve the 1221.30s - 1227.58s | distance comparison. So in addition, we talked about, we also scaled the vectors up 1227.58s - 1231.26s | so that they're, you know, they get moved around a little bit, they get scaled, so 1231.26s - 1235.18s | when, if you just look at them, and then the elements get shuffled, so it's very 1235.18s - 1241.18s | difficult to correlate an encrypted vector and the original vector that was encrypted. 1241.18s - 1247.74s | Again, because we've preserved that distance comparison, they're still relatively 1247.74s - 1255.38s | close together to, with each other. Here's an example. We kind of turned off the shuffle 1255.38s - 1259.50s | part of it so it wouldn't be quite as difficult to see, but you can see, you know, we


chunk_text:
that sphere is governed by that beta value, the approximation 1206.30s - 1212.42s | factor. So you can see that if you, if you bound the amount that you can move the 1212.42s - 1216.58s | point around, and you've bound the amount that you've moved another point around, 1216.58s - 1221.30s | the distance between those is bounded too. So that's how it manages to preserve the 1221.30s - 1227.58s | distance comparison. So in addition, we talked about, we also scaled the vectors up 1227.58s - 1231.26s | so that they're, you know, they get moved around a little bit, they get scaled, so 1231.26s - 1235.18s | when, if you just look at them, and then the elements get shuffled, so it's very 1235.18s - 1241.18s | difficult to correlate an encrypted vector and the original vector that was encrypted. 1241.18s - 1247.74s | Again, because we've preserved that distance comparison, they're still relatively 1247.74s - 1255.38s | close together to, with each other. Here's an example. We kind of turned off the shuffle 1255.38s - 1259.50s | part of it so it wouldn't be quite as difficult to see, but you can see, you know, we 1259.50s - 1264.30s | scaled it up, and then we perturb everything. So sometimes, depending on how much we 1264.30s - 1268.78s | perturb stuff, signs on elements might change, you know, they bounce around a little 1268.78s - 1276.94s | bit, but they're still in this vector. So we've implemented this algorithm. We've 1276.94s - 1282.18s | got an open source library we call IronCoreAlloy that's out there on GitHub. It's 1282.18s - 1288.86s | under the AGPL license, so if you can use GPL software, you can go grab it and use it. 1288.86s - 1296.10s | If you can't use GPL software, you can talk to us about a different arrangement. Along 1296.10s - 1299.50s | with the library, we've got some sample code that shows how you can use it with a 1299.50s - 1304.74s | number of different vector databases, and it, as I said earlier, it's easy. So the 1304.74s - 1308.98s | examples aren't super complicated. It's pretty easy to drop this into some code that's 1308.98s - 1313.74s | going to put data in one of these vector databases. The library isn't written in Rust, 1313.74s - 1318.74s | but we've exposed


chunk_text:
1259.50s - 1264.30s | scaled it up, and then we perturb everything. So sometimes, depending on how much we 1264.30s - 1268.78s | perturb stuff, signs on elements might change, you know, they bounce around a little 1268.78s - 1276.94s | bit, but they're still in this vector. So we've implemented this algorithm. We've 1276.94s - 1282.18s | got an open source library we call IronCoreAlloy that's out there on GitHub. It's 1282.18s - 1288.86s | under the AGPL license, so if you can use GPL software, you can go grab it and use it. 1288.86s - 1296.10s | If you can't use GPL software, you can talk to us about a different arrangement. Along 1296.10s - 1299.50s | with the library, we've got some sample code that shows how you can use it with a 1299.50s - 1304.74s | number of different vector databases, and it, as I said earlier, it's easy. So the 1304.74s - 1308.98s | examples aren't super complicated. It's pretty easy to drop this into some code that's 1308.98s - 1313.74s | going to put data in one of these vector databases. The library isn't written in Rust, 1313.74s - 1318.74s | but we've exposed it in Java, Kotlin, and Python. We've got some more language support 1318.74s - 1327.50s | on the way. Along with the examples, we've got some results of using this on some 1327.50s - 1336.74s | output of different LLMs, open source LLMs, and you can see for an approximation factor 1336.74s - 1343.10s | of one and a half, which is a pretty modest one, we don't impact the search performance. 1343.10s - 1346.70s | We measured precision and recall loss, which are pretty common measures of search 1346.78s - 1355.84s | accuracy. It didn't really impact the search accuracy much at all. So, you know, it works. 1355.84s - 1361.64s | So now, once we've encrypted these vectors, suppose we want to run an attack on them. 1361.64s - 1366.96s | We're going to run on one of the inversion models that Patrick was talking about. So 1366.96s - 1371.88s | we know exactly, somehow we know exactly what the embedding model was that was used. It 1371.88s - 1375.88s | was an open source one, so we don't have to, we train this up once and it's going to work 1375.88s - 1380.64s | on every embedding


chunk_text:
it in Java, Kotlin, and Python. We've got some more language support 1318.74s - 1327.50s | on the way. Along with the examples, we've got some results of using this on some 1327.50s - 1336.74s | output of different LLMs, open source LLMs, and you can see for an approximation factor 1336.74s - 1343.10s | of one and a half, which is a pretty modest one, we don't impact the search performance. 1343.10s - 1346.70s | We measured precision and recall loss, which are pretty common measures of search 1346.78s - 1355.84s | accuracy. It didn't really impact the search accuracy much at all. So, you know, it works. 1355.84s - 1361.64s | So now, once we've encrypted these vectors, suppose we want to run an attack on them. 1361.64s - 1366.96s | We're going to run on one of the inversion models that Patrick was talking about. So 1366.96s - 1371.88s | we know exactly, somehow we know exactly what the embedding model was that was used. It 1371.88s - 1375.88s | was an open source one, so we don't have to, we train this up once and it's going to work 1375.88s - 1380.64s | on every embedding that was generated by that embedding model. But we're going to try 1380.64s - 1386.52s | to run it on the encrypted vectors. Well, it turns out because we've done the perturbation 1386.52s - 1395.00s | and we shifted around all of the elements, okay, we, it's mostly gibberish that we get 1395.00s - 1404.16s | out. So, you really can't tell much about them. Even if somebody knows the plaintext 1404.16s - 1411.00s | and they have a black box access to the model and they're going to submit vectors, get encrypted 1411.00s - 1415.60s | vectors out for a particular key and they're going to train their own inversion model, 1415.60s - 1421.04s | the randomization makes that so that it's very difficult and you get a lot less valuable 1421.04s - 1428.08s | results. You might get a little bit of the meaning. You're not going to get exact words. 1428.08s - 1436.56s | And if you, and again, it depends on what value you use for that approximation model. 1436.56s - 1442.68s | If you knew the plaintext and you knew the ciphertext, can you extract the key? No. It's 1442.68s - 1449.72s | based on


chunk_text:
that was generated by that embedding model. But we're going to try 1380.64s - 1386.52s | to run it on the encrypted vectors. Well, it turns out because we've done the perturbation 1386.52s - 1395.00s | and we shifted around all of the elements, okay, we, it's mostly gibberish that we get 1395.00s - 1404.16s | out. So, you really can't tell much about them. Even if somebody knows the plaintext 1404.16s - 1411.00s | and they have a black box access to the model and they're going to submit vectors, get encrypted 1411.00s - 1415.60s | vectors out for a particular key and they're going to train their own inversion model, 1415.60s - 1421.04s | the randomization makes that so that it's very difficult and you get a lot less valuable 1421.04s - 1428.08s | results. You might get a little bit of the meaning. You're not going to get exact words. 1428.08s - 1436.56s | And if you, and again, it depends on what value you use for that approximation model. 1436.56s - 1442.68s | If you knew the plaintext and you knew the ciphertext, can you extract the key? No. It's 1442.68s - 1449.72s | based on a probabilistic random function that's essentially like a 256-bit keyed hash. And 1449.72s - 1453.24s | I don't know about you, but I don't want to spend my next two billion weekends trying 1453.24s - 1460.24s | to brute force attack a 256-bit keyed hash. So, I'm going to turn it over to Patrick and 1460.24s - 1465.37s | he'll summarize for you. 1465.37s - 1473.53s | Okay. So, okay. So, the takeaways that we hope you have here as we just did a real brief 1473.53s - 1478.65s | fast run through on what this is and how it works is first and foremost, you should walk 1478.65s - 1484.65s | away realizing that RAG produces a lot of copies of data. So, if people are using AI 1484.65s - 1491.13s | and LLMs in their applications and somehow that they're operating over data that model 1491.13s - 1495.81s | wasn't trained on, probably they're doing this and probably lots of copies of that data 1495.81s - 1501.53s | are being made. It's sprinkled everywhere. And vector databases are like a key part of 1501.53s - 1507.93s | that. Second thing is that vectors and vector databases can be


chunk_text:
a probabilistic random function that's essentially like a 256-bit keyed hash. And 1449.72s - 1453.24s | I don't know about you, but I don't want to spend my next two billion weekends trying 1453.24s - 1460.24s | to brute force attack a 256-bit keyed hash. So, I'm going to turn it over to Patrick and 1460.24s - 1465.37s | he'll summarize for you. 1465.37s - 1473.53s | Okay. So, okay. So, the takeaways that we hope you have here as we just did a real brief 1473.53s - 1478.65s | fast run through on what this is and how it works is first and foremost, you should walk 1478.65s - 1484.65s | away realizing that RAG produces a lot of copies of data. So, if people are using AI 1484.65s - 1491.13s | and LLMs in their applications and somehow that they're operating over data that model 1491.13s - 1495.81s | wasn't trained on, probably they're doing this and probably lots of copies of that data 1495.81s - 1501.53s | are being made. It's sprinkled everywhere. And vector databases are like a key part of 1501.53s - 1507.93s | that. Second thing is that vectors and vector databases can be inverted back to their original 1508.01s - 1515.53s | input or something very closely approximating it, right? High fidelity and low effort attack. 1515.53s - 1519.13s | And oftentimes an attacker won't even need to do that. If they have access to the chat app, 1519.13s - 1523.61s | they can bypass that even. But never mind. If they have access to the vector database, 1523.61s - 1528.97s | that's as good as having access to the chat app, right? And then the third takeaway that 1528.97s - 1534.73s | we want you to walk away with is this. It isn't that hard in this case because there's a built 1534.73s - 1541.77s | open source library to implement a solution to this problem in your software. So, if you 1541.77s - 1548.41s | want to, feel free. Check out the results. Go try it online. The results you get in a vector 1548.41s - 1553.69s | search are really close to the original. Like it looks the same to me pretty much across the board. 1553.69s - 1558.01s | The benchmarks show a few percent differences. There's almost no performance penalty. 1558.01s - 1563.05s | From a latency perspective,


chunk_text:
inverted back to their original 1508.01s - 1515.53s | input or something very closely approximating it, right? High fidelity and low effort attack. 1515.53s - 1519.13s | And oftentimes an attacker won't even need to do that. If they have access to the chat app, 1519.13s - 1523.61s | they can bypass that even. But never mind. If they have access to the vector database, 1523.61s - 1528.97s | that's as good as having access to the chat app, right? And then the third takeaway that 1528.97s - 1534.73s | we want you to walk away with is this. It isn't that hard in this case because there's a built 1534.73s - 1541.77s | open source library to implement a solution to this problem in your software. So, if you 1541.77s - 1548.41s | want to, feel free. Check out the results. Go try it online. The results you get in a vector 1548.41s - 1553.69s | search are really close to the original. Like it looks the same to me pretty much across the board. 1553.69s - 1558.01s | The benchmarks show a few percent differences. There's almost no performance penalty. 1558.01s - 1563.05s | From a latency perspective, there's almost no reason not to encrypt your vectors if they 1563.05s - 1568.57s | contain sensitive data in them. And that's it. Thanks for your time today. We're going to be out 1568.57s - 1572.97s | there probably just outside the Creator Stage area if people want to chat with us or have any 1572.97s - 1575.13s | questions. Thanks for your time.


chunk_text:
there's almost no reason not to encrypt your vectors if they 1563.05s - 1568.57s | contain sensitive data in them. And that's it. Thanks for your time today. We're going to be out 1568.57s - 1572.97s | there probably just outside the Creator Stage area if people want to chat with us or have any 1572.97s - 1575.13s | questions. Thanks for your time.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=O48DBFT02eU", "title": "DEF CON 32 - Simulating attacks against hydroelectric power plants - Julia Dewitz-W\u00fcrzelberger", "description": "In this talk we will present the ICS firing range we built and hacked to simulate an actual attack against a hydroelectric power plant and create a DFIR training from the evidence left behind. The talk aims to emphasize the importance of attack simulation in the context of critical infrastructure and the potential benefit that firing ranges can provide to such assessments.\n\nFirst we will examine the motivation behind the construction and usage of a firing range, covering various aspects including:\n\nthe threats operators of critical infrastructure face,\nhow security assessments are conducted in an OT context and\nhow an ICS firing range can be utilized to support them.\nNext we will discuss the intended use cases of the firing range and the scenario it was made to display, the flooding of a hydroelectric power plant. As a result, the relevant components and production processes of the plant will be outlined. Then we will present and go into detail about the design & architecture of the firing range:\n\nindividual physical and virtual networks and components,\nseparate Active Directory environments,\nimplemented security measures\nspecific vulnerabilities intentionally left behind.\nPicking up this last bullet-point, we continue with how we hacked the firing range and performed a Red Team assessment against it, simulating an actual attack. Starting with the C2 infrastructure we set up for the attack, we will guide the audience through the kill chain in chronological order and highlight the most important and relevant steps of the attack.\n\nOnce the offensive part of the talk concludes, a shift of perspective takes place and the attack is evaluated from the defence's point-of-view: we'll show how we identified, secured and analyzed indicators of compromise left behind by the attack. This includes the analysis of network captures, Windows event logs, memory dumps and more.\n\nThis talk will be presented by not only people from NVISO as the IT security service provider who built the firing range and performed to attack against it, but also by people from VERBUND's IT security team who actively use the firing range for training. This way we can involve both the attacker's and the defence's point-of-view.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1360, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.16s | This text was transcribed using whisper model: large-v2 Thanks for your patience, thanks for your interest in this talk today. 4.16s -


chunk_text:
we continue with how we hacked the firing range and performed a Red Team assessment against it, simulating an actual attack. Starting with the C2 infrastructure we set up for the attack, we will guide the audience through the kill chain in chronological order and highlight the most important and relevant steps of the attack.\n\nOnce the offensive part of the talk concludes, a shift of perspective takes place and the attack is evaluated from the defence's point-of-view: we'll show how we identified, secured and analyzed indicators of compromise left behind by the attack. This includes the analysis of network captures, Windows event logs, memory dumps and more.\n\nThis talk will be presented by not only people from NVISO as the IT security service provider who built the firing range and performed to attack against it, but also by people from VERBUND's IT security team who actively use the firing range for training. This way we can involve both the attacker's and the defence's point-of-view.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1360, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.16s | This text was transcribed using whisper model: large-v2 Thanks for your patience, thanks for your interest in this talk today. 4.16s - 7.92s | My colleagues and I, Sarah, Bernhard and I, my name is Julia, 7.92s - 11.68s | we will talk about a project that we made together, a joint project, 11.68s - 15.84s | and we actually created a run-of-river prototype together. 15.84s - 26.24s | Since Verbund is a hydropower energy supplier in Austria, 26.24s - 29.28s | actually, especially in the field of renewable energy, 29.28s - 32.00s | like hydropower, solar power and wind power, 32.00s - 34.72s | and maybe you just want to say a few words about Enviso. 36.24s - 42.48s | Yes, hi everybody. Enviso is a security consulting company from Europe. 42.48s - 47.84s | We are mainly focused on the financial and technology sector 47.84s - 50.80s | and also the governmental and critical infrastructures. 51.44s - 54.80s | So, I want to use the moment, since this was a team effort, 54.80s - 56.48s | to give a shout-out to a few people. 56.48s - 62.64s | So, great thanks to Alex, Moritz, Olaf, Nicolas, Vanessa and Patrick. 64.00s - 64.64s | Thanks, Sarah. 65.20s - 68.00s | Okay, so as I said, it's about a prototype that we


chunk_text:
7.92s | My colleagues and I, Sarah, Bernhard and I, my name is Julia, 7.92s - 11.68s | we will talk about a project that we made together, a joint project, 11.68s - 15.84s | and we actually created a run-of-river prototype together. 15.84s - 26.24s | Since Verbund is a hydropower energy supplier in Austria, 26.24s - 29.28s | actually, especially in the field of renewable energy, 29.28s - 32.00s | like hydropower, solar power and wind power, 32.00s - 34.72s | and maybe you just want to say a few words about Enviso. 36.24s - 42.48s | Yes, hi everybody. Enviso is a security consulting company from Europe. 42.48s - 47.84s | We are mainly focused on the financial and technology sector 47.84s - 50.80s | and also the governmental and critical infrastructures. 51.44s - 54.80s | So, I want to use the moment, since this was a team effort, 54.80s - 56.48s | to give a shout-out to a few people. 56.48s - 62.64s | So, great thanks to Alex, Moritz, Olaf, Nicolas, Vanessa and Patrick. 64.00s - 64.64s | Thanks, Sarah. 65.20s - 68.00s | Okay, so as I said, it's about a prototype that we built, 68.00s - 71.36s | or specifically Enviso did a lot of the creating process. 72.00s - 75.84s | And we chose a run-of-river power plant, hydropower plant, 75.84s - 79.60s | to visualize the effects of a cyber attack on such a plant. 81.36s - 84.64s | So, it's not only like a visual awareness tool, 84.64s - 87.68s | it's also supposed to be a forensic training tool. 87.68s - 91.20s | So, what also is included in this ICS firing range... 96.30s - 98.62s | Okay, I hope you can still hear me. 100.46s - 105.98s | Okay, but in fact, we really tried to also include a forensic training 105.98s - 110.06s | in the ICS firing range that has more than, I think, 10 modules. 110.06s - 111.10s | I think it's 15. 111.66s - 113.50s | And Bernhard will get into that a bit later, 113.50s - 116.94s | but you can really investigate a forensic training 116.94s - 119.82s | in how the cyber attack on a run-of-river power plant worked. 123.44s - 125.36s | Motivation and project idea. 127.78s - 128.28s | Thank you. 129.22s - 133.54s | So, what was the


chunk_text:
built, 68.00s - 71.36s | or specifically Enviso did a lot of the creating process. 72.00s - 75.84s | And we chose a run-of-river power plant, hydropower plant, 75.84s - 79.60s | to visualize the effects of a cyber attack on such a plant. 81.36s - 84.64s | So, it's not only like a visual awareness tool, 84.64s - 87.68s | it's also supposed to be a forensic training tool. 87.68s - 91.20s | So, what also is included in this ICS firing range... 96.30s - 98.62s | Okay, I hope you can still hear me. 100.46s - 105.98s | Okay, but in fact, we really tried to also include a forensic training 105.98s - 110.06s | in the ICS firing range that has more than, I think, 10 modules. 110.06s - 111.10s | I think it's 15. 111.66s - 113.50s | And Bernhard will get into that a bit later, 113.50s - 116.94s | but you can really investigate a forensic training 116.94s - 119.82s | in how the cyber attack on a run-of-river power plant worked. 123.44s - 125.36s | Motivation and project idea. 127.78s - 128.28s | Thank you. 129.22s - 133.54s | So, what was the motivation for two companies like us to create such a prototype? 133.54s - 137.14s | So, for Brint, it was especially that we are critical infrastructure. 138.10s - 141.06s | We are a really large power supplier in Austria. 141.06s - 145.38s | So, of course, IoT cybersecurity is like one of our biggest priorities. 146.10s - 148.90s | And since all of us three are from this section, 149.54s - 152.18s | we really wanted to do an innovative project together. 153.22s - 159.22s | And what actually is also one of the most motivational parts for this project was 159.22s - 163.86s | that for Brint is planning to build a really big cyber security range 163.86s - 169.14s | focused on IoT in Austria, in Styria, at a local site of a plant. 169.14s - 172.66s | And we really want to get all the IoT specialists there from for Brint, 172.66s - 177.30s | but also externals to train there and to get their cybersecurity knowledge up. 177.86s - 183.54s | So, first, we wanted to have a prototype before we really build a really big cyber range. 184.34s - 186.42s | That was one of


chunk_text:
motivation for two companies like us to create such a prototype? 133.54s - 137.14s | So, for Brint, it was especially that we are critical infrastructure. 138.10s - 141.06s | We are a really large power supplier in Austria. 141.06s - 145.38s | So, of course, IoT cybersecurity is like one of our biggest priorities. 146.10s - 148.90s | And since all of us three are from this section, 149.54s - 152.18s | we really wanted to do an innovative project together. 153.22s - 159.22s | And what actually is also one of the most motivational parts for this project was 159.22s - 163.86s | that for Brint is planning to build a really big cyber security range 163.86s - 169.14s | focused on IoT in Austria, in Styria, at a local site of a plant. 169.14s - 172.66s | And we really want to get all the IoT specialists there from for Brint, 172.66s - 177.30s | but also externals to train there and to get their cybersecurity knowledge up. 177.86s - 183.54s | So, first, we wanted to have a prototype before we really build a really big cyber range. 184.34s - 186.42s | That was one of the great motivations. 186.42s - 187.94s | Do you want to get into that? 188.50s - 189.22s | Okay. 189.22s - 194.66s | So, our main motivation is to strengthen the security resilience of our customers 195.46s - 203.54s | by building realistic attack scenarios that represent actual IoT cyber threats. 203.54s - 206.26s | So, we do this either in Red Team assessments or, as in this case, 206.26s - 212.18s | we're building a realistic training scenario for Brint. 214.18s - 217.22s | Different IoT environments has faced different challenges. 217.22s - 220.50s | Therefore, it was very important for us to create a tailored training approach 221.14s - 224.50s | that actually fit the requirements previously described by Julia. 225.54s - 245.10s | So, having a visible and practical approach like in the cyber range can help to make things 245.10s - 247.42s | more tangible and therefore to raise awareness. 257.42s - 260.46s | And finally, if you look at the current IoT threat landscape, 260.46s - 263.42s | you can see that the things are getting worse. 263.50s - 267.58s | And therefore, it's even more important to have proper training capabilities at hand 267.58s


chunk_text:
the great motivations. 186.42s - 187.94s | Do you want to get into that? 188.50s - 189.22s | Okay. 189.22s - 194.66s | So, our main motivation is to strengthen the security resilience of our customers 195.46s - 203.54s | by building realistic attack scenarios that represent actual IoT cyber threats. 203.54s - 206.26s | So, we do this either in Red Team assessments or, as in this case, 206.26s - 212.18s | we're building a realistic training scenario for Brint. 214.18s - 217.22s | Different IoT environments has faced different challenges. 217.22s - 220.50s | Therefore, it was very important for us to create a tailored training approach 221.14s - 224.50s | that actually fit the requirements previously described by Julia. 225.54s - 245.10s | So, having a visible and practical approach like in the cyber range can help to make things 245.10s - 247.42s | more tangible and therefore to raise awareness. 257.42s - 260.46s | And finally, if you look at the current IoT threat landscape, 260.46s - 263.42s | you can see that the things are getting worse. 263.50s - 267.58s | And therefore, it's even more important to have proper training capabilities at hand 267.58s - 272.38s | to increase the detection and response readiness 272.38s - 275.42s | of the people that actually have to deal with cyber incidents on site. 277.82s - 278.62s | Thanks, Sarah. 278.62s - 280.78s | So, as we said, let's summarize it. 280.78s - 284.38s | Two things were the main objectives for this project. 284.38s - 289.18s | It's awareness building for people who may only know a little bit about cybersecurity, 289.18s - 292.22s | but also forensic training for specialists in the field. 292.22s - 293.02s | Next slide, please. 297.41s - 300.53s | So, what is really important to us, as I told you, 300.53s - 303.33s | us three are from the field of IoT cybersecurity. 303.33s - 305.25s | So, we're not in operational field. 305.97s - 309.49s | We're not working directly in a power plant. 309.49s - 312.29s | So, we need to include the knowledge from internal colleagues, 312.29s - 316.05s | but also from manufacturers to gain really a good understanding 316.05s - 322.05s | of how an ICS firing range could look like an abstracted model of a hydropower plant, 322.05s - 326.85s | since it's not


chunk_text:
- 272.38s | to increase the detection and response readiness 272.38s - 275.42s | of the people that actually have to deal with cyber incidents on site. 277.82s - 278.62s | Thanks, Sarah. 278.62s - 280.78s | So, as we said, let's summarize it. 280.78s - 284.38s | Two things were the main objectives for this project. 284.38s - 289.18s | It's awareness building for people who may only know a little bit about cybersecurity, 289.18s - 292.22s | but also forensic training for specialists in the field. 292.22s - 293.02s | Next slide, please. 297.41s - 300.53s | So, what is really important to us, as I told you, 300.53s - 303.33s | us three are from the field of IoT cybersecurity. 303.33s - 305.25s | So, we're not in operational field. 305.97s - 309.49s | We're not working directly in a power plant. 309.49s - 312.29s | So, we need to include the knowledge from internal colleagues, 312.29s - 316.05s | but also from manufacturers to gain really a good understanding 316.05s - 322.05s | of how an ICS firing range could look like an abstracted model of a hydropower plant, 322.05s - 326.85s | since it's not exactly a realistic one, but as close as possible. 327.41s - 332.53s | And one of the really biggest inputs that we received from internal colleagues was, 332.53s - 334.37s | of course, as we have, I think, 334.37s - 338.13s | Verbund has already over 130 power plants in Austria. 338.93s - 343.01s | We really need to have a control room where all the measured data comes together 343.01s - 346.45s | and everyone can monetize the data that comes here 346.45s - 349.73s | and see if everything's all right in the plant itself. 350.29s - 356.45s | And we realized this kind of control room within an HMI on the ICS firing range, 356.45s - 359.73s | where you can also control the range in itself 359.73s - 362.29s | and you see all the measured data from the power plant. 362.29s - 366.13s | And you can also give an input as to, say, control the wares 366.13s - 368.85s | that is also included in this prototype. 368.85s - 371.57s | But also, for example, you can raise the water levels. 373.17s - 378.61s | And, yeah, so that was one of the main


chunk_text:
exactly a realistic one, but as close as possible. 327.41s - 332.53s | And one of the really biggest inputs that we received from internal colleagues was, 332.53s - 334.37s | of course, as we have, I think, 334.37s - 338.13s | Verbund has already over 130 power plants in Austria. 338.93s - 343.01s | We really need to have a control room where all the measured data comes together 343.01s - 346.45s | and everyone can monetize the data that comes here 346.45s - 349.73s | and see if everything's all right in the plant itself. 350.29s - 356.45s | And we realized this kind of control room within an HMI on the ICS firing range, 356.45s - 359.73s | where you can also control the range in itself 359.73s - 362.29s | and you see all the measured data from the power plant. 362.29s - 366.13s | And you can also give an input as to, say, control the wares 366.13s - 368.85s | that is also included in this prototype. 368.85s - 371.57s | But also, for example, you can raise the water levels. 373.17s - 378.61s | And, yeah, so that was one of the main important inputs that our people gave us. 378.61s - 384.05s | And we really tried to include it to make it as, you know, real as possible. 386.45s - 388.45s | Next, I want to give you some... 389.41s - 390.21s | Please, next slide. 394.48s - 397.84s | I want to give you some hard facts about the ICS firing range. 397.84s - 401.12s | As you can see, the project had a duration of around one year. 401.68s - 407.04s | One of the challenges was that our team is in Austria, Bernhard and my team, 407.04s - 408.72s | but Enviso is in Germany. 408.72s - 412.08s | I think most of them were in Frankfurt and we were in Vienna. 412.08s - 414.32s | So, of course, we had quite a big span. 415.12s - 419.28s | And many or actually all of our meetings were remote meetings. 419.28s - 420.72s | So, that's also a challenge. 420.72s - 424.08s | Bernhard will get into the challenges later a bit. 424.08s - 428.40s | But it's not so easy since we could not get together and build on it together. 428.96s - 431.28s | But I


chunk_text:
important inputs that our people gave us. 378.61s - 384.05s | And we really tried to include it to make it as, you know, real as possible. 386.45s - 388.45s | Next, I want to give you some... 389.41s - 390.21s | Please, next slide. 394.48s - 397.84s | I want to give you some hard facts about the ICS firing range. 397.84s - 401.12s | As you can see, the project had a duration of around one year. 401.68s - 407.04s | One of the challenges was that our team is in Austria, Bernhard and my team, 407.04s - 408.72s | but Enviso is in Germany. 408.72s - 412.08s | I think most of them were in Frankfurt and we were in Vienna. 412.08s - 414.32s | So, of course, we had quite a big span. 415.12s - 419.28s | And many or actually all of our meetings were remote meetings. 419.28s - 420.72s | So, that's also a challenge. 420.72s - 424.08s | Bernhard will get into the challenges later a bit. 424.08s - 428.40s | But it's not so easy since we could not get together and build on it together. 428.96s - 431.28s | But I think it still worked really well. 431.28s - 436.96s | And what I also think is really cool is that we had a lot of people in this project. 436.96s - 438.80s | So, now you're just seeing us three. 438.80s - 441.68s | But as Sarah mentioned at the beginning, it was really a team effort. 441.68s - 443.76s | We had over 30 people involved. 443.76s - 448.16s | We had students from the university in Vienna, the technical university in Vienna, 448.16s - 450.40s | who really programmed the cyber attack for us. 450.96s - 455.04s | And Enviso did the part of going into the construction. 455.04s - 457.36s | And that's why I want to give the mic to Sarah, 457.36s - 461.04s | because she will get into the construction and logical construction part now for you. 463.36s - 464.88s | Yeah, thank you, Julia. 464.88s - 467.12s | So, now we're getting into the more technical part. 467.12s - 470.72s | So, as you could see in the previous slide, the cyber range consists of two layers. 471.44s - 473.60s | So, on top, which is the slide that you can see now,


chunk_text:
think it still worked really well. 431.28s - 436.96s | And what I also think is really cool is that we had a lot of people in this project. 436.96s - 438.80s | So, now you're just seeing us three. 438.80s - 441.68s | But as Sarah mentioned at the beginning, it was really a team effort. 441.68s - 443.76s | We had over 30 people involved. 443.76s - 448.16s | We had students from the university in Vienna, the technical university in Vienna, 448.16s - 450.40s | who really programmed the cyber attack for us. 450.96s - 455.04s | And Enviso did the part of going into the construction. 455.04s - 457.36s | And that's why I want to give the mic to Sarah, 457.36s - 461.04s | because she will get into the construction and logical construction part now for you. 463.36s - 464.88s | Yeah, thank you, Julia. 464.88s - 467.12s | So, now we're getting into the more technical part. 467.12s - 470.72s | So, as you could see in the previous slide, the cyber range consists of two layers. 471.44s - 473.60s | So, on top, which is the slide that you can see now, 473.60s - 476.00s | is the scenario and visualization layer. 476.00s - 481.12s | Below that, we have the electric cabinet with all the technical components inside. 483.12s - 491.36s | The scenario and visualization layer has, at first, the modulated hydro power plants. 491.36s - 492.88s | So, we have a river, of course. 492.88s - 494.56s | We have head and tail water. 494.56s - 495.76s | We have a turbine building. 495.76s - 496.88s | And we have the weirs. 496.88s - 500.48s | So, we have one twin weir for the normal operations. 500.48s - 502.64s | And we have one emergency weir. 503.20s - 508.56s | Since you cannot look into this little building, to make things more tangible, 508.56s - 516.08s | we also added the HMI to the cyber range and also a model of the turbine, 516.08s - 519.92s | including the shutters that actually control the water flow that hits the turbine. 521.60s - 523.28s | Okay, next slide, please. 524.56s - 526.32s | Now, you can see the electric cabinet. 527.92s - 530.64s | Here, we have, at first, a few basic components, 530.64s - 535.36s | as, for example,


chunk_text:
473.60s - 476.00s | is the scenario and visualization layer. 476.00s - 481.12s | Below that, we have the electric cabinet with all the technical components inside. 483.12s - 491.36s | The scenario and visualization layer has, at first, the modulated hydro power plants. 491.36s - 492.88s | So, we have a river, of course. 492.88s - 494.56s | We have head and tail water. 494.56s - 495.76s | We have a turbine building. 495.76s - 496.88s | And we have the weirs. 496.88s - 500.48s | So, we have one twin weir for the normal operations. 500.48s - 502.64s | And we have one emergency weir. 503.20s - 508.56s | Since you cannot look into this little building, to make things more tangible, 508.56s - 516.08s | we also added the HMI to the cyber range and also a model of the turbine, 516.08s - 519.92s | including the shutters that actually control the water flow that hits the turbine. 521.60s - 523.28s | Okay, next slide, please. 524.56s - 526.32s | Now, you can see the electric cabinet. 527.92s - 530.64s | Here, we have, at first, a few basic components, 530.64s - 535.36s | as, for example, power supply and general safety and controlling equipment. 535.36s - 540.40s | So, on the upper left, we have the contactor and electronic circuit breaker 540.40s - 541.84s | that handle electric faults. 542.56s - 547.28s | Additionally, we have the PSUs that provide 5, 12, or 24 volts 547.28s - 550.16s | to the different components of the cyber range. 550.16s - 554.40s | And below that, we have the terminal blocks that are used for the distribution of the power. 555.04s - 562.64s | The heart for our cyber range is a network of programmable logic controllers 563.20s - 566.72s | and Raspberry Pis that are orchestrated to emulate 567.44s - 570.32s | electromechanical and hydraulic processes. 570.32s - 574.72s | These PLCs are the decision-making brain of our firing range. 576.40s - 579.44s | To make a realistic scenario, we actually implemented 579.52s - 586.56s | a commonly used PLC, specifically the Siemens Seachem A8000. 587.76s - 591.84s | The Raspberry Pis serve as remote IOs for these PLCs. 591.84s - 595.52s | And in the little box on the right bottom, you can see 597.60s - 600.08s | there are the IO drivers for the Raspberry


chunk_text:
power supply and general safety and controlling equipment. 535.36s - 540.40s | So, on the upper left, we have the contactor and electronic circuit breaker 540.40s - 541.84s | that handle electric faults. 542.56s - 547.28s | Additionally, we have the PSUs that provide 5, 12, or 24 volts 547.28s - 550.16s | to the different components of the cyber range. 550.16s - 554.40s | And below that, we have the terminal blocks that are used for the distribution of the power. 555.04s - 562.64s | The heart for our cyber range is a network of programmable logic controllers 563.20s - 566.72s | and Raspberry Pis that are orchestrated to emulate 567.44s - 570.32s | electromechanical and hydraulic processes. 570.32s - 574.72s | These PLCs are the decision-making brain of our firing range. 576.40s - 579.44s | To make a realistic scenario, we actually implemented 579.52s - 586.56s | a commonly used PLC, specifically the Siemens Seachem A8000. 587.76s - 591.84s | The Raspberry Pis serve as remote IOs for these PLCs. 591.84s - 595.52s | And in the little box on the right bottom, you can see 597.60s - 600.08s | there are the IO drivers for the Raspberry Pi 600.08s - 602.80s | to actually drive the stepper motors of the wheels. 602.80s - 607.36s | Above that, in the upper right corner, you have the Siemens BoxPC. 607.36s - 610.16s | And the Siemens BoxPC is used to drive the HMI. 611.12s - 613.04s | So please, next slide. 613.04s - 614.96s | So tying it all together, how does this work? 614.96s - 617.04s | What is the logic of the cyber range? 617.04s - 621.60s | So as I mentioned before, we have the PLCs and the Raspberry Pis 621.60s - 623.20s | that are connected via Modbus. 624.32s - 628.40s | We have the HMI that is connected via S7 COM with the PLCs. 629.04s - 635.12s | And the sensors and actuators are connected via I2C and GPIOs with the Raspberry Pis. 635.12s - 640.72s | If I talk about sensors here, then I mean the opening level sensors for the wheels 640.72s - 642.48s | and also the shutters of the turbine. 643.60s - 645.52s | OK, you may have recognized this. 645.52s - 648.96s | We have a hydroelectric power plant, but we don't have water at the moment. 648.96s -


chunk_text:
Pi 600.08s - 602.80s | to actually drive the stepper motors of the wheels. 602.80s - 607.36s | Above that, in the upper right corner, you have the Siemens BoxPC. 607.36s - 610.16s | And the Siemens BoxPC is used to drive the HMI. 611.12s - 613.04s | So please, next slide. 613.04s - 614.96s | So tying it all together, how does this work? 614.96s - 617.04s | What is the logic of the cyber range? 617.04s - 621.60s | So as I mentioned before, we have the PLCs and the Raspberry Pis 621.60s - 623.20s | that are connected via Modbus. 624.32s - 628.40s | We have the HMI that is connected via S7 COM with the PLCs. 629.04s - 635.12s | And the sensors and actuators are connected via I2C and GPIOs with the Raspberry Pis. 635.12s - 640.72s | If I talk about sensors here, then I mean the opening level sensors for the wheels 640.72s - 642.48s | and also the shutters of the turbine. 643.60s - 645.52s | OK, you may have recognized this. 645.52s - 648.96s | We have a hydroelectric power plant, but we don't have water at the moment. 648.96s - 650.56s | So that's actually bad. 650.56s - 652.00s | So maybe there's something missing. 652.96s - 655.92s | If you want to create a model including real water, 655.92s - 658.08s | this is always kind of error prone. 658.08s - 661.44s | We have a lot of electric here, so we decided to go a different approach. 662.40s - 667.44s | And for this, we added a simulation layer to the logic of the cyber range. 668.24s - 671.36s | In this simulation layer, we have a simulation program. 671.36s - 677.44s | This program actually emulates the water level of the headwater of the power plant. 679.36s - 685.68s | In combination with the actual data, so the sensor data retrieved from the Raspberry Pi, 687.12s - 689.60s | this program calculates the new water levels 689.60s - 693.28s | and publishes these water levels to the MQTT broker. 694.00s - 698.56s | The Raspberry Pi's MQTT client is then subscribed to these values. 698.56s - 701.28s | So it retrieves all the updates of the new water levels 701.28s - 703.60s | and forwards these water levels to the PLCs. 704.24s - 704.88s | OK, nice.


chunk_text:
650.56s | So that's actually bad. 650.56s - 652.00s | So maybe there's something missing. 652.96s - 655.92s | If you want to create a model including real water, 655.92s - 658.08s | this is always kind of error prone. 658.08s - 661.44s | We have a lot of electric here, so we decided to go a different approach. 662.40s - 667.44s | And for this, we added a simulation layer to the logic of the cyber range. 668.24s - 671.36s | In this simulation layer, we have a simulation program. 671.36s - 677.44s | This program actually emulates the water level of the headwater of the power plant. 679.36s - 685.68s | In combination with the actual data, so the sensor data retrieved from the Raspberry Pi, 687.12s - 689.60s | this program calculates the new water levels 689.60s - 693.28s | and publishes these water levels to the MQTT broker. 694.00s - 698.56s | The Raspberry Pi's MQTT client is then subscribed to these values. 698.56s - 701.28s | So it retrieves all the updates of the new water levels 701.28s - 703.60s | and forwards these water levels to the PLCs. 704.24s - 704.88s | OK, nice. 704.88s - 707.36s | Now we have water, but still only in logic. 707.36s - 710.72s | So you can still see no water on our model. 710.72s - 712.80s | OK, so another step is necessary. 712.80s - 715.84s | And therefore, we added another machine, the visualization machine. 716.64s - 723.36s | The visualization machine is basically a projector that is tied on top of our model. 724.80s - 725.76s | Please, next slide. 726.88s - 731.52s | There you can see in the middle picture, you can see the projector that is on top of our model. 731.52s - 739.12s | And in combination with our SYN client, they also consume the water levels 739.76s - 743.44s | from the MQTT broker and project them on the model. 744.32s - 746.08s | How did we do this? 746.08s - 750.96s | To actually create the images for the water, there is a Unity game running 751.60s - 757.36s | that contains that surface structure represents the surface structure of our range. 758.00s - 761.52s | And additionally, we have a blue layer in this Unity game, 761.52s - 765.92s | and its height is increased and decreased


chunk_text:
704.88s - 707.36s | Now we have water, but still only in logic. 707.36s - 710.72s | So you can still see no water on our model. 710.72s - 712.80s | OK, so another step is necessary. 712.80s - 715.84s | And therefore, we added another machine, the visualization machine. 716.64s - 723.36s | The visualization machine is basically a projector that is tied on top of our model. 724.80s - 725.76s | Please, next slide. 726.88s - 731.52s | There you can see in the middle picture, you can see the projector that is on top of our model. 731.52s - 739.12s | And in combination with our SYN client, they also consume the water levels 739.76s - 743.44s | from the MQTT broker and project them on the model. 744.32s - 746.08s | How did we do this? 746.08s - 750.96s | To actually create the images for the water, there is a Unity game running 751.60s - 757.36s | that contains that surface structure represents the surface structure of our range. 758.00s - 761.52s | And additionally, we have a blue layer in this Unity game, 761.52s - 765.92s | and its height is increased and decreased as needed to represent our water levels. 767.52s - 768.40s | OK, nice. 768.40s - 770.40s | Now we have a working power plant. 770.48s - 771.44s | Working power plant. 772.64s - 778.24s | But to actually create training scenarios for this cyber range, 778.24s - 779.76s | we also need network infrastructure. 779.76s - 781.36s | So please go to the next slide. 783.04s - 787.04s | The network infrastructure for the firing range is also split up into two parts. 787.04s - 789.68s | So we have the IT and the OT network. 789.68s - 796.88s | The IT network hosts multiple virtual machines that emulate a classic office environment. 796.88s - 799.68s | The IT network is completely virtualized. 800.56s - 804.56s | And the OT network contains two networks. 804.56s - 806.16s | So a virtual and a physical one. 806.16s - 809.92s | The physical one hosts the PLCs. 810.48s - 814.96s | And the virtual one hosts a virtualized active directory. 814.96s - 815.60s | OK, nice. 815.60s - 819.04s | Now we can actually start implementing attacks here in our cyber range. 820.08s - 823.44s | And if you look at the


chunk_text:
as needed to represent our water levels. 767.52s - 768.40s | OK, nice. 768.40s - 770.40s | Now we have a working power plant. 770.48s - 771.44s | Working power plant. 772.64s - 778.24s | But to actually create training scenarios for this cyber range, 778.24s - 779.76s | we also need network infrastructure. 779.76s - 781.36s | So please go to the next slide. 783.04s - 787.04s | The network infrastructure for the firing range is also split up into two parts. 787.04s - 789.68s | So we have the IT and the OT network. 789.68s - 796.88s | The IT network hosts multiple virtual machines that emulate a classic office environment. 796.88s - 799.68s | The IT network is completely virtualized. 800.56s - 804.56s | And the OT network contains two networks. 804.56s - 806.16s | So a virtual and a physical one. 806.16s - 809.92s | The physical one hosts the PLCs. 810.48s - 814.96s | And the virtual one hosts a virtualized active directory. 814.96s - 815.60s | OK, nice. 815.60s - 819.04s | Now we can actually start implementing attacks here in our cyber range. 820.08s - 823.44s | And if you look at the current OT incidents, 823.44s - 827.12s | then you can see that actually a lot of OT incidents start in IT. 827.12s - 829.44s | So that is also the case for our attack scenario. 830.00s - 831.60s | So a very classic one. 831.60s - 835.20s | The attacker sends a phishing mail to the victim, 835.76s - 842.72s | which orders the victim to download an executable from an attacker-controlled web server. 842.72s - 845.92s | This executable, surprise, contains an SITU implant. 845.92s - 850.56s | And after execution, the attacker has an initial foothold in the IT network. 851.20s - 854.80s | Further, poorly configured workstation security allows the attacker to 854.96s - 862.16s | dump credentials, escalate privileges, and finally move laterally and 862.80s - 866.00s | compromise the jump host and the control technology DMC. 866.00s - 867.36s | So actually very bad. 868.56s - 869.36s | Why is this bad? 869.36s - 873.60s | Well, the jump host and the control technology DMC is used to manage the PLCs. 873.60s - 878.40s | So it's used to reprogram the PLCs in absolutely a place 878.40s - 880.80s | where you do not want


chunk_text:
current OT incidents, 823.44s - 827.12s | then you can see that actually a lot of OT incidents start in IT. 827.12s - 829.44s | So that is also the case for our attack scenario. 830.00s - 831.60s | So a very classic one. 831.60s - 835.20s | The attacker sends a phishing mail to the victim, 835.76s - 842.72s | which orders the victim to download an executable from an attacker-controlled web server. 842.72s - 845.92s | This executable, surprise, contains an SITU implant. 845.92s - 850.56s | And after execution, the attacker has an initial foothold in the IT network. 851.20s - 854.80s | Further, poorly configured workstation security allows the attacker to 854.96s - 862.16s | dump credentials, escalate privileges, and finally move laterally and 862.80s - 866.00s | compromise the jump host and the control technology DMC. 866.00s - 867.36s | So actually very bad. 868.56s - 869.36s | Why is this bad? 869.36s - 873.60s | Well, the jump host and the control technology DMC is used to manage the PLCs. 873.60s - 878.40s | So it's used to reprogram the PLCs in absolutely a place 878.40s - 880.80s | where you do not want to have unauthorized personnel. 882.72s - 884.32s | But it's even getting worse. 884.40s - 888.40s | So the attacker starts enumeration of the network, dumps the active directory, 888.40s - 894.24s | and further analyzes which servers are accessible with the currently owned privileges. 895.60s - 898.96s | Unfortunately for the power plant, and fortunately for the attacker, 898.96s - 904.00s | he is able to access the Nextcloud Datastore. 904.00s - 907.04s | So what is the Nextcloud Datastore and why is this bad? 907.04s - 910.72s | Well, the Nextcloud Datastore is used to host the project files for the PLCs. 910.72s - 914.40s | So that's actually very valuable information for the attacker, 915.04s - 918.96s | since the project files contain the logic of the PLCs. 918.96s - 921.92s | And, well, the PLCs control the power plant. 921.92s - 923.12s | So not too nice. 924.24s - 929.68s | Attacker is happy, is exfiltrating these files via the previously established C2 channel, 931.12s - 936.48s | analyzes it, modifies it, and re-uploads the files to the Nextcloud Datastore. 936.48s - 939.76s | And what happens next and why this is a problem, Bernard will


chunk_text:
to have unauthorized personnel. 882.72s - 884.32s | But it's even getting worse. 884.40s - 888.40s | So the attacker starts enumeration of the network, dumps the active directory, 888.40s - 894.24s | and further analyzes which servers are accessible with the currently owned privileges. 895.60s - 898.96s | Unfortunately for the power plant, and fortunately for the attacker, 898.96s - 904.00s | he is able to access the Nextcloud Datastore. 904.00s - 907.04s | So what is the Nextcloud Datastore and why is this bad? 907.04s - 910.72s | Well, the Nextcloud Datastore is used to host the project files for the PLCs. 910.72s - 914.40s | So that's actually very valuable information for the attacker, 915.04s - 918.96s | since the project files contain the logic of the PLCs. 918.96s - 921.92s | And, well, the PLCs control the power plant. 921.92s - 923.12s | So not too nice. 924.24s - 929.68s | Attacker is happy, is exfiltrating these files via the previously established C2 channel, 931.12s - 936.48s | analyzes it, modifies it, and re-uploads the files to the Nextcloud Datastore. 936.48s - 939.76s | And what happens next and why this is a problem, Bernard will tell you. 942.51s - 947.39s | At the next stage, as an OT operator, I took the project file, 947.39s - 950.11s | deployed it on my PLCs, and the horror is starting. 950.11s - 956.51s | So an immense flood is running over the water power plant and also the environment. 958.19s - 958.83s | Next slide. 960.35s - 961.79s | Training and DFIR. 963.07s - 967.87s | We have separated into 15 labs, which are separated in three main parts. 967.87s - 970.75s | The first main part is the analyzing part. 970.75s - 975.63s | The second part is see how an attacker is working on the environment 975.63s - 978.35s | and which tools they are using normally. 978.35s - 982.27s | And also we use OS typical forensic parts. 982.27s - 986.27s | So we will show the people who are working on a water power plant, 987.23s - 993.47s | what can we see, what is a security engineer seeing, and what can he see in real life. 994.43s - 999.39s | And also we get into deeper of the Siemens toolbox, 999.39s - 1002.59s | which we use to program the logical units.


chunk_text:
tell you. 942.51s - 947.39s | At the next stage, as an OT operator, I took the project file, 947.39s - 950.11s | deployed it on my PLCs, and the horror is starting. 950.11s - 956.51s | So an immense flood is running over the water power plant and also the environment. 958.19s - 958.83s | Next slide. 960.35s - 961.79s | Training and DFIR. 963.07s - 967.87s | We have separated into 15 labs, which are separated in three main parts. 967.87s - 970.75s | The first main part is the analyzing part. 970.75s - 975.63s | The second part is see how an attacker is working on the environment 975.63s - 978.35s | and which tools they are using normally. 978.35s - 982.27s | And also we use OS typical forensic parts. 982.27s - 986.27s | So we will show the people who are working on a water power plant, 987.23s - 993.47s | what can we see, what is a security engineer seeing, and what can he see in real life. 994.43s - 999.39s | And also we get into deeper of the Siemens toolbox, 999.39s - 1002.59s | which we use to program the logical units. 1002.59s - 1007.95s | And we also do the analyzation of the files from the toolbox. 1008.59s - 1009.23s | Next slide. 1013.10s - 1021.86s | The lessons learned. 1023.14s - 1029.70s | These are the heavy part because the ICS fire range is a bit bulky and heavy. 1030.34s - 1034.90s | We heard before it's a lot of weight and a lot of metal in it. 1035.94s - 1040.90s | Also, the most important part is to create an easy to use 1040.90s - 1044.66s | and also good resilient backup and restore solution. 1044.66s - 1049.78s | Because if we do some trainings, we should be really fast in restoring 1049.78s - 1055.38s | and deploying and backuping the situation where we can do the live trainings on it. 1055.38s - 1061.78s | So it took us a long time to create consistent ESXi backups 1061.78s - 1065.70s | in combination with the graphics and also the Raspberry configuration. 1066.82s - 1067.38s | The noise. 1068.26s - 1072.34s | Noise is really important because it's not the best choice to 1072.34s - 1075.14s | took the first switch which you have in your depot. 1075.14s - 1079.86s


chunk_text:
1002.59s - 1007.95s | And we also do the analyzation of the files from the toolbox. 1008.59s - 1009.23s | Next slide. 1013.10s - 1021.86s | The lessons learned. 1023.14s - 1029.70s | These are the heavy part because the ICS fire range is a bit bulky and heavy. 1030.34s - 1034.90s | We heard before it's a lot of weight and a lot of metal in it. 1035.94s - 1040.90s | Also, the most important part is to create an easy to use 1040.90s - 1044.66s | and also good resilient backup and restore solution. 1044.66s - 1049.78s | Because if we do some trainings, we should be really fast in restoring 1049.78s - 1055.38s | and deploying and backuping the situation where we can do the live trainings on it. 1055.38s - 1061.78s | So it took us a long time to create consistent ESXi backups 1061.78s - 1065.70s | in combination with the graphics and also the Raspberry configuration. 1066.82s - 1067.38s | The noise. 1068.26s - 1072.34s | Noise is really important because it's not the best choice to 1072.34s - 1075.14s | took the first switch which you have in your depot. 1075.14s - 1079.86s | Normally we have a Cisco catalyst switch from an old environment. 1079.86s - 1081.70s | So it was really noisy. 1081.70s - 1083.30s | It was active cooled. 1083.30s - 1086.34s | So we changed the switch to a passive cooled switch. 1086.34s - 1089.22s | So everyone who is trying such a project, 1089.22s - 1094.26s | use as most as you can passive components because there's some really loud. 1095.78s - 1096.66s | Model building. 1096.66s - 1099.22s | Yeah, model building is not a technique. 1099.22s - 1101.38s | It's also a bit of art. 1101.38s - 1105.94s | So you had to design the mountains and you had to design the cars and so on. 1105.94s - 1107.70s | So a typical Austrian environment. 1108.74s - 1113.30s | The PCAP size during the analysis and for the training is also important 1113.38s - 1119.30s | because not everyone is happy to handle a lot of gigabytes from PCAP files. 1119.30s - 1123.14s | And this is the next part to analyze them with Tshark. 1125.06s - 1127.86s | Normally in the security we use Tshark. 1128.50s - 1132.58s | But not every OT operator is


chunk_text:
| Normally we have a Cisco catalyst switch from an old environment. 1079.86s - 1081.70s | So it was really noisy. 1081.70s - 1083.30s | It was active cooled. 1083.30s - 1086.34s | So we changed the switch to a passive cooled switch. 1086.34s - 1089.22s | So everyone who is trying such a project, 1089.22s - 1094.26s | use as most as you can passive components because there's some really loud. 1095.78s - 1096.66s | Model building. 1096.66s - 1099.22s | Yeah, model building is not a technique. 1099.22s - 1101.38s | It's also a bit of art. 1101.38s - 1105.94s | So you had to design the mountains and you had to design the cars and so on. 1105.94s - 1107.70s | So a typical Austrian environment. 1108.74s - 1113.30s | The PCAP size during the analysis and for the training is also important 1113.38s - 1119.30s | because not everyone is happy to handle a lot of gigabytes from PCAP files. 1119.30s - 1123.14s | And this is the next part to analyze them with Tshark. 1125.06s - 1127.86s | Normally in the security we use Tshark. 1128.50s - 1132.58s | But not every OT operator is familiar with Tshark. 1132.58s - 1138.02s | So we had to switch to Wireshark which is more convenient for everybody to use. 1139.06s - 1142.10s | And yeah, so that's all. 1145.82s - 1152.06s | And for the toolbox, what is happening in the second part of the file? 1152.06s - 1156.06s | Because the attacker is manipulating the toolbox file. 1157.02s - 1165.82s | The toolbox file, the new one, is displaying the target values as the real values. 1165.82s - 1174.14s | So the target values will show on the HMI and seems to the operator everything is fine. 1174.78s - 1179.82s | And on the other side, the toolbox is sending zeros to the wires. 1179.82s - 1185.34s | So the wires will not function at the moment during the attack. 1185.98s - 1188.70s | And this is why the flood starts. 1188.70s - 1192.86s | And the problem is normally you have the HMI, 1192.86s - 1197.34s | the operator which is working on the HMI is not directly connected 1197.34s - 1200.70s | or has no visual view to the water power plant. 1200.70s - 1205.10s | And then, yeah, that's all for now. 1207.18s


chunk_text:
familiar with Tshark. 1132.58s - 1138.02s | So we had to switch to Wireshark which is more convenient for everybody to use. 1139.06s - 1142.10s | And yeah, so that's all. 1145.82s - 1152.06s | And for the toolbox, what is happening in the second part of the file? 1152.06s - 1156.06s | Because the attacker is manipulating the toolbox file. 1157.02s - 1165.82s | The toolbox file, the new one, is displaying the target values as the real values. 1165.82s - 1174.14s | So the target values will show on the HMI and seems to the operator everything is fine. 1174.78s - 1179.82s | And on the other side, the toolbox is sending zeros to the wires. 1179.82s - 1185.34s | So the wires will not function at the moment during the attack. 1185.98s - 1188.70s | And this is why the flood starts. 1188.70s - 1192.86s | And the problem is normally you have the HMI, 1192.86s - 1197.34s | the operator which is working on the HMI is not directly connected 1197.34s - 1200.70s | or has no visual view to the water power plant. 1200.70s - 1205.10s | And then, yeah, that's all for now. 1207.18s - 1210.30s | Are there any questions so far? 1210.30s - 1216.14s | Because we also have a short video where you can see what happens. 1227.44s - 1228.72s | This is a short overview. 1229.36s - 1232.56s | Here you see the top of the wires and the mountains. 1234.64s - 1235.92s | I had to cheat a little bit. 1237.12s - 1239.68s | Yeah, here are the mountains. 1239.68s - 1249.76s | So we created a typical Austria environment to make it more home feeling for the students. 1250.32s - 1253.04s | Here are the wires which are 3D printed. 1255.30s - 1258.90s | This is the landscape which is getting flooded. 1261.41s - 1264.93s | In the back, you can see the turbine which is a Kaplan turbine. 1265.73s - 1269.57s | So it's also realistic to create. 1269.57s - 1272.85s | It's also important to create a realistic Kaplan turbine. 1276.58s - 1278.50s | On the left top, you see the HMI. 1281.95s - 1284.91s | And here is the ICS component. 1284.91s - 1294.43s | So here you can see the Siemens ICS, the A8000, and also the Siemens computer. 1298.98s - 1308.26s | So


chunk_text:
- 1210.30s | Are there any questions so far? 1210.30s - 1216.14s | Because we also have a short video where you can see what happens. 1227.44s - 1228.72s | This is a short overview. 1229.36s - 1232.56s | Here you see the top of the wires and the mountains. 1234.64s - 1235.92s | I had to cheat a little bit. 1237.12s - 1239.68s | Yeah, here are the mountains. 1239.68s - 1249.76s | So we created a typical Austria environment to make it more home feeling for the students. 1250.32s - 1253.04s | Here are the wires which are 3D printed. 1255.30s - 1258.90s | This is the landscape which is getting flooded. 1261.41s - 1264.93s | In the back, you can see the turbine which is a Kaplan turbine. 1265.73s - 1269.57s | So it's also realistic to create. 1269.57s - 1272.85s | It's also important to create a realistic Kaplan turbine. 1276.58s - 1278.50s | On the left top, you see the HMI. 1281.95s - 1284.91s | And here is the ICS component. 1284.91s - 1294.43s | So here you can see the Siemens ICS, the A8000, and also the Siemens computer. 1298.98s - 1308.26s | So we used everything or we tried to make the model as near as a real water power plant. 1308.26s - 1312.18s | So normally, Siemens component will be used in this environment. 1316.96s - 1318.56s | Yeah, it is mobile. 1318.56s - 1321.04s | So you can bring it from point A to B. 1332.64s - 1335.52s | Yeah, so are there any questions so far? 1339.26s - 1342.30s | Okay, then thank you. 1347.41s - 1352.45s | And as I see that there are some people waving, feel free to contact us and chat with us about 1352.45s - 1357.25s | the rain and we can give you a bit more details than just the 25 minutes that we have here. 1357.89s - 1359.97s | Thank you.


chunk_text:
we used everything or we tried to make the model as near as a real water power plant. 1308.26s - 1312.18s | So normally, Siemens component will be used in this environment. 1316.96s - 1318.56s | Yeah, it is mobile. 1318.56s - 1321.04s | So you can bring it from point A to B. 1332.64s - 1335.52s | Yeah, so are there any questions so far? 1339.26s - 1342.30s | Okay, then thank you. 1347.41s - 1352.45s | And as I see that there are some people waving, feel free to contact us and chat with us about 1352.45s - 1357.25s | the rain and we can give you a bit more details than just the 25 minutes that we have here. 1357.89s - 1359.97s | Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=JbnHaBY0sWM", "title": "DEF CON 32 - Travel Better Expedient Digital Defense - Grey Fox", "description": "Expedient Digital Defense focuses on using free and readily available applications, or recommending paid-for commercial apps and tools that have proven records of credibility, to make our devices and online presence less harmful to us. We will follow a typical traveler in the United States, with some experiences drawn from overseas travel.\n\nThe talk stresses the value of Operational Security (OPSEC), and the mindset of seeing every piece of communication through the eyes of your adversary. The intent is to make people think twice before revealing anything considered sensitive, even if using the latest and greatest encryption. The surveillance economy and ever-present data collection in our modern world demand better awareness of how our digital world works. We\u2019ll discuss examples like invasive social media collection, foreign influence on public perception, data insecurity putting users in danger, and advertising models based on location and click tracking.\n\nFinally, the take-away is knowing the tools and tech available, and being able to select those which fit your needs, if at all. Most of the time, one mitigation isn't enough, and several need to be emplaced to achieve proper defense in depth, in case one solution fails. Even if no technical solutions are put in place, the user will have that \"red team\" mindset and awareness that calibrates better judgment over technical solutions, and promotes OPSEC and rational thinking for security rather than blindly depending on apps and gadgets.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1329, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.20s | This text was transcribed using whisper model: large-v2 All right, everyone. Good morning. Thanks for bearing with us. New venue new everything. So, 5.84s - 10.56s | you know, just a bunch of delayed delays, false starts, things like that. But hey, 10.56s - 16.00s | I appreciate you coming out over here. So this is called as you can see on just the one screen, 16.00s - 25.04s | travel better expedient digital defense. So I am Gray Fox. My background is retired Air Force. 25.04s - 29.04s | I did basically intelligence for 20 years. A lot of that intelligence though, 29.60s - 34.56s | involved some kind of either defensive or offensive cyber. It also involved briefing 34.56s - 38.64s | a lot of people on how they can operate in environments


chunk_text:
defense in depth, in case one solution fails. Even if no technical solutions are put in place, the user will have that \"red team\" mindset and awareness that calibrates better judgment over technical solutions, and promotes OPSEC and rational thinking for security rather than blindly depending on apps and gadgets.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1329, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.20s | This text was transcribed using whisper model: large-v2 All right, everyone. Good morning. Thanks for bearing with us. New venue new everything. So, 5.84s - 10.56s | you know, just a bunch of delayed delays, false starts, things like that. But hey, 10.56s - 16.00s | I appreciate you coming out over here. So this is called as you can see on just the one screen, 16.00s - 25.04s | travel better expedient digital defense. So I am Gray Fox. My background is retired Air Force. 25.04s - 29.04s | I did basically intelligence for 20 years. A lot of that intelligence though, 29.60s - 34.56s | involved some kind of either defensive or offensive cyber. It also involved briefing 34.56s - 38.64s | a lot of people on how they can operate in environments where foreign intelligence 38.64s - 46.64s | services were after them. So I created this briefing for them. It is it is typically long, 46.64s - 52.24s | but we only have about a half hour with me. So we'll do our best over here. I do a bunch of 52.24s - 56.96s | digital forensics on the side. I do product security and pen testing. Not so much on the 56.96s - 63.76s | side. I really am into wireless stuff. My my big obsessions right now are setting up Wi-Fi 63.76s - 68.64s | networks and then trying to break them. Wi-Fi is getting better. So I'm probably getting worse. 68.64s - 73.84s | So I got to keep up with the times on that one. For my hobbies, I rock march. I put on heavy 73.84s - 79.20s | weight and I walk around because, hey, who needs joints? Right. You know, but I don't do it on 79.20s - 83.44s | sand. I'm sick of sand. I don't want to see sand ever again. Welcome to Las Vegas. Right. 84.96s - 87.44s | So just to give you an idea of what we're getting into. 89.12s


chunk_text:
where foreign intelligence 38.64s - 46.64s | services were after them. So I created this briefing for them. It is it is typically long, 46.64s - 52.24s | but we only have about a half hour with me. So we'll do our best over here. I do a bunch of 52.24s - 56.96s | digital forensics on the side. I do product security and pen testing. Not so much on the 56.96s - 63.76s | side. I really am into wireless stuff. My my big obsessions right now are setting up Wi-Fi 63.76s - 68.64s | networks and then trying to break them. Wi-Fi is getting better. So I'm probably getting worse. 68.64s - 73.84s | So I got to keep up with the times on that one. For my hobbies, I rock march. I put on heavy 73.84s - 79.20s | weight and I walk around because, hey, who needs joints? Right. You know, but I don't do it on 79.20s - 83.44s | sand. I'm sick of sand. I don't want to see sand ever again. Welcome to Las Vegas. Right. 84.96s - 87.44s | So just to give you an idea of what we're getting into. 89.12s - 93.52s | Just foundations. If you were coming in here expecting something very comprehensive, 93.52s - 98.08s | I unfortunately can't give that. But what I'm hoping to leave you with is just a flavor 98.08s - 103.68s | of what you can do to get a little bit deeper into things like wireless anti-tracking, 103.68s - 108.40s | trying to reduce your attack surface when you're traveling and some things that you can do to 108.40s - 114.80s | mitigate whatever dangers that or exploitation that could be posed to you if you happen to lose 114.80s - 120.00s | your device or it gets stolen or you get pulled in by security and they take your devices and they 120.00s - 125.60s | try to get information about you off of them. These things happen. Ask me how I know. I'm going 125.60s - 129.28s | to give you some of those tips and some of those tools. What we're really looking for, though, 129.28s - 134.48s | is a mindset. I'm not trying to sell you anything. It's just about how to think a little bit more like 134.48s - 138.88s | the adversary when you're


chunk_text:
- 93.52s | Just foundations. If you were coming in here expecting something very comprehensive, 93.52s - 98.08s | I unfortunately can't give that. But what I'm hoping to leave you with is just a flavor 98.08s - 103.68s | of what you can do to get a little bit deeper into things like wireless anti-tracking, 103.68s - 108.40s | trying to reduce your attack surface when you're traveling and some things that you can do to 108.40s - 114.80s | mitigate whatever dangers that or exploitation that could be posed to you if you happen to lose 114.80s - 120.00s | your device or it gets stolen or you get pulled in by security and they take your devices and they 120.00s - 125.60s | try to get information about you off of them. These things happen. Ask me how I know. I'm going 125.60s - 129.28s | to give you some of those tips and some of those tools. What we're really looking for, though, 129.28s - 134.48s | is a mindset. I'm not trying to sell you anything. It's just about how to think a little bit more like 134.48s - 138.88s | the adversary when you're out and about, when you're in places where your information may be 138.88s - 145.52s | exposed. What we're not going to do is cover the entire thing that I like to cover. I typically 145.52s - 150.96s | do this for military members for 90 minutes. You're getting, I don't know, we'll see, maybe 150.96s - 156.72s | 20 minutes now. So I might go fast. If I do go fast, my contact information is going to be at 156.72s - 161.12s | the end. Please hit me up. Please hit me up. I will answer your questions. I'll give you all 161.12s - 167.84s | the time that you deserve. So biggest thing, if you take away nothing else from this talk, 168.48s - 174.32s | is threat modeling. You have your attack surface. That's everything that you use. It is your phone, 174.32s - 179.44s | your computer, your social media presence, your wireless presence, anything like that. 179.44s - 184.64s | And then you have your threat profile. Those are the people that are after you. Those are anybody 184.64s - 189.52s | that can benefit from getting your information. If I am going to attack


chunk_text:
out and about, when you're in places where your information may be 138.88s - 145.52s | exposed. What we're not going to do is cover the entire thing that I like to cover. I typically 145.52s - 150.96s | do this for military members for 90 minutes. You're getting, I don't know, we'll see, maybe 150.96s - 156.72s | 20 minutes now. So I might go fast. If I do go fast, my contact information is going to be at 156.72s - 161.12s | the end. Please hit me up. Please hit me up. I will answer your questions. I'll give you all 161.12s - 167.84s | the time that you deserve. So biggest thing, if you take away nothing else from this talk, 168.48s - 174.32s | is threat modeling. You have your attack surface. That's everything that you use. It is your phone, 174.32s - 179.44s | your computer, your social media presence, your wireless presence, anything like that. 179.44s - 184.64s | And then you have your threat profile. Those are the people that are after you. Those are anybody 184.64s - 189.52s | that can benefit from getting your information. If I am going to attack your attack surface, 189.52s - 193.92s | it's because I want something that you have. I am part of your threat profile. It's different 193.92s - 199.36s | for everybody. A school teacher has a different threat profile than a school student. A computer 199.36s - 205.52s | user at home has a much different threat profile than someone that's a computer user at an airport. 205.52s - 209.28s | So that's something that you need to square away with is what is your attack surface? What does 209.28s - 214.40s | it look like? What do you use? And then who's after it? This all comes down to the operation 214.48s - 220.08s | security process. And this is something that we should all be living with. Operation security, 220.08s - 226.08s | or OPSEC, is a cycle. You identify what your vulnerabilities are, your attack surface. 226.08s - 232.72s | You identify who's after it, your threat profile. You look at what would happen if they exploited 232.72s - 239.28s | that vulnerability. And then you do your risk analysis. Not every vulnerability needs to be 239.28s - 244.08s | patched. Some of them carry a really low


chunk_text:
your attack surface, 189.52s - 193.92s | it's because I want something that you have. I am part of your threat profile. It's different 193.92s - 199.36s | for everybody. A school teacher has a different threat profile than a school student. A computer 199.36s - 205.52s | user at home has a much different threat profile than someone that's a computer user at an airport. 205.52s - 209.28s | So that's something that you need to square away with is what is your attack surface? What does 209.28s - 214.40s | it look like? What do you use? And then who's after it? This all comes down to the operation 214.48s - 220.08s | security process. And this is something that we should all be living with. Operation security, 220.08s - 226.08s | or OPSEC, is a cycle. You identify what your vulnerabilities are, your attack surface. 226.08s - 232.72s | You identify who's after it, your threat profile. You look at what would happen if they exploited 232.72s - 239.28s | that vulnerability. And then you do your risk analysis. Not every vulnerability needs to be 239.28s - 244.08s | patched. Some of them carry a really low risk. I use a cell phone. Cell phones are full of 244.08s - 251.20s | vulnerabilities. If I stop using a cell phone, am I safe? Well, maybe, maybe not. But you completely 251.20s - 255.28s | lose the benefit of using a cell phone. So you're not going to stop using your cell phone, right? 255.28s - 260.24s | You're going to accept that risk. When you accept that risk, then you need to think about, well, 260.24s - 265.12s | what if the adversary did exploit me? How could I mitigate some of the worst issues of losing my 265.12s - 270.08s | cell phone or getting it compromised? And then you put mitigations in place. You put defenses 270.08s - 274.72s | in place. Maybe you change the way you use it a little bit. That's the OPSEC process. But the 274.72s - 279.84s | important thing is, it's a mindset. It's something that you constantly do. It's going to become 279.84s - 283.84s | second nature after a while. Everything that you do, you're going to think about it. What 283.84s - 288.64s | risk does this pose? How does it increase or decrease my attack


chunk_text:
risk. I use a cell phone. Cell phones are full of 244.08s - 251.20s | vulnerabilities. If I stop using a cell phone, am I safe? Well, maybe, maybe not. But you completely 251.20s - 255.28s | lose the benefit of using a cell phone. So you're not going to stop using your cell phone, right? 255.28s - 260.24s | You're going to accept that risk. When you accept that risk, then you need to think about, well, 260.24s - 265.12s | what if the adversary did exploit me? How could I mitigate some of the worst issues of losing my 265.12s - 270.08s | cell phone or getting it compromised? And then you put mitigations in place. You put defenses 270.08s - 274.72s | in place. Maybe you change the way you use it a little bit. That's the OPSEC process. But the 274.72s - 279.84s | important thing is, it's a mindset. It's something that you constantly do. It's going to become 279.84s - 283.84s | second nature after a while. Everything that you do, you're going to think about it. What 283.84s - 288.64s | risk does this pose? How does it increase or decrease my attack surface? How does it change 288.64s - 296.16s | my threat model? So let's start off. These are things that you can do without traveling. You 296.16s - 300.72s | could be sitting in your home and you can do these things and it'll still reduce your attack surface. 301.36s - 305.28s | This audience, I don't have to explain to you what MFA is, password managers. I don't need to 305.28s - 311.12s | go through that. You all already know what this is. It's been shoved down your throats so many 311.12s - 317.04s | times over the past decade. Long, complicated passwords. Use a password manager. Multi-factor 317.04s - 321.76s | authentication is going to stop a lot of these attacks. If you can use a PIN or a password, 321.76s - 326.80s | definitely use it. If for some reason you happen to be traveling and you lose your phone, you lose 326.80s - 333.44s | your computer, some applications allow you to have a standalone PIN or password that you use 333.44s - 338.40s | to activate or to access that app, even if it's still on your device and your device is unlocked. 338.40s


chunk_text:
surface? How does it change 288.64s - 296.16s | my threat model? So let's start off. These are things that you can do without traveling. You 296.16s - 300.72s | could be sitting in your home and you can do these things and it'll still reduce your attack surface. 301.36s - 305.28s | This audience, I don't have to explain to you what MFA is, password managers. I don't need to 305.28s - 311.12s | go through that. You all already know what this is. It's been shoved down your throats so many 311.12s - 317.04s | times over the past decade. Long, complicated passwords. Use a password manager. Multi-factor 317.04s - 321.76s | authentication is going to stop a lot of these attacks. If you can use a PIN or a password, 321.76s - 326.80s | definitely use it. If for some reason you happen to be traveling and you lose your phone, you lose 326.80s - 333.44s | your computer, some applications allow you to have a standalone PIN or password that you use 333.44s - 338.40s | to activate or to access that app, even if it's still on your device and your device is unlocked. 338.40s - 343.20s | It's a good second layer of defense. I would definitely recommend that. Backups are a good 343.20s - 347.76s | thing that a lot of people don't think about. If your devices are lost, stolen, or confiscated and 347.76s - 353.12s | you need to recover, you can recover. My favorite way to back things up is putting it on a thumb 353.12s - 358.56s | drive, leaving it somewhere like in my house, somewhere where I can access it, copying a second 358.56s - 364.40s | thumb drive, maybe leaving it in my car. And if I really want overkill, I maybe backup stuff to a 364.40s - 368.80s | third thumb drive and I leave it at a friend's or a relative's house. Because what if my car gets 368.80s - 373.68s | broken into? What if my house burns down? I still have that third backup. You'll probably be thinking 373.68s - 379.12s | about other things than re-imaging your computer or phone if your house burns down, but it's still 379.12s - 383.28s | some peace of mind. One less thing you need to worry about. And then the last thing is end-to-end


chunk_text:
- 343.20s | It's a good second layer of defense. I would definitely recommend that. Backups are a good 343.20s - 347.76s | thing that a lot of people don't think about. If your devices are lost, stolen, or confiscated and 347.76s - 353.12s | you need to recover, you can recover. My favorite way to back things up is putting it on a thumb 353.12s - 358.56s | drive, leaving it somewhere like in my house, somewhere where I can access it, copying a second 358.56s - 364.40s | thumb drive, maybe leaving it in my car. And if I really want overkill, I maybe backup stuff to a 364.40s - 368.80s | third thumb drive and I leave it at a friend's or a relative's house. Because what if my car gets 368.80s - 373.68s | broken into? What if my house burns down? I still have that third backup. You'll probably be thinking 373.68s - 379.12s | about other things than re-imaging your computer or phone if your house burns down, but it's still 379.12s - 383.28s | some peace of mind. One less thing you need to worry about. And then the last thing is end-to-end 383.28s - 389.20s | encrypted chat and calling. This reduces your attack surface a lot. And I would normally spend 389.20s - 393.68s | three slides talking to people about how to choose one. Are you going to choose WhatsApp? Are you going 393.68s - 398.88s | to use Signal, Wire, Telegram? What is it going to be? I'm not going to sell you any apps. I'm not 398.88s - 404.24s | going to give you recommendations. For all I know, Signal protocol gets broken tomorrow and I don't 404.24s - 408.80s | want you going home thinking, oh man, Gray Fox told me to use Signal. What a jerk. So I'm not going to 408.80s - 413.36s | do that. But what I will say is work with your ecosystem. If you're in an environment where 413.36s - 419.60s | everyone else is using WhatsApp, use WhatsApp. Because app fatigue is a thing. Don't try to get 419.60s - 423.44s | everyone to go with what you use. It's an uphill battle and you're probably going to lose that 423.44s - 429.84s | battle. Really what you want to have in mind is thinking like the adversary. Using your


chunk_text:
383.28s - 389.20s | encrypted chat and calling. This reduces your attack surface a lot. And I would normally spend 389.20s - 393.68s | three slides talking to people about how to choose one. Are you going to choose WhatsApp? Are you going 393.68s - 398.88s | to use Signal, Wire, Telegram? What is it going to be? I'm not going to sell you any apps. I'm not 398.88s - 404.24s | going to give you recommendations. For all I know, Signal protocol gets broken tomorrow and I don't 404.24s - 408.80s | want you going home thinking, oh man, Gray Fox told me to use Signal. What a jerk. So I'm not going to 408.80s - 413.36s | do that. But what I will say is work with your ecosystem. If you're in an environment where 413.36s - 419.60s | everyone else is using WhatsApp, use WhatsApp. Because app fatigue is a thing. Don't try to get 419.60s - 423.44s | everyone to go with what you use. It's an uphill battle and you're probably going to lose that 423.44s - 429.84s | battle. Really what you want to have in mind is thinking like the adversary. Using your OPSEC. 429.84s - 436.00s | Every keystroke. There is a potential for every keystroke to be exposed. You could be using the 436.00s - 440.48s | most secure thing in the entire world, but what if there's malware on your device that gets around 440.48s - 445.76s | the encryption? So just think about it before you type it, before you say it. Blinky boxes are great, 445.76s - 449.04s | but the technology is not going to save you. Your brain is going to save you. 450.96s - 457.04s | Social media is another one. We're getting away from what you carry and now into what 457.04s - 461.76s | your presence looks like. If I'm the adversary and I want to build an intelligence dossier on you, 462.88s - 466.88s | damn sure I'm going to go to your LinkedIn, your Facebook, your Instagram, 466.88s - 470.40s | wherever you have a presence, I'm going to find you and I'm going to put it together. 470.40s - 474.00s | Every photograph that you post, I'm not only going to look at your face, I'm going to look at who 474.00s - 477.84s | you're standing next to. I'm


chunk_text:
OPSEC. 429.84s - 436.00s | Every keystroke. There is a potential for every keystroke to be exposed. You could be using the 436.00s - 440.48s | most secure thing in the entire world, but what if there's malware on your device that gets around 440.48s - 445.76s | the encryption? So just think about it before you type it, before you say it. Blinky boxes are great, 445.76s - 449.04s | but the technology is not going to save you. Your brain is going to save you. 450.96s - 457.04s | Social media is another one. We're getting away from what you carry and now into what 457.04s - 461.76s | your presence looks like. If I'm the adversary and I want to build an intelligence dossier on you, 462.88s - 466.88s | damn sure I'm going to go to your LinkedIn, your Facebook, your Instagram, 466.88s - 470.40s | wherever you have a presence, I'm going to find you and I'm going to put it together. 470.40s - 474.00s | Every photograph that you post, I'm not only going to look at your face, I'm going to look at who 474.00s - 477.84s | you're standing next to. I'm going to look at what's in the background. I'm going to look at 477.84s - 482.96s | the date, time group, and I'm going to put together a pattern of life and a pattern of movement and a 482.96s - 488.00s | pattern of communication. All of these things I can get from your social media. And the more that 488.00s - 493.60s | I can get as an adversary about how you live and how you travel, the better I can determine if I 493.60s - 498.64s | were a foreign intelligence, where I can possibly sit next to you and try to solicit you, get 498.64s - 504.16s | information from you, maybe even try to turn you to my side. It's really nuanced, really, 504.16s - 508.72s | really nuanced, but definitely go and take a look at what your social media presence looks like. 509.60s - 514.16s | See if you were investigating yourself, what could you put together? It's pretty eye-opening. 514.16s - 518.40s | I'm not saying get rid of your Facebook account. You don't have to do that, but I'm just saying 518.40s - 524.08s | use it a little bit better. This


chunk_text:
going to look at what's in the background. I'm going to look at 477.84s - 482.96s | the date, time group, and I'm going to put together a pattern of life and a pattern of movement and a 482.96s - 488.00s | pattern of communication. All of these things I can get from your social media. And the more that 488.00s - 493.60s | I can get as an adversary about how you live and how you travel, the better I can determine if I 493.60s - 498.64s | were a foreign intelligence, where I can possibly sit next to you and try to solicit you, get 498.64s - 504.16s | information from you, maybe even try to turn you to my side. It's really nuanced, really, 504.16s - 508.72s | really nuanced, but definitely go and take a look at what your social media presence looks like. 509.60s - 514.16s | See if you were investigating yourself, what could you put together? It's pretty eye-opening. 514.16s - 518.40s | I'm not saying get rid of your Facebook account. You don't have to do that, but I'm just saying 518.40s - 524.08s | use it a little bit better. This is when you start getting into open source intelligence. 524.08s - 528.48s | If you really want to see what your internet footprint looks like, use some of these resources. 528.48s - 534.40s | See what's out there. These are all accessible to me. I can get you from these. If you can get 534.40s - 538.56s | yourself from these, great. Even if you can't get rid of that information and deleting your 538.56s - 545.12s | data off the internet is extremely hard. It's really time consuming. It may be a Sisyphean 545.12s - 549.76s | task because whether you delete it in one place or not, it'll appear in another place. It's like 549.76s - 554.08s | playing whack-a-mole, but at least you're aware that it's out there. If you know that it's out 554.08s - 559.28s | there, you can put other mitigations in place. You can maybe alter some of your routines. Maybe 559.28s - 564.48s | stop using an app. Maybe think a little bit more about whether you tag something, giving your 564.48s - 569.76s | location out, stuff like that. It's an extremely useful exercise to think like the enemy and see


chunk_text:
is when you start getting into open source intelligence. 524.08s - 528.48s | If you really want to see what your internet footprint looks like, use some of these resources. 528.48s - 534.40s | See what's out there. These are all accessible to me. I can get you from these. If you can get 534.40s - 538.56s | yourself from these, great. Even if you can't get rid of that information and deleting your 538.56s - 545.12s | data off the internet is extremely hard. It's really time consuming. It may be a Sisyphean 545.12s - 549.76s | task because whether you delete it in one place or not, it'll appear in another place. It's like 549.76s - 554.08s | playing whack-a-mole, but at least you're aware that it's out there. If you know that it's out 554.08s - 559.28s | there, you can put other mitigations in place. You can maybe alter some of your routines. Maybe 559.28s - 564.48s | stop using an app. Maybe think a little bit more about whether you tag something, giving your 564.48s - 569.76s | location out, stuff like that. It's an extremely useful exercise to think like the enemy and see 569.76s - 577.60s | what you can find on you. Now let's talk about phones. I hate phones. I hate them. I hate them 577.60s - 583.52s | because I absolutely need it. And it always, always tries to bite me. Always. You have so many 583.52s - 588.80s | radio genes on a typical phone that there's no way to tamp it down. But there are some things that 588.80s - 593.60s | you can do to try to mitigate the risk. All of the signals that your phone is going to put out 593.60s - 598.24s | is collected by the operating system. It's collected by whatever's providing you internet 598.24s - 603.44s | access. Every single application is trying to access all the way down to the kernel level, 603.44s - 609.84s | all the inner workings of your device. Bluetooth, Wi-Fi, anything. If you're connected to something, 609.84s - 615.68s | it wants your location. If I'm the adversary, getting your email's fine. Getting your 615.68s - 621.52s | communications are good. I got some content and photos. Great. I might even get some file access. 622.16s - 627.52s | But if I get your location,


chunk_text:
569.76s - 577.60s | what you can find on you. Now let's talk about phones. I hate phones. I hate them. I hate them 577.60s - 583.52s | because I absolutely need it. And it always, always tries to bite me. Always. You have so many 583.52s - 588.80s | radio genes on a typical phone that there's no way to tamp it down. But there are some things that 588.80s - 593.60s | you can do to try to mitigate the risk. All of the signals that your phone is going to put out 593.60s - 598.24s | is collected by the operating system. It's collected by whatever's providing you internet 598.24s - 603.44s | access. Every single application is trying to access all the way down to the kernel level, 603.44s - 609.84s | all the inner workings of your device. Bluetooth, Wi-Fi, anything. If you're connected to something, 609.84s - 615.68s | it wants your location. If I'm the adversary, getting your email's fine. Getting your 615.68s - 621.52s | communications are good. I got some content and photos. Great. I might even get some file access. 622.16s - 627.52s | But if I get your location, if I know where you are, that's my bread and butter. Because then I 627.52s - 632.56s | know where I can find you. I know who you're meeting with. And I know for how long. And I'm 632.56s - 638.64s | developing that pattern of life. Foreign intelligence, security services, FIS, they're the ones that are 638.64s - 644.56s | typically after my clients, foreign military members. You can't really do much if you just 644.56s - 649.76s | track them online. What's the end point? The end point is to try to solicit them in person. 649.76s - 654.48s | This is a means to an end. I can't do that without location. That's when I start getting into 654.48s - 660.16s | wireless anti-tracking. If I can try to tamp down how much my phone is giving out my location, 660.16s - 666.56s | then that's what I'm going to go for. The reason why location is so dangerous is because it is the 666.56s - 672.96s | business model for your device. So the way that advertising works is you use an application for 672.96s - 678.64s | free. It's got to get paid for somehow.


chunk_text:
if I know where you are, that's my bread and butter. Because then I 627.52s - 632.56s | know where I can find you. I know who you're meeting with. And I know for how long. And I'm 632.56s - 638.64s | developing that pattern of life. Foreign intelligence, security services, FIS, they're the ones that are 638.64s - 644.56s | typically after my clients, foreign military members. You can't really do much if you just 644.56s - 649.76s | track them online. What's the end point? The end point is to try to solicit them in person. 649.76s - 654.48s | This is a means to an end. I can't do that without location. That's when I start getting into 654.48s - 660.16s | wireless anti-tracking. If I can try to tamp down how much my phone is giving out my location, 660.16s - 666.56s | then that's what I'm going to go for. The reason why location is so dangerous is because it is the 666.56s - 672.96s | business model for your device. So the way that advertising works is you use an application for 672.96s - 678.64s | free. It's got to get paid for somehow. And so it follows this cycle. The organization that made 678.64s - 683.60s | your app is collecting your data. It's selling it to a data broker. Data broker sells that to 683.60s - 688.56s | advertisers. Advertisers send you advertisements. And every click is going to be more money. 688.56s - 693.28s | It's a cycle, but it's innocuous. They're not the enemy. They're not trying to go after you. 693.28s - 697.92s | But the problem is when you're making money from advertising, you're not making any money from 697.92s - 704.72s | security. So that's why this is so bad. They're not trying to get after you. But if somebody 704.72s - 709.76s | breaches those data and all of your collected information is out there, your location is out 709.76s - 715.04s | there. And I, as the adversary, can buy it or I can steal it or I could just go open source and I 715.04s - 720.08s | could find it somewhere for free anyway. So that's why it's a goldmine for someone like me. 720.64s - 724.24s | That's why your phones are so dangerous. It's all about the location. It's all about


chunk_text:
And so it follows this cycle. The organization that made 678.64s - 683.60s | your app is collecting your data. It's selling it to a data broker. Data broker sells that to 683.60s - 688.56s | advertisers. Advertisers send you advertisements. And every click is going to be more money. 688.56s - 693.28s | It's a cycle, but it's innocuous. They're not the enemy. They're not trying to go after you. 693.28s - 697.92s | But the problem is when you're making money from advertising, you're not making any money from 697.92s - 704.72s | security. So that's why this is so bad. They're not trying to get after you. But if somebody 704.72s - 709.76s | breaches those data and all of your collected information is out there, your location is out 709.76s - 715.04s | there. And I, as the adversary, can buy it or I can steal it or I could just go open source and I 715.04s - 720.08s | could find it somewhere for free anyway. So that's why it's a goldmine for someone like me. 720.64s - 724.24s | That's why your phones are so dangerous. It's all about the location. It's all about the 724.24s - 730.88s | advertising system. Can you get around it? Yeah, you can mitigate a lot of this. And we'll start 730.88s - 737.20s | getting into that. Smart cities are becoming more and more prevalent. UTS or ubiquitous technical 737.20s - 742.64s | surveillance is a reality. If you live in the United States, you're seeing these things pop 742.64s - 747.60s | up more and more. If you live overseas, it's already what you live in. You have cameras 747.60s - 753.04s | everywhere with facial recognition as your edge computing. So it doesn't really matter one way 753.04s - 757.12s | or another if you have a mainframe or something like that that has all your faces in it. These 757.12s - 761.44s | cameras can automatically use algorithms to detect your face. It's instantaneous. 762.72s - 768.40s | ShotSpotter is a neat technology that takes audio from surrounding areas and it tries to correlate 768.40s - 773.36s | that audio with gunshots and then it alerts law enforcement. So you have video and you have sound. 774.00s - 779.04s | You have tag readers, license plate readers all over the place that'll read where


chunk_text:
the 724.24s - 730.88s | advertising system. Can you get around it? Yeah, you can mitigate a lot of this. And we'll start 730.88s - 737.20s | getting into that. Smart cities are becoming more and more prevalent. UTS or ubiquitous technical 737.20s - 742.64s | surveillance is a reality. If you live in the United States, you're seeing these things pop 742.64s - 747.60s | up more and more. If you live overseas, it's already what you live in. You have cameras 747.60s - 753.04s | everywhere with facial recognition as your edge computing. So it doesn't really matter one way 753.04s - 757.12s | or another if you have a mainframe or something like that that has all your faces in it. These 757.12s - 761.44s | cameras can automatically use algorithms to detect your face. It's instantaneous. 762.72s - 768.40s | ShotSpotter is a neat technology that takes audio from surrounding areas and it tries to correlate 768.40s - 773.36s | that audio with gunshots and then it alerts law enforcement. So you have video and you have sound. 774.00s - 779.04s | You have tag readers, license plate readers all over the place that'll read where your vehicle 779.04s - 784.72s | is going. You also have point of sale systems. If any of you use touchless payment with your phone, 784.72s - 791.52s | that's being collected as well. All of these things ostensibly are being collected anonymously, 791.52s - 795.68s | but in order for them to work with the vast amount of collection that they need to do, 795.68s - 800.80s | there's not a lot of overhead for security. So once again, just like the advertising system, 800.80s - 805.12s | you're looking at something that is breachable. You're looking at anonymous data that can be 805.12s - 810.64s | easily de-anonymized. So ubiquitous technical surveillance in a smart city is going to be 810.64s - 814.88s | the enemy in this case. It doesn't want to be your enemy. It wants to do good. It wants to 814.88s - 820.80s | alert a fire department when there's a fire. But as an adversary, you can weaponize these data. 821.60s - 825.92s | So how do you get around it? If you want to take a picture of this slide, go for it because I'm not 825.92s - 829.36s | going to


chunk_text:
your vehicle 779.04s - 784.72s | is going. You also have point of sale systems. If any of you use touchless payment with your phone, 784.72s - 791.52s | that's being collected as well. All of these things ostensibly are being collected anonymously, 791.52s - 795.68s | but in order for them to work with the vast amount of collection that they need to do, 795.68s - 800.80s | there's not a lot of overhead for security. So once again, just like the advertising system, 800.80s - 805.12s | you're looking at something that is breachable. You're looking at anonymous data that can be 805.12s - 810.64s | easily de-anonymized. So ubiquitous technical surveillance in a smart city is going to be 810.64s - 814.88s | the enemy in this case. It doesn't want to be your enemy. It wants to do good. It wants to 814.88s - 820.80s | alert a fire department when there's a fire. But as an adversary, you can weaponize these data. 821.60s - 825.92s | So how do you get around it? If you want to take a picture of this slide, go for it because I'm not 825.92s - 829.36s | going to explain everything. We don't have the time for that. But there are simple things that 829.36s - 834.24s | you can do to mitigate. The biggest thing you can do is turning off some of those radio chains on 834.24s - 839.76s | your devices, specifically Bluetooth and Wi-Fi. Wireless sensors are everywhere. If you don't put 839.76s - 844.72s | out a wireless signal, I won't be able to get you. It's not 100%, but it comes close. 845.28s - 849.04s | Same thing with your web browsers. If you use an ad blocker or if you put on strict cookie 849.04s - 853.52s | protection, you should be okay. There's recent news that Firefox was kind of lying and not 853.52s - 858.56s | really blocking your third-party cookies. You can go into your custom settings in Firefox and you 858.56s - 864.96s | can customize blocking cookies. I think that kind of goes around that just overall strict problem. 864.96s - 871.28s | But I would recommend something like uBlock Origin for the time that it still works. It's a pretty 872.24s - 876.64s | good add-on that I think does the job of getting rid of


chunk_text:
explain everything. We don't have the time for that. But there are simple things that 829.36s - 834.24s | you can do to mitigate. The biggest thing you can do is turning off some of those radio chains on 834.24s - 839.76s | your devices, specifically Bluetooth and Wi-Fi. Wireless sensors are everywhere. If you don't put 839.76s - 844.72s | out a wireless signal, I won't be able to get you. It's not 100%, but it comes close. 845.28s - 849.04s | Same thing with your web browsers. If you use an ad blocker or if you put on strict cookie 849.04s - 853.52s | protection, you should be okay. There's recent news that Firefox was kind of lying and not 853.52s - 858.56s | really blocking your third-party cookies. You can go into your custom settings in Firefox and you 858.56s - 864.96s | can customize blocking cookies. I think that kind of goes around that just overall strict problem. 864.96s - 871.28s | But I would recommend something like uBlock Origin for the time that it still works. It's a pretty 872.24s - 876.64s | good add-on that I think does the job of getting rid of a lot of those cookies, especially the ones 876.64s - 882.48s | that collect location data. When you're looking at payment systems, cash is still king. If you 882.48s - 887.20s | pay with cash, you're good. There is a camera that sees your face. There's probably audio that 887.20s - 892.72s | will recognize your voice. But at least what you're paying and what you're buying might still 892.72s - 897.28s | be a little bit of a secret, at least for now. And then lastly, if you're looking at your cars, 897.60s - 901.44s | it's difficult. If you want a good car, it's going to be connected. It'll have many radio 901.44s - 908.24s | chains. But do yourself a favor. Try to refrain from connecting your phone to your car because 908.24s - 912.64s | the car is not just accessing your music. It's not just accessing apps and stuff like that 912.64s - 920.00s | for navigation. It's also accessing usernames, contacts, call history, SMS history. And cars, 920.00s - 924.32s | the security are not great in a car. So if I were to hack into a car, I would probably 925.04s - 929.84s


chunk_text:
a lot of those cookies, especially the ones 876.64s - 882.48s | that collect location data. When you're looking at payment systems, cash is still king. If you 882.48s - 887.20s | pay with cash, you're good. There is a camera that sees your face. There's probably audio that 887.20s - 892.72s | will recognize your voice. But at least what you're paying and what you're buying might still 892.72s - 897.28s | be a little bit of a secret, at least for now. And then lastly, if you're looking at your cars, 897.60s - 901.44s | it's difficult. If you want a good car, it's going to be connected. It'll have many radio 901.44s - 908.24s | chains. But do yourself a favor. Try to refrain from connecting your phone to your car because 908.24s - 912.64s | the car is not just accessing your music. It's not just accessing apps and stuff like that 912.64s - 920.00s | for navigation. It's also accessing usernames, contacts, call history, SMS history. And cars, 920.00s - 924.32s | the security are not great in a car. So if I were to hack into a car, I would probably 925.04s - 929.84s | in a car. So if I were to hack into a car, I basically have what is also on your phone, 929.84s - 934.40s | especially when you're renting a car. Think about that. Think about the wireless implications of 934.40s - 939.04s | tethering a device. So we can get into that. We could spend an hour. I don't have an hour. 939.04s - 944.32s | I wish I did. So now let's get into a little bit more physical security stuff. 944.96s - 948.56s | When you're going through any security checkpoints, I'm talking about airports, 948.56s - 954.56s | rail, whatever, turn your devices off, completely cold. Even with the best forensics equipment, 954.56s - 959.36s | something that is turned off, what we call a cold state, would be extremely hard to get into, 959.36s - 965.84s | especially if it's a modern operating system. Android 13-ish and up, the latest iOS, 967.76s - 971.84s | they all use file-based encryption, which forensically is a lot harder than full disk 971.84s - 976.64s | encryption. If you have your device turned off, I as an adversary would have a hard time getting 976.64s - 981.28s


chunk_text:
| in a car. So if I were to hack into a car, I basically have what is also on your phone, 929.84s - 934.40s | especially when you're renting a car. Think about that. Think about the wireless implications of 934.40s - 939.04s | tethering a device. So we can get into that. We could spend an hour. I don't have an hour. 939.04s - 944.32s | I wish I did. So now let's get into a little bit more physical security stuff. 944.96s - 948.56s | When you're going through any security checkpoints, I'm talking about airports, 948.56s - 954.56s | rail, whatever, turn your devices off, completely cold. Even with the best forensics equipment, 954.56s - 959.36s | something that is turned off, what we call a cold state, would be extremely hard to get into, 959.36s - 965.84s | especially if it's a modern operating system. Android 13-ish and up, the latest iOS, 967.76s - 971.84s | they all use file-based encryption, which forensically is a lot harder than full disk 971.84s - 976.64s | encryption. If you have your device turned off, I as an adversary would have a hard time getting 976.64s - 981.28s | into that device. If I only have you for 20 minutes in secondary at an airport, that's not 981.28s - 986.24s | enough time to crack anything. If your device is locked but it's turned on, we call that a warm 986.24s - 991.60s | state. Depending on the operating system and the version, maybe I can brute force your pin. If you 991.60s - 996.96s | use a six-digit pin or higher, that would take too long. If you have your phone on and unlocked, well 996.96s - 1003.12s | then, physical possession is always going to be the king and queen here. So if you don't have it 1003.12s - 1009.12s | locked, that's on you, I got everything. So do yourself a favor, turn it off. If you have it on 1009.12s - 1013.52s | your person and not in a bag, that's a bonus. Most places, when they pull you into secondary, 1013.52s - 1017.68s | they're not going to search your body, they may search your bags. So do yourself a favor. 1018.72s - 1022.40s | Another thing to keep in mind, and this is a little bit more advanced, if you're worried about


chunk_text:
| into that device. If I only have you for 20 minutes in secondary at an airport, that's not 981.28s - 986.24s | enough time to crack anything. If your device is locked but it's turned on, we call that a warm 986.24s - 991.60s | state. Depending on the operating system and the version, maybe I can brute force your pin. If you 991.60s - 996.96s | use a six-digit pin or higher, that would take too long. If you have your phone on and unlocked, well 996.96s - 1003.12s | then, physical possession is always going to be the king and queen here. So if you don't have it 1003.12s - 1009.12s | locked, that's on you, I got everything. So do yourself a favor, turn it off. If you have it on 1009.12s - 1013.52s | your person and not in a bag, that's a bonus. Most places, when they pull you into secondary, 1013.52s - 1017.68s | they're not going to search your body, they may search your bags. So do yourself a favor. 1018.72s - 1022.40s | Another thing to keep in mind, and this is a little bit more advanced, if you're worried about 1022.40s - 1027.28s | your phone or your computer being compromised and you have sensitive stuff in a chat app or over 1027.28s - 1032.32s | email, uninstall that app before you go through the security checkpoint, because then there's no 1032.32s - 1036.72s | evidence that it was there unless they do a full forensic rip. And if that's the case, you probably 1036.72s - 1040.80s | have bigger problems than what the content was. But that's just something a lot of people don't 1040.80s - 1044.96s | really take into account. You're not going to lose all your data if you uninstall the app. When you're 1044.96s - 1049.28s | finished, you get everything back, you reinstall it, you're okay. But just keep those little tidbits 1049.28s - 1055.20s | in mind. Security checkpoints, they're a minefield. Ask me how I know. I would also avoid doing any 1055.20s - 1059.12s | dummy devices, because eventually they'll look at your phone that's a dummy phone and be like, oh, 1059.12s - 1064.08s | there's nothing on here. That's strange. Then they may ask to search some other things. And 1064.08s - 1068.32s | if they find your real


chunk_text:
1022.40s - 1027.28s | your phone or your computer being compromised and you have sensitive stuff in a chat app or over 1027.28s - 1032.32s | email, uninstall that app before you go through the security checkpoint, because then there's no 1032.32s - 1036.72s | evidence that it was there unless they do a full forensic rip. And if that's the case, you probably 1036.72s - 1040.80s | have bigger problems than what the content was. But that's just something a lot of people don't 1040.80s - 1044.96s | really take into account. You're not going to lose all your data if you uninstall the app. When you're 1044.96s - 1049.28s | finished, you get everything back, you reinstall it, you're okay. But just keep those little tidbits 1049.28s - 1055.20s | in mind. Security checkpoints, they're a minefield. Ask me how I know. I would also avoid doing any 1055.20s - 1059.12s | dummy devices, because eventually they'll look at your phone that's a dummy phone and be like, oh, 1059.12s - 1064.08s | there's nothing on here. That's strange. Then they may ask to search some other things. And 1064.08s - 1068.32s | if they find your real phone, that's going to raise a couple more questions. Don't increase 1068.32s - 1072.72s | your attack surface. Don't give yourself another bullseye. Avoid the whole dummy phone and dummy 1072.72s - 1079.68s | computer thing. All right. Inevitably, I get asked about VPNs. This is probably the only really 1079.68s - 1087.04s | technical conversation I'm going to get into here. A VPN is simple. It is a tunnel that encrypts data. 1087.04s - 1092.24s | That's all it does. A lot of people use that for privacy. It's not private. It's more for security 1092.24s - 1097.68s | than anything else. Commercial VPNs, stuff that your company would issue you, it gives you a tunnel 1097.68s - 1102.72s | where you can work in their network, in their corporate infrastructure. That's what a virtual 1102.72s - 1108.48s | private network is. You're virtually part of that private network. Off-the-shelf VPNs like NordVPN, 1108.48s - 1113.76s | Proton, all those, what they essentially do is give you a tunnel from your end user device 1113.76s - 1119.12s | to another server somewhere else that has a different IP address. Between your end user 1119.12s - 1124.40s | device and


chunk_text:
phone, that's going to raise a couple more questions. Don't increase 1068.32s - 1072.72s | your attack surface. Don't give yourself another bullseye. Avoid the whole dummy phone and dummy 1072.72s - 1079.68s | computer thing. All right. Inevitably, I get asked about VPNs. This is probably the only really 1079.68s - 1087.04s | technical conversation I'm going to get into here. A VPN is simple. It is a tunnel that encrypts data. 1087.04s - 1092.24s | That's all it does. A lot of people use that for privacy. It's not private. It's more for security 1092.24s - 1097.68s | than anything else. Commercial VPNs, stuff that your company would issue you, it gives you a tunnel 1097.68s - 1102.72s | where you can work in their network, in their corporate infrastructure. That's what a virtual 1102.72s - 1108.48s | private network is. You're virtually part of that private network. Off-the-shelf VPNs like NordVPN, 1108.48s - 1113.76s | Proton, all those, what they essentially do is give you a tunnel from your end user device 1113.76s - 1119.12s | to another server somewhere else that has a different IP address. Between your end user 1119.12s - 1124.40s | device and that server, you have some pretty good encryption. If I were trying to sniff packets in 1124.40s - 1129.84s | the air, I would just get a bunch of nonsense. But as soon as your traffic leaves this VPN server, 1129.84s - 1135.60s | it is you. It is ostensibly you. Everything you're doing, all the sites you're going to, 1135.60s - 1140.40s | any other traffic, it's all out there. It can be de-anonymized, especially if you're logging into 1140.40s - 1145.20s | things using a username associated with you. The benefit of a VPN is that it changes your 1145.20s - 1150.80s | location. Your perceived location over the internet changes. That's the good thing about a VPN. 1150.80s - 1156.88s | So if I was in Somalia and I wanted to watch US Netflix, I VPN to a US server. I watch Netflix. 1156.88s - 1161.92s | But it doesn't mean that somebody in the US that sees my traffic wouldn't be able to attack me. 1161.92s - 1167.04s | They would just have a false impression of where I am. That's all a VPN does. It's a good security 1167.04s - 1171.20s | measure. It's good


chunk_text:
that server, you have some pretty good encryption. If I were trying to sniff packets in 1124.40s - 1129.84s | the air, I would just get a bunch of nonsense. But as soon as your traffic leaves this VPN server, 1129.84s - 1135.60s | it is you. It is ostensibly you. Everything you're doing, all the sites you're going to, 1135.60s - 1140.40s | any other traffic, it's all out there. It can be de-anonymized, especially if you're logging into 1140.40s - 1145.20s | things using a username associated with you. The benefit of a VPN is that it changes your 1145.20s - 1150.80s | location. Your perceived location over the internet changes. That's the good thing about a VPN. 1150.80s - 1156.88s | So if I was in Somalia and I wanted to watch US Netflix, I VPN to a US server. I watch Netflix. 1156.88s - 1161.92s | But it doesn't mean that somebody in the US that sees my traffic wouldn't be able to attack me. 1161.92s - 1167.04s | They would just have a false impression of where I am. That's all a VPN does. It's a good security 1167.04s - 1171.20s | measure. It's good for defense in depth. It is not an end-all be-all. It won't protect you from 1171.20s - 1177.28s | malware, phishing, all the other bad things that are out there. I just want to make that clear 1177.28s - 1181.84s | because I get a lot of questions about, will a VPN save me? It depends on who you're running away 1181.84s - 1187.44s | from, but probably not. So other questions about VPNs definitely hit me up offline. 1188.88s - 1192.16s | So let's cover what we went through in the very, very short time that I had. 1192.80s - 1198.16s | We have physical security aspects. No location means I can't find you. I think that that's 1198.16s - 1204.08s | relatively secure. You can't block all location, but you can try. Your online security. If you try 1204.08s - 1209.12s | to target you on social media, you'll find where your vulnerabilities are and you can mitigate that. 1209.12s - 1215.60s | Definitely OSINT yourself. For communication security, end-to-end encryption is what we got 1215.60s - 1220.88s | and it works. If all of you could reverse engineer the apps that you use, we'd be golden, but


chunk_text:
for defense in depth. It is not an end-all be-all. It won't protect you from 1171.20s - 1177.28s | malware, phishing, all the other bad things that are out there. I just want to make that clear 1177.28s - 1181.84s | because I get a lot of questions about, will a VPN save me? It depends on who you're running away 1181.84s - 1187.44s | from, but probably not. So other questions about VPNs definitely hit me up offline. 1188.88s - 1192.16s | So let's cover what we went through in the very, very short time that I had. 1192.80s - 1198.16s | We have physical security aspects. No location means I can't find you. I think that that's 1198.16s - 1204.08s | relatively secure. You can't block all location, but you can try. Your online security. If you try 1204.08s - 1209.12s | to target you on social media, you'll find where your vulnerabilities are and you can mitigate that. 1209.12s - 1215.60s | Definitely OSINT yourself. For communication security, end-to-end encryption is what we got 1215.60s - 1220.88s | and it works. If all of you could reverse engineer the apps that you use, we'd be golden, but you 1220.88s - 1226.72s | can't. There's got to be some level of trust, but I would say if you're doing regular telephony like 1227.36s - 1232.16s | your standard phone calls and your standard SMS, a lot less security than using something like 1232.16s - 1238.32s | WhatsApp, Signal, Wire, Session, anything like that. So consider end-to-end encryption for your 1238.32s - 1244.96s | communications. All right. Maybe I have time for questions. I think I have like, what, 1244.96s - 1250.64s | just a few minutes. If you want to reach out to me, please reach out to me. That QR code, 1251.76s - 1255.68s | I'm looking at people that are clicking it and I'm trying to make a note of like, did you really 1255.68s - 1259.12s | do your threat model with this? But it's okay. You can click it. It's fine. I'm not going to come 1259.12s - 1264.16s | after you. Those are some books and some websites that I recommend for further learning, but 1264.16s - 1267.92s | definitely reach out to me if you have any questions because I am sorry this is very short, 1267.92s - 1279.06s | but I


chunk_text:
you 1220.88s - 1226.72s | can't. There's got to be some level of trust, but I would say if you're doing regular telephony like 1227.36s - 1232.16s | your standard phone calls and your standard SMS, a lot less security than using something like 1232.16s - 1238.32s | WhatsApp, Signal, Wire, Session, anything like that. So consider end-to-end encryption for your 1238.32s - 1244.96s | communications. All right. Maybe I have time for questions. I think I have like, what, 1244.96s - 1250.64s | just a few minutes. If you want to reach out to me, please reach out to me. That QR code, 1251.76s - 1255.68s | I'm looking at people that are clicking it and I'm trying to make a note of like, did you really 1255.68s - 1259.12s | do your threat model with this? But it's okay. You can click it. It's fine. I'm not going to come 1259.12s - 1264.16s | after you. Those are some books and some websites that I recommend for further learning, but 1264.16s - 1267.92s | definitely reach out to me if you have any questions because I am sorry this is very short, 1267.92s - 1279.06s | but I hope you got something out of it and thanks very much. And I think I have two minutes. I have 1279.06s - 1283.14s | two minutes if anyone has anything they want to ask. And please keep in mind, I lost my hearing 1283.14s - 1290.67s | in the war. So please speak up if you're going to ask anything. I don't see any brave souls. 1292.67s - 1307.60s | Yes, sir. You may be compelled to get an email from me if you email me because the email address 1307.60s - 1311.84s | is also in the QR code and then you'll have to have a conversation with me. And I don't know 1311.84s - 1319.47s | how that's going to go. That's up to you, but you're a brave soul. All right. Please come find 1319.47s - 1323.31s | me. I'm probably going to be hanging out in Crypto Privacy Village if you want to have a chat. 1323.31s - 1325.87s | And once again, thank you very much for sitting through this.


chunk_text:
hope you got something out of it and thanks very much. And I think I have two minutes. I have 1279.06s - 1283.14s | two minutes if anyone has anything they want to ask. And please keep in mind, I lost my hearing 1283.14s - 1290.67s | in the war. So please speak up if you're going to ask anything. I don't see any brave souls. 1292.67s - 1307.60s | Yes, sir. You may be compelled to get an email from me if you email me because the email address 1307.60s - 1311.84s | is also in the QR code and then you'll have to have a conversation with me. And I don't know 1311.84s - 1319.47s | how that's going to go. That's up to you, but you're a brave soul. All right. Please come find 1319.47s - 1323.31s | me. I'm probably going to be hanging out in Crypto Privacy Village if you want to have a chat. 1323.31s - 1325.87s | And once again, thank you very much for sitting through this.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=TqKb7h8VFcA", "title": "DEF CON 32 - Top War Stories from a TryHard Bug Bounty Hunter -Justin Rhynorater Gardner", "description": "Ask any top bug bounty hunter: the best part of a live hacking event is the Show & Tell; the time when the veil is lifted and we collectively revel in the ingenuity of the best finds from the competition. The goal of this talk is to give you that same experience. I will speak to you as the competent hackers that you are, not withholding the nitty-gritty technical details and the Ls along the way. Together, we\u2019ll journey through the highs and the lows of my hunts, both solo and in a Live Hacking Event context. You\u2019ll see everything from RCE to SQL injection, mass PII leakage to spying on people\u2019s homes and workplaces. You\u2019ll find some bugs mind-numbingly simple, and some bugs mind-bogglingly complex. Each bug in this talk was assigned the highest severity possible, and awarded somewhere between $10k-$60k in bounties.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 3037, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.76s | This text was transcribed using whisper model: large-v2 Alrighty y'all, I think we're going to go ahead and get started a little bit early. 3.30s - 5.36s | Sorry for any of the people that are coming in at the last minute, 5.36s - 7.36s | but we'll go ahead and get rolling. 7.36s - 12.36s | Also, I realized that I got super lucky because this is the last slot of the day. 12.76s - 15.36s | So we can go a little bit long, which is exciting. 15.96s - 17.52s | You guys can hear me all right on this one, too, right? 17.52s - 18.80s | I kind of like to walk around a little bit. 18.80s - 22.26s | OK, so. Oh, I need to point it right at it. 22.26s - 25.00s | OK, so for any of you, the guys that don't know me, 25.00s - 27.00s | I'm Justin Gardner, a.k.a. Rhino Raider. 27.00s - 29.80s | I'm a professional live hacking event participant, a.k.a. 29.80s - 31.80s | full time bug bounty, a.k.a. 32.50s - 33.86s | no job. 33.86s - 37.90s | And I hack web applications mostly and IOT devices 38.60s - 43.00s | occasionally and sometimes mobile devices when Joel is here to help me out. 44.30s - 47.10s


chunk_text:
a little bit early. 3.30s - 5.36s | Sorry for any of the people that are coming in at the last minute, 5.36s - 7.36s | but we'll go ahead and get rolling. 7.36s - 12.36s | Also, I realized that I got super lucky because this is the last slot of the day. 12.76s - 15.36s | So we can go a little bit long, which is exciting. 15.96s - 17.52s | You guys can hear me all right on this one, too, right? 17.52s - 18.80s | I kind of like to walk around a little bit. 18.80s - 22.26s | OK, so. Oh, I need to point it right at it. 22.26s - 25.00s | OK, so for any of you, the guys that don't know me, 25.00s - 27.00s | I'm Justin Gardner, a.k.a. Rhino Raider. 27.00s - 29.80s | I'm a professional live hacking event participant, a.k.a. 29.80s - 31.80s | full time bug bounty, a.k.a. 32.50s - 33.86s | no job. 33.86s - 37.90s | And I hack web applications mostly and IOT devices 38.60s - 43.00s | occasionally and sometimes mobile devices when Joel is here to help me out. 44.30s - 47.10s | I'm the host of the Critical Thinking Bug Bounty Podcast with my boy 47.10s - 48.70s | Joel right here as the co-host. 48.70s - 50.70s | And I'm also advisor for Kaido. 51.66s - 53.86s | So check those out if you're interested. 54.78s - 57.18s | All right, let's go ahead and talk about the road map for today's talk. 58.78s - 62.52s | We're going to hit 11 bugs and I don't have to rush, which is great. 62.86s - 65.28s | I was going to give you a disclaimer that we're going to move pretty quickly. 65.92s - 69.66s | The whole concept behind this talk was to kind of bring to you 69.66s - 74.06s | all the experience that the hackers get at a live hacking event 74.32s - 77.06s | during the show and tell portion, which is at the end of the event. 77.28s - 81.06s | When we all sit down and we compare notes, some of the people go up on stage 81.28s - 83.26s | and present the bugs that they've found. 83.26s - 85.76s | So what I've done is I've compiled 11 vulnerabilities for you 85.76s


chunk_text:
| I'm the host of the Critical Thinking Bug Bounty Podcast with my boy 47.10s - 48.70s | Joel right here as the co-host. 48.70s - 50.70s | And I'm also advisor for Kaido. 51.66s - 53.86s | So check those out if you're interested. 54.78s - 57.18s | All right, let's go ahead and talk about the road map for today's talk. 58.78s - 62.52s | We're going to hit 11 bugs and I don't have to rush, which is great. 62.86s - 65.28s | I was going to give you a disclaimer that we're going to move pretty quickly. 65.92s - 69.66s | The whole concept behind this talk was to kind of bring to you 69.66s - 74.06s | all the experience that the hackers get at a live hacking event 74.32s - 77.06s | during the show and tell portion, which is at the end of the event. 77.28s - 81.06s | When we all sit down and we compare notes, some of the people go up on stage 81.28s - 83.26s | and present the bugs that they've found. 83.26s - 85.76s | So what I've done is I've compiled 11 vulnerabilities for you 85.76s - 89.32s | over the past two or three years of bug bounty hunting, all criticals. 90.08s - 91.86s | And I'm going to walk you through each one. 91.86s - 95.42s | And I'm going to do so at as much technical depth as I can 95.42s - 96.58s | without revealing the target. 98.26s - 99.82s | We have three easy bugs. 99.82s - 102.68s | We have two mediums, four hards and two very hards. 103.22s - 105.92s | So we're going to start off easy and then we're going to go go 106.36s - 107.62s | a little bit deeper after that. 107.62s - 108.68s | All right, so let's jump into it. 108.68s - 112.88s | First one is an NGINX 403 bypass to PII leak. 112.88s - 116.00s | OK, so this is on a semi private program. 116.00s - 120.44s | You'll see actually throughout the whole presentation that we that 120.44s - 123.60s | most of the targets that I'm hacking on are public programs or 124.48s - 126.14s | are semi private programs, 126.14s - 129.24s | which is essentially a private program that everyone knows exists. 129.24s - 131.30s |


chunk_text:
- 89.32s | over the past two or three years of bug bounty hunting, all criticals. 90.08s - 91.86s | And I'm going to walk you through each one. 91.86s - 95.42s | And I'm going to do so at as much technical depth as I can 95.42s - 96.58s | without revealing the target. 98.26s - 99.82s | We have three easy bugs. 99.82s - 102.68s | We have two mediums, four hards and two very hards. 103.22s - 105.92s | So we're going to start off easy and then we're going to go go 106.36s - 107.62s | a little bit deeper after that. 107.62s - 108.68s | All right, so let's jump into it. 108.68s - 112.88s | First one is an NGINX 403 bypass to PII leak. 112.88s - 116.00s | OK, so this is on a semi private program. 116.00s - 120.44s | You'll see actually throughout the whole presentation that we that 120.44s - 123.60s | most of the targets that I'm hacking on are public programs or 124.48s - 126.14s | are semi private programs, 126.14s - 129.24s | which is essentially a private program that everyone knows exists. 129.24s - 131.30s | And they're very public about the fact that they exist. 131.30s - 134.88s | And you can easily get added to that program and paid for a bug if you have a bug. 136.04s - 138.64s | So when finding this bug, the first indicator 138.64s - 141.08s | that there might be a bug here was that the application 141.64s - 146.28s | or that the company was taking a piece of software that was meant for internal use. 146.64s - 149.38s | And then they've modified it to be publicly used. 149.38s - 152.20s | So anybody can sign up and log into this app. Right. 152.34s - 155.98s | So when they do that, of course, the threat model changes for the application. Right. 156.70s - 157.98s | So I thought that was really sketchy. 157.98s - 159.70s | So I decided to look into it a little bit deeper. 161.14s - 163.80s | So what I was thinking is, OK, well, when this app was intended 163.80s - 166.10s | for private use only within an organization, 166.38s - 169.84s | then there was probably a lot of implicit trust between the users in the organization.


chunk_text:
And they're very public about the fact that they exist. 131.30s - 134.88s | And you can easily get added to that program and paid for a bug if you have a bug. 136.04s - 138.64s | So when finding this bug, the first indicator 138.64s - 141.08s | that there might be a bug here was that the application 141.64s - 146.28s | or that the company was taking a piece of software that was meant for internal use. 146.64s - 149.38s | And then they've modified it to be publicly used. 149.38s - 152.20s | So anybody can sign up and log into this app. Right. 152.34s - 155.98s | So when they do that, of course, the threat model changes for the application. Right. 156.70s - 157.98s | So I thought that was really sketchy. 157.98s - 159.70s | So I decided to look into it a little bit deeper. 161.14s - 163.80s | So what I was thinking is, OK, well, when this app was intended 163.80s - 166.10s | for private use only within an organization, 166.38s - 169.84s | then there was probably a lot of implicit trust between the users in the organization. 170.10s - 173.26s | You know, if I am in an organization with Joel, 173.50s - 177.20s | it's probably not a huge problem if I can go and look and see his last name or whatever. 177.20s - 181.90s | Right. However, in a public application, that information may be more sensitive. 181.90s - 183.84s | So I decided to look for those sort of endpoints, 184.00s - 186.90s | exploiting implicit trust and leak user data. 187.86s - 190.50s | So I identified a couple of those endpoints in the 191.24s - 193.44s | sort of internal use version of the software. 193.84s - 198.74s | And when I hit them on the API, I noticed that I got an NGINX 403. Right. 199.24s - 202.16s | Instead of the application level 403, you can see the differences over there. 202.96s - 207.10s | The NGINX 403 seems to imply that there is a 208.50s - 211.26s | this sort of structure. OK, so we're on the network. 211.50s - 214.56s | We send a request over the Internet to the NGINX reverse proxy 214.56s - 217.06s | that's standing in front of the back end server. 217.24s


chunk_text:
170.10s - 173.26s | You know, if I am in an organization with Joel, 173.50s - 177.20s | it's probably not a huge problem if I can go and look and see his last name or whatever. 177.20s - 181.90s | Right. However, in a public application, that information may be more sensitive. 181.90s - 183.84s | So I decided to look for those sort of endpoints, 184.00s - 186.90s | exploiting implicit trust and leak user data. 187.86s - 190.50s | So I identified a couple of those endpoints in the 191.24s - 193.44s | sort of internal use version of the software. 193.84s - 198.74s | And when I hit them on the API, I noticed that I got an NGINX 403. Right. 199.24s - 202.16s | Instead of the application level 403, you can see the differences over there. 202.96s - 207.10s | The NGINX 403 seems to imply that there is a 208.50s - 211.26s | this sort of structure. OK, so we're on the network. 211.50s - 214.56s | We send a request over the Internet to the NGINX reverse proxy 214.56s - 217.06s | that's standing in front of the back end server. 217.24s - 220.60s | And then the back end server processes that request, gives the response 220.60s - 222.74s | back to NGINX, which gives a response back to the user. 222.94s - 226.70s | Pretty standard NGINX structure or reverse proxy structure. 227.06s - 230.62s | However, when we request the point or the API endpoint slash API 230.86s - 233.96s | slash internal slash get all users, that's not the API endpoint. 234.90s - 236.50s | That's obfuscated. 236.80s - 239.32s | It hits the reverse proxy 239.62s - 242.62s | and then the reverse proxy says, but not allowed. Right. 243.36s - 247.02s | So I noticed the difference between those two 403 pages. 247.26s - 249.36s | And I thought we should try to fuzz that a little bit. 249.36s - 250.66s | So what do we do? 250.66s - 252.36s | We try get all users. 252.36s - 253.52s | We hit the 403. 253.52s - 255.70s | We try get all users with a Z. 256.50s - 260.70s | Just to see if they had like blocked off that specific endpoint 260.70s - 265.96s | at the NGINX level or whether they are blocking out


chunk_text:
- 220.60s | And then the back end server processes that request, gives the response 220.60s - 222.74s | back to NGINX, which gives a response back to the user. 222.94s - 226.70s | Pretty standard NGINX structure or reverse proxy structure. 227.06s - 230.62s | However, when we request the point or the API endpoint slash API 230.86s - 233.96s | slash internal slash get all users, that's not the API endpoint. 234.90s - 236.50s | That's obfuscated. 236.80s - 239.32s | It hits the reverse proxy 239.62s - 242.62s | and then the reverse proxy says, but not allowed. Right. 243.36s - 247.02s | So I noticed the difference between those two 403 pages. 247.26s - 249.36s | And I thought we should try to fuzz that a little bit. 249.36s - 250.66s | So what do we do? 250.66s - 252.36s | We try get all users. 252.36s - 253.52s | We hit the 403. 253.52s - 255.70s | We try get all users with a Z. 256.50s - 260.70s | Just to see if they had like blocked off that specific endpoint 260.70s - 265.96s | at the NGINX level or whether they are blocking out the path before that. 265.96s - 267.70s | Right. We get a 404 there. 267.70s - 272.66s | So not that whole path is slash API slash internal is not all blocked. 272.82s - 274.60s | Just get all users. 274.60s - 276.56s | So then I tried some path traversal stuff. 276.56s - 279.80s | And eventually I started encoding various characters and found out 279.80s - 284.46s | that a double URL encoded S would pass through the reverse proxy 284.46s - 288.42s | and not be perceived as a match for the block on get all users route. 288.68s - 293.22s | And it would be parsed on the back end as an S. 293.28s - 297.12s | So it would match that get all users route and dump back a ton of data. 298.42s - 301.62s | So the impact of that one was four point five million users. 301.78s - 304.56s | PII leaked. The bounty was between 15 and 20 K. 304.56s - 307.26s | I'm going to give you ranges because 307.36s - 310.62s | some of the ranges can the actual numbers can disclose the programs. 311.28s - 313.58s | The severity


chunk_text:
the path before that. 265.96s - 267.70s | Right. We get a 404 there. 267.70s - 272.66s | So not that whole path is slash API slash internal is not all blocked. 272.82s - 274.60s | Just get all users. 274.60s - 276.56s | So then I tried some path traversal stuff. 276.56s - 279.80s | And eventually I started encoding various characters and found out 279.80s - 284.46s | that a double URL encoded S would pass through the reverse proxy 284.46s - 288.42s | and not be perceived as a match for the block on get all users route. 288.68s - 293.22s | And it would be parsed on the back end as an S. 293.28s - 297.12s | So it would match that get all users route and dump back a ton of data. 298.42s - 301.62s | So the impact of that one was four point five million users. 301.78s - 304.56s | PII leaked. The bounty was between 15 and 20 K. 304.56s - 307.26s | I'm going to give you ranges because 307.36s - 310.62s | some of the ranges can the actual numbers can disclose the programs. 311.28s - 313.58s | The severity was critical, critical, critical, 313.64s - 315.64s | which is what we say from the critical thinking podcast. 315.64s - 317.14s | Shout out to Whitey Cracker. 317.14s - 320.38s | And and this program was very private, as mentioned before. 320.70s - 324.80s | The takeaways for this one were obviously that changed the threat model. 324.80s - 328.38s | Like we mentioned, identify odd and out of place for three pages. 328.38s - 333.18s | Those can always tell can imply to you when a route is getting 333.44s - 336.94s | essentially blocked off by a reverse proxy and might be bypassable 336.94s - 339.48s | via some of these normalization tricks. 339.48s - 343.08s | And yeah, there was an amazing talk by one of the guys at Portswager 343.20s - 345.70s | earlier today on some of the amazing 345.70s - 348.74s | path reversal and path normalization stuff you can do. 349.30s - 351.40s | So I bet that would also be really helpful here. 352.70s - 355.14s | So the last takeaway is know your bypass tricks, 355.14s - 357.94s | URL encoding, double URL encoding, path reversal, et cetera. 358.10s - 359.30s


chunk_text:
was critical, critical, critical, 313.64s - 315.64s | which is what we say from the critical thinking podcast. 315.64s - 317.14s | Shout out to Whitey Cracker. 317.14s - 320.38s | And and this program was very private, as mentioned before. 320.70s - 324.80s | The takeaways for this one were obviously that changed the threat model. 324.80s - 328.38s | Like we mentioned, identify odd and out of place for three pages. 328.38s - 333.18s | Those can always tell can imply to you when a route is getting 333.44s - 336.94s | essentially blocked off by a reverse proxy and might be bypassable 336.94s - 339.48s | via some of these normalization tricks. 339.48s - 343.08s | And yeah, there was an amazing talk by one of the guys at Portswager 343.20s - 345.70s | earlier today on some of the amazing 345.70s - 348.74s | path reversal and path normalization stuff you can do. 349.30s - 351.40s | So I bet that would also be really helpful here. 352.70s - 355.14s | So the last takeaway is know your bypass tricks, 355.14s - 357.94s | URL encoding, double URL encoding, path reversal, et cetera. 358.10s - 359.30s | All right. Let's move to the next one. 359.30s - 360.44s | This one's really easy. 360.44s - 364.10s | It's an arbitrary account takeover via docs, essentially. 364.10s - 365.00s | So I open the docs. 365.00s - 368.98s | I look at these endpoints and I notice that there is an API 368.98s - 372.34s | endpoint for a slash slash slash token. 372.34s - 375.70s | And the there's an authorization header required for that. 376.40s - 378.24s | And the body is really simple. 378.24s - 380.54s | It's just grant type equals password. 380.94s - 384.40s | And then username equals user equals username. 384.40s - 385.34s | Password equals password. 385.34s - 387.50s | That's exactly what you would expect. 387.50s - 389.00s | And it dumps back the access token. 389.00s - 390.00s | Very, very reasonable. 391.14s - 392.18s | But wait a second. 392.18s - 393.10s | A password. 393.10s - 396.44s | This application is a OTP login application. 397.10s - 397.98s | There's no password. 397.98s - 398.94s | You just put in your email. 398.94s - 400.04s | They send you a link to your email. 400.04s


chunk_text:
| All right. Let's move to the next one. 359.30s - 360.44s | This one's really easy. 360.44s - 364.10s | It's an arbitrary account takeover via docs, essentially. 364.10s - 365.00s | So I open the docs. 365.00s - 368.98s | I look at these endpoints and I notice that there is an API 368.98s - 372.34s | endpoint for a slash slash slash token. 372.34s - 375.70s | And the there's an authorization header required for that. 376.40s - 378.24s | And the body is really simple. 378.24s - 380.54s | It's just grant type equals password. 380.94s - 384.40s | And then username equals user equals username. 384.40s - 385.34s | Password equals password. 385.34s - 387.50s | That's exactly what you would expect. 387.50s - 389.00s | And it dumps back the access token. 389.00s - 390.00s | Very, very reasonable. 391.14s - 392.18s | But wait a second. 392.18s - 393.10s | A password. 393.10s - 396.44s | This application is a OTP login application. 397.10s - 397.98s | There's no password. 397.98s - 398.94s | You just put in your email. 398.94s - 400.04s | They send you a link to your email. 400.04s - 401.80s | You click on it and you're logged in. 401.80s - 403.00s | So how does that work? 403.00s - 404.44s | So I started building it out. 404.44s - 407.14s | And when I sent the request, I got a 401 unauthorized. 407.14s - 411.40s | Of course, we need to authorize with the 412.54s - 415.44s | credentials mentioned in the doc for the authorization header. 416.54s - 420.20s | So I went and I needed that. 420.20s - 421.60s | So I was like, what do I do? 421.60s - 423.64s | Of course, to the JS files. 424.14s - 425.90s | So I search in the JS files. 425.90s - 430.86s | I'm looking for the UI, the part of the UI that uses this request. 431.10s - 436.52s | And I find sitting in the JS files these authorization credentials. 436.76s - 438.96s | And they're obviously Base64 encoded. 438.96s - 440.36s | And the values were kind of odd. 440.36s - 444.56s | I can't show them to you, but they weren't they weren't random. 444.60s - 446.12s | They were just a string. 446.12s - 448.76s | So it was a


chunk_text:
- 401.80s | You click on it and you're logged in. 401.80s - 403.00s | So how does that work? 403.00s - 404.44s | So I started building it out. 404.44s - 407.14s | And when I sent the request, I got a 401 unauthorized. 407.14s - 411.40s | Of course, we need to authorize with the 412.54s - 415.44s | credentials mentioned in the doc for the authorization header. 416.54s - 420.20s | So I went and I needed that. 420.20s - 421.60s | So I was like, what do I do? 421.60s - 423.64s | Of course, to the JS files. 424.14s - 425.90s | So I search in the JS files. 425.90s - 430.86s | I'm looking for the UI, the part of the UI that uses this request. 431.10s - 436.52s | And I find sitting in the JS files these authorization credentials. 436.76s - 438.96s | And they're obviously Base64 encoded. 438.96s - 440.36s | And the values were kind of odd. 440.36s - 444.56s | I can't show them to you, but they weren't they weren't random. 444.60s - 446.12s | They were just a string. 446.12s - 448.76s | So it was a little bit of an odd setup. 448.76s - 452.26s | And so then using those authorization basic credentials, 452.46s - 455.60s | we could literally just submit any password for any user. 455.86s - 459.90s | And it would accept it and dump back the authorization token, 460.06s - 462.36s | giving us access to arbitrary account takeover on this target. 462.66s - 464.26s | This is a public program. 464.26s - 466.86s | This is a very high paying public program. 466.86s - 468.00s | And this sort of stuff is out there. 469.56s - 472.20s | So this was a thank you. Thank you. 472.20s - 475.72s | This was an arbitrary ATO on double digit million accounts, 475.96s - 478.90s | 40 to 60 K bounty, of course, critical. 478.90s - 481.20s | And like I mentioned, public public program. 481.46s - 485.70s | So takeaways for this will be read the docs, think about the docs 486.02s - 490.52s | and then check the JS because there's a lot of good stuff in there. 491.62s - 493.32s | All right. Next, bug number three. 493.32s - 495.46s | This one's very similar to the last one.


chunk_text:
little bit of an odd setup. 448.76s - 452.26s | And so then using those authorization basic credentials, 452.46s - 455.60s | we could literally just submit any password for any user. 455.86s - 459.90s | And it would accept it and dump back the authorization token, 460.06s - 462.36s | giving us access to arbitrary account takeover on this target. 462.66s - 464.26s | This is a public program. 464.26s - 466.86s | This is a very high paying public program. 466.86s - 468.00s | And this sort of stuff is out there. 469.56s - 472.20s | So this was a thank you. Thank you. 472.20s - 475.72s | This was an arbitrary ATO on double digit million accounts, 475.96s - 478.90s | 40 to 60 K bounty, of course, critical. 478.90s - 481.20s | And like I mentioned, public public program. 481.46s - 485.70s | So takeaways for this will be read the docs, think about the docs 486.02s - 490.52s | and then check the JS because there's a lot of good stuff in there. 491.62s - 493.32s | All right. Next, bug number three. 493.32s - 495.46s | This one's very similar to the last one. 495.46s - 499.22s | Essentially, you take the auth bearer and you log into that API, 499.22s - 501.30s | that godforsaken API. 501.30s - 505.36s | And there's simply a numeric IDOR in that API 505.60s - 510.16s | that literally leaks password hashes and password reset tokens. 511.40s - 513.80s | And I see someone in the audience that is laughing 514.00s - 516.12s | because I think they know the target that I'm talking about. 517.12s - 518.50s | So that's interesting. 518.50s - 520.60s | But yeah, the password reset token is there. 520.70s - 523.22s | You can just password reset the account, hit the IDOR, 523.36s - 526.16s | and then you'll be able to log into the person's account. 526.50s - 528.76s | This was also 40 to 60 K. 528.76s - 531.62s | And the takeaway from this one that's different from the other one 531.62s - 533.92s | is just get really deep into these apps. 534.96s - 537.72s | It probably took 40 hours of configuring stuff 537.72s - 540.20s | and getting to know the various parts of the application 540.20s - 543.86s | before I got to this


chunk_text:
495.46s - 499.22s | Essentially, you take the auth bearer and you log into that API, 499.22s - 501.30s | that godforsaken API. 501.30s - 505.36s | And there's simply a numeric IDOR in that API 505.60s - 510.16s | that literally leaks password hashes and password reset tokens. 511.40s - 513.80s | And I see someone in the audience that is laughing 514.00s - 516.12s | because I think they know the target that I'm talking about. 517.12s - 518.50s | So that's interesting. 518.50s - 520.60s | But yeah, the password reset token is there. 520.70s - 523.22s | You can just password reset the account, hit the IDOR, 523.36s - 526.16s | and then you'll be able to log into the person's account. 526.50s - 528.76s | This was also 40 to 60 K. 528.76s - 531.62s | And the takeaway from this one that's different from the other one 531.62s - 533.92s | is just get really deep into these apps. 534.96s - 537.72s | It probably took 40 hours of configuring stuff 537.72s - 540.20s | and getting to know the various parts of the application 540.20s - 543.86s | before I got to this point where I was needing to authenticate into this asset. 544.76s - 547.16s | So that's the behind the scenes. 547.20s - 550.16s | I don't want to make sure I want to make sure that it's not perceived 550.16s - 553.26s | as looking too easy because there is some work that goes into it. 554.36s - 557.86s | OK, bug number four, we're moving into the medium difficulty section now. 558.30s - 562.60s | This was a blind XSS via SMS to arbitrary account takeover. 563.06s - 568.16s | So this was on an app that was a place where you could buy a car. 568.48s - 573.82s | And there was a sister app that would allow the dealers to deal with the 574.02s - 576.68s | it's kind of like a CRM for the dealers, right? 576.68s - 578.72s | So you go ahead and find a car. 578.72s - 581.18s | I was interested in this DeLorean for 42 million. 582.12s - 584.32s | And so I went ahead and filled it out. 584.62s - 588.52s | And somebody named Christina from my local car place reached out to me and said, 588.52s - 591.28s


chunk_text:
point where I was needing to authenticate into this asset. 544.76s - 547.16s | So that's the behind the scenes. 547.20s - 550.16s | I don't want to make sure I want to make sure that it's not perceived 550.16s - 553.26s | as looking too easy because there is some work that goes into it. 554.36s - 557.86s | OK, bug number four, we're moving into the medium difficulty section now. 558.30s - 562.60s | This was a blind XSS via SMS to arbitrary account takeover. 563.06s - 568.16s | So this was on an app that was a place where you could buy a car. 568.48s - 573.82s | And there was a sister app that would allow the dealers to deal with the 574.02s - 576.68s | it's kind of like a CRM for the dealers, right? 576.68s - 578.72s | So you go ahead and find a car. 578.72s - 581.18s | I was interested in this DeLorean for 42 million. 582.12s - 584.32s | And so I went ahead and filled it out. 584.62s - 588.52s | And somebody named Christina from my local car place reached out to me and said, 588.52s - 591.28s | Hey, Justin, I saw that you filled out the request for this. 592.28s - 594.02s | You know, when can we meet to see the car? 594.02s - 595.78s | I was like, OK, well, how did they do that? 595.78s - 599.28s | Because I had access to the dealer panel as a part of this scope 599.64s - 601.38s | and I didn't see where they did that. 601.38s - 604.60s | So I said, OK, let me go ahead and log into the dealer software 605.04s - 606.18s | and get that perspective. 606.18s - 607.04s | So this is what I see. 607.04s - 608.18s | You can select the 609.38s - 612.14s | the users that you want to view the details for on the left hand side. 612.44s - 614.48s | And there's like an info and a financing tab. 614.48s - 618.18s | And you can kind of inspect that that lead that had come through the website. 619.50s - 621.48s | And so I started reading the code on that page. 621.48s - 624.84s | And there's like some super long window object that's kind of difficult to read. 624.84s -


chunk_text:
| Hey, Justin, I saw that you filled out the request for this. 592.28s - 594.02s | You know, when can we meet to see the car? 594.02s - 595.78s | I was like, OK, well, how did they do that? 595.78s - 599.28s | Because I had access to the dealer panel as a part of this scope 599.64s - 601.38s | and I didn't see where they did that. 601.38s - 604.60s | So I said, OK, let me go ahead and log into the dealer software 605.04s - 606.18s | and get that perspective. 606.18s - 607.04s | So this is what I see. 607.04s - 608.18s | You can select the 609.38s - 612.14s | the users that you want to view the details for on the left hand side. 612.44s - 614.48s | And there's like an info and a financing tab. 614.48s - 618.18s | And you can kind of inspect that that lead that had come through the website. 619.50s - 621.48s | And so I started reading the code on that page. 621.48s - 624.84s | And there's like some super long window object that's kind of difficult to read. 624.84s - 627.40s | But if you scroll through it and do your due diligence, 627.70s - 630.24s | there's a section called feature flags, 630.24s - 633.70s | which is something that I just talked about at my talk earlier in Bug Bounty Village. 634.44s - 636.54s | And there was a messages feature flag. 636.90s - 639.24s | So we turned that from false to true. 640.04s - 642.84s | And you can see, yeah, from false to true 643.10s - 645.70s | with this easy Kido match and replace rule. 646.74s - 649.80s | And voila, the messages tab appears in the application 650.00s - 652.40s | and we have the ability to use it. 652.40s - 655.22s | So as we as we go into that application, 655.22s - 657.42s | we can send messages to the various leads. 657.42s - 660.02s | It'll go to the phone number that they submitted 660.02s - 662.66s | and then you can interact with them. Great. 663.66s - 665.52s | So I sent myself a message. 665.52s - 668.22s | I submitted a lead, sent myself a message and I thought, OK, wow, 668.22s - 671.96s | wouldn't it be


chunk_text:
627.40s | But if you scroll through it and do your due diligence, 627.70s - 630.24s | there's a section called feature flags, 630.24s - 633.70s | which is something that I just talked about at my talk earlier in Bug Bounty Village. 634.44s - 636.54s | And there was a messages feature flag. 636.90s - 639.24s | So we turned that from false to true. 640.04s - 642.84s | And you can see, yeah, from false to true 643.10s - 645.70s | with this easy Kido match and replace rule. 646.74s - 649.80s | And voila, the messages tab appears in the application 650.00s - 652.40s | and we have the ability to use it. 652.40s - 655.22s | So as we as we go into that application, 655.22s - 657.42s | we can send messages to the various leads. 657.42s - 660.02s | It'll go to the phone number that they submitted 660.02s - 662.66s | and then you can interact with them. Great. 663.66s - 665.52s | So I sent myself a message. 665.52s - 668.22s | I submitted a lead, sent myself a message and I thought, OK, wow, 668.22s - 671.96s | wouldn't it be cool if I could SMS myself a an XSS payload? 672.36s - 676.30s | So I went ahead and first typoed my XSS payload to something that would never work. 677.06s - 679.86s | Proceeded to reaction down it instinctually 680.36s - 683.56s | and then submitted the actual XSS payload. 683.98s - 688.32s | When the dealer came back to the screen, they would see that the XSS would pop. 688.52s - 692.72s | And we were able to get a blind XSS of sorts in this environment. 694.72s - 698.42s | So we've got blind XSS, but what can we do with it to get more impact? 699.12s - 702.36s | Well, the authorization flow for this application happened 702.36s - 705.32s | in an invisible eye frame right near this interface. 705.78s - 709.66s | And what it would do is it would go through the OAuth flow on a different domain 709.88s - 711.78s | and then it would call back with just a token. 713.28s - 717.72s | And so what I did using the XSS is I cookie bombed that callback location 718.06s - 720.72s | and then so that the code wouldn't get


chunk_text:
cool if I could SMS myself a an XSS payload? 672.36s - 676.30s | So I went ahead and first typoed my XSS payload to something that would never work. 677.06s - 679.86s | Proceeded to reaction down it instinctually 680.36s - 683.56s | and then submitted the actual XSS payload. 683.98s - 688.32s | When the dealer came back to the screen, they would see that the XSS would pop. 688.52s - 692.72s | And we were able to get a blind XSS of sorts in this environment. 694.72s - 698.42s | So we've got blind XSS, but what can we do with it to get more impact? 699.12s - 702.36s | Well, the authorization flow for this application happened 702.36s - 705.32s | in an invisible eye frame right near this interface. 705.78s - 709.66s | And what it would do is it would go through the OAuth flow on a different domain 709.88s - 711.78s | and then it would call back with just a token. 713.28s - 717.72s | And so what I did using the XSS is I cookie bombed that callback location 718.06s - 720.72s | and then so that the code wouldn't get consumed. 720.96s - 724.86s | And then I stole the code out of the eye frame and exfiltrated 724.86s - 726.22s | that to the attacker server. 726.22s - 730.22s | So whenever the dealer comes, their session token would be exfiltrated. 730.38s - 732.72s | The attack, the victim. 732.72s - 737.06s | The victim's token would be exfiltrated and the attacker can simply click the link 737.06s - 739.76s | and they're logged into the victim's dealer account. 740.56s - 742.82s | And you don't have to bypass MFA or anything like that 742.82s - 745.08s | because the session token is there. 745.76s - 748.62s | Great. So now we've got we can log in as the dealer. 748.62s - 751.32s | We've got ATO. How can we get even more impact? 751.36s - 756.26s | Well, that same request had three vulnerabilities in it. 756.28s - 760.66s | OK, the send SMS message API endpoint had a dealer ID 760.66s - 764.06s | that was vulnerable to IDOR, a client ID that was vulnerable to IDOR. 764.28s - 766.78s | And the message was vulnerable to XSS. 767.10s - 770.94s | So essentially what this means


chunk_text:
consumed. 720.96s - 724.86s | And then I stole the code out of the eye frame and exfiltrated 724.86s - 726.22s | that to the attacker server. 726.22s - 730.22s | So whenever the dealer comes, their session token would be exfiltrated. 730.38s - 732.72s | The attack, the victim. 732.72s - 737.06s | The victim's token would be exfiltrated and the attacker can simply click the link 737.06s - 739.76s | and they're logged into the victim's dealer account. 740.56s - 742.82s | And you don't have to bypass MFA or anything like that 742.82s - 745.08s | because the session token is there. 745.76s - 748.62s | Great. So now we've got we can log in as the dealer. 748.62s - 751.32s | We've got ATO. How can we get even more impact? 751.36s - 756.26s | Well, that same request had three vulnerabilities in it. 756.28s - 760.66s | OK, the send SMS message API endpoint had a dealer ID 760.66s - 764.06s | that was vulnerable to IDOR, a client ID that was vulnerable to IDOR. 764.28s - 766.78s | And the message was vulnerable to XSS. 767.10s - 770.94s | So essentially what this means is that we can worm this XSS 770.94s - 772.34s | across all of the dealers. 772.34s - 777.00s | We can send a message to every client from every dealer with an XSS payload 777.14s - 779.30s | and then proceed to hijack their accounts. 779.30s - 782.64s | And when we get access to their accounts, then we get access to all of the PII 782.84s - 785.74s | of all of the customers that have ever used this application. 786.70s - 789.34s | So that was bad. 792.88s - 796.22s | And that was an arbitrary ATO and 797.08s - 801.54s | of double digit million users, PII leak, 20 to 40K. 801.82s - 803.44s | This was on a private program. 803.44s - 806.22s | However, this program will be going public soon, I'm aware. 806.78s - 811.34s | And the takeaway for this is look at all the look at the application 811.34s - 812.52s | from all perspectives, right? 812.52s - 813.24s | We wouldn't have seen this 813.24s - 815.18s | if we just looked at it from the dealer perspective 815.18s - 817.38s | or just looked at it from the client


chunk_text:
is that we can worm this XSS 770.94s - 772.34s | across all of the dealers. 772.34s - 777.00s | We can send a message to every client from every dealer with an XSS payload 777.14s - 779.30s | and then proceed to hijack their accounts. 779.30s - 782.64s | And when we get access to their accounts, then we get access to all of the PII 782.84s - 785.74s | of all of the customers that have ever used this application. 786.70s - 789.34s | So that was bad. 792.88s - 796.22s | And that was an arbitrary ATO and 797.08s - 801.54s | of double digit million users, PII leak, 20 to 40K. 801.82s - 803.44s | This was on a private program. 803.44s - 806.22s | However, this program will be going public soon, I'm aware. 806.78s - 811.34s | And the takeaway for this is look at all the look at the application 811.34s - 812.52s | from all perspectives, right? 812.52s - 813.24s | We wouldn't have seen this 813.24s - 815.18s | if we just looked at it from the dealer perspective 815.18s - 817.38s | or just looked at it from the client perspective. 817.38s - 820.08s | Make sure you're turning on all the feature flags with match and replace 820.32s - 823.14s | that can enable features that are essential 823.90s - 827.04s | and look for alternative data input paths like SMS. 827.86s - 831.04s | And then lastly, of course, chain, chain, chain to get maximum impact. 832.70s - 836.44s | OK, bug number five, Snoop on other people's meetings. 836.66s - 837.86s | This was a really interesting one. 837.86s - 841.46s | It's going to be a little brief, but there was a target that I came across 841.76s - 844.30s | in a video chat and team collaboration app. 844.64s - 847.64s | And for this specific 847.64s - 851.06s | period, I decided to focus on a specific goal, 851.08s - 853.82s | which was I wanted to be able to do creepy shit 855.06s - 856.96s | in people's meetings, right? 856.96s - 859.68s | So I started investigating how exactly that worked. 859.68s - 863.78s | I read the developer's docs, the JavaScript code, the GitHub issues, everything. 864.26s - 868.38s | And when I was investigating the GitHub issues, 868.72s - 869.96s


chunk_text:
perspective. 817.38s - 820.08s | Make sure you're turning on all the feature flags with match and replace 820.32s - 823.14s | that can enable features that are essential 823.90s - 827.04s | and look for alternative data input paths like SMS. 827.86s - 831.04s | And then lastly, of course, chain, chain, chain to get maximum impact. 832.70s - 836.44s | OK, bug number five, Snoop on other people's meetings. 836.66s - 837.86s | This was a really interesting one. 837.86s - 841.46s | It's going to be a little brief, but there was a target that I came across 841.76s - 844.30s | in a video chat and team collaboration app. 844.64s - 847.64s | And for this specific 847.64s - 851.06s | period, I decided to focus on a specific goal, 851.08s - 853.82s | which was I wanted to be able to do creepy shit 855.06s - 856.96s | in people's meetings, right? 856.96s - 859.68s | So I started investigating how exactly that worked. 859.68s - 863.78s | I read the developer's docs, the JavaScript code, the GitHub issues, everything. 864.26s - 868.38s | And when I was investigating the GitHub issues, 868.72s - 869.96s | this GitHub issue popped up. 869.96s - 874.32s | It says the participant list is wrong when XYZ audio device is used. 874.62s - 876.18s | And I was like, huh, that's weird. 876.18s - 878.48s | So the participant list didn't get updated 878.70s - 881.04s | when the user has a broken audio device. 881.58s - 882.58s | Why would that be happening? 882.58s - 884.94s | So I thought maybe I can make that happen. 884.94s - 888.74s | And that would be I'd be able to enter meetings without people 888.74s - 889.48s | knowing I was there. 890.64s - 894.34s | So how does that how does this joining meeting work? 894.94s - 897.54s | The user connects first over WebRTC. 897.84s - 902.30s | Then they get all of the information like the call, comms channels, et cetera. 902.90s - 906.08s | And then the JS code identifies an audio device 906.58s - 909.84s | that the user can use or it creates a fake audio device. 910.08s - 914.90s | And then the client side JS sends the audio connect signal to join. 916.54s - 917.30s | Wait, what? 917.30s - 920.40s


chunk_text:
| this GitHub issue popped up. 869.96s - 874.32s | It says the participant list is wrong when XYZ audio device is used. 874.62s - 876.18s | And I was like, huh, that's weird. 876.18s - 878.48s | So the participant list didn't get updated 878.70s - 881.04s | when the user has a broken audio device. 881.58s - 882.58s | Why would that be happening? 882.58s - 884.94s | So I thought maybe I can make that happen. 884.94s - 888.74s | And that would be I'd be able to enter meetings without people 888.74s - 889.48s | knowing I was there. 890.64s - 894.34s | So how does that how does this joining meeting work? 894.94s - 897.54s | The user connects first over WebRTC. 897.84s - 902.30s | Then they get all of the information like the call, comms channels, et cetera. 902.90s - 906.08s | And then the JS code identifies an audio device 906.58s - 909.84s | that the user can use or it creates a fake audio device. 910.08s - 914.90s | And then the client side JS sends the audio connect signal to join. 916.54s - 917.30s | Wait, what? 917.30s - 920.40s | It sends an audio connect signal to join that little 921.18s - 922.74s | that you hear when you join a meeting. 922.74s - 926.00s | Was the thing actually triggering the participant list update, 926.40s - 928.50s | which I really could not believe. 928.50s - 930.70s | And so since this was happening on the client side, 931.08s - 933.88s | we could just not send the signal. 934.48s - 936.94s | And that's exactly what we did with this match and replace rule. 938.18s - 942.38s | We just simply said has did a true false switch 942.58s - 944.68s | on whether the audio signal had already been sent or not. 944.84s - 947.08s | And it didn't send the signal. 947.08s - 949.74s | And we became Snoop Dogg in that environment. 949.78s - 951.20s | OK, so let's see how it worked. 951.20s - 953.14s | Here's my Snoop Dogg POC right here. 953.14s - 953.94s | That's what I named it. 953.94s - 954.84s | The triagers loved it. 955.80s - 960.04s | And essentially what you would do is paste in the meeting information 960.40s - 962.24s | and then you


chunk_text:
| It sends an audio connect signal to join that little 921.18s - 922.74s | that you hear when you join a meeting. 922.74s - 926.00s | Was the thing actually triggering the participant list update, 926.40s - 928.50s | which I really could not believe. 928.50s - 930.70s | And so since this was happening on the client side, 931.08s - 933.88s | we could just not send the signal. 934.48s - 936.94s | And that's exactly what we did with this match and replace rule. 938.18s - 942.38s | We just simply said has did a true false switch 942.58s - 944.68s | on whether the audio signal had already been sent or not. 944.84s - 947.08s | And it didn't send the signal. 947.08s - 949.74s | And we became Snoop Dogg in that environment. 949.78s - 951.20s | OK, so let's see how it worked. 951.20s - 953.14s | Here's my Snoop Dogg POC right here. 953.14s - 953.94s | That's what I named it. 953.94s - 954.84s | The triagers loved it. 955.80s - 960.04s | And essentially what you would do is paste in the meeting information 960.40s - 962.24s | and then you would click Snoop. 962.26s - 967.04s | And it would actually exfiltrate the user's transcripts. 967.24s - 970.86s | And you would not see anything in the in the meeting participant list. 972.86s - 976.66s | So that one was a 20 to 25 K bounty. 976.66s - 979.14s | It was technically high, but it was paid as a critical 979.76s - 982.04s | given the the various bonuses that were occurring. 982.30s - 984.20s | This is on a public program as well. 984.20s - 987.90s | So takeaways from this one, reading the GitHub issues can have massive dividends, 987.90s - 990.96s | especially anything related to security or privacy. 992.34s - 995.44s | Set goals for your target, like being able to snoop on meetings 995.74s - 1000.14s | and then verify in the code base how this works, especially on the client side. 1001.54s - 1003.80s | OK, we are 15 minutes in. 1003.80s - 1005.14s | Dude, we are doing good. 1005.14s - 1007.84s | I mean, I may not keep you here long. 1007.84s - 1009.80s | We'll see, though, because now things are getting a little bit trickier. 1009.80s - 1011.90s |


chunk_text:
would click Snoop. 962.26s - 967.04s | And it would actually exfiltrate the user's transcripts. 967.24s - 970.86s | And you would not see anything in the in the meeting participant list. 972.86s - 976.66s | So that one was a 20 to 25 K bounty. 976.66s - 979.14s | It was technically high, but it was paid as a critical 979.76s - 982.04s | given the the various bonuses that were occurring. 982.30s - 984.20s | This is on a public program as well. 984.20s - 987.90s | So takeaways from this one, reading the GitHub issues can have massive dividends, 987.90s - 990.96s | especially anything related to security or privacy. 992.34s - 995.44s | Set goals for your target, like being able to snoop on meetings 995.74s - 1000.14s | and then verify in the code base how this works, especially on the client side. 1001.54s - 1003.80s | OK, we are 15 minutes in. 1003.80s - 1005.14s | Dude, we are doing good. 1005.14s - 1007.84s | I mean, I may not keep you here long. 1007.84s - 1009.80s | We'll see, though, because now things are getting a little bit trickier. 1009.80s - 1011.90s | OK, so this one's going to be a long one. 1012.64s - 1018.24s | This one was a Perforce server to client RCE. 1018.50s - 1020.54s | And I'll explain what that is in just a second. 1020.54s - 1024.90s | The target for this was a desktop application used for game development. 1024.90s - 1028.36s | OK, the problem is I suck at hacking desktop applications. 1028.36s - 1032.20s | Note that I did not add that in the list of things that I often hack in the intro slide. 1033.10s - 1035.84s | So I was thinking, all right, how can I attack this? 1036.10s - 1038.84s | This is kind of a little bit outside of my comfort zone. 1039.40s - 1041.16s | I can't really do privilege escalation stuff 1041.16s - 1043.26s | because this doesn't really run in a privileged environment. 1043.54s - 1046.04s | So I was thinking, OK, but local attacks are kind of dumb anyway. 1046.60s - 1048.60s | Let me try to focus on remote attacks. 1048.60s - 1050.34s | And these are some of the ideas that I came up with. 1050.34s - 1051.66s | I just want to walk


chunk_text:
OK, so this one's going to be a long one. 1012.64s - 1018.24s | This one was a Perforce server to client RCE. 1018.50s - 1020.54s | And I'll explain what that is in just a second. 1020.54s - 1024.90s | The target for this was a desktop application used for game development. 1024.90s - 1028.36s | OK, the problem is I suck at hacking desktop applications. 1028.36s - 1032.20s | Note that I did not add that in the list of things that I often hack in the intro slide. 1033.10s - 1035.84s | So I was thinking, all right, how can I attack this? 1036.10s - 1038.84s | This is kind of a little bit outside of my comfort zone. 1039.40s - 1041.16s | I can't really do privilege escalation stuff 1041.16s - 1043.26s | because this doesn't really run in a privileged environment. 1043.54s - 1046.04s | So I was thinking, OK, but local attacks are kind of dumb anyway. 1046.60s - 1048.60s | Let me try to focus on remote attacks. 1048.60s - 1050.34s | And these are some of the ideas that I came up with. 1050.34s - 1051.66s | I just want to walk you through the process. 1051.66s - 1054.10s | So all of this doesn't seem too easy. 1054.10s - 1056.96s | And you see how often we fail when attacking targets like this. 1057.94s - 1059.90s | So here are some of the attack factors I came up with. 1059.90s - 1063.80s | I was thinking we could open a malicious file in the development thing 1063.80s - 1065.54s | and something bad would happen. 1065.54s - 1068.30s | We could connect to a malicious server with the development environment 1069.00s - 1070.46s | and then something bad would happen. 1070.46s - 1074.10s | We could attack the software development lifecycle 1074.10s - 1076.80s | a la Lupin, a la Ronnie Carta right here, 1077.42s - 1081.26s | and try to inject something into the build of this application itself. 1082.46s - 1087.80s | We could take advantage of some sort of misconfiguration 1088.56s - 1090.10s | in the actual code itself, 1090.10s - 1092.12s | like maybe it's reaching out to an unclaimed domain 1092.12s - 1094.72s | or an unclaimed S3 bucket and inject sort of there. 1095.12s - 1098.20s | Or we could kind of take these reusable


chunk_text:
you through the process. 1051.66s - 1054.10s | So all of this doesn't seem too easy. 1054.10s - 1056.96s | And you see how often we fail when attacking targets like this. 1057.94s - 1059.90s | So here are some of the attack factors I came up with. 1059.90s - 1063.80s | I was thinking we could open a malicious file in the development thing 1063.80s - 1065.54s | and something bad would happen. 1065.54s - 1068.30s | We could connect to a malicious server with the development environment 1069.00s - 1070.46s | and then something bad would happen. 1070.46s - 1074.10s | We could attack the software development lifecycle 1074.10s - 1076.80s | a la Lupin, a la Ronnie Carta right here, 1077.42s - 1081.26s | and try to inject something into the build of this application itself. 1082.46s - 1087.80s | We could take advantage of some sort of misconfiguration 1088.56s - 1090.10s | in the actual code itself, 1090.10s - 1092.12s | like maybe it's reaching out to an unclaimed domain 1092.12s - 1094.72s | or an unclaimed S3 bucket and inject sort of there. 1095.12s - 1098.20s | Or we could kind of take these reusable game component pieces 1098.20s - 1101.16s | that were being processed and try to do something with those. 1101.56s - 1105.40s | So I started going down these paths and I checked out, 1105.46s - 1107.20s | open a malicious file. 1107.20s - 1112.12s | So I broke apart some of the file extensions 1112.12s - 1114.36s | associated with this and looked at the structure. 1114.36s - 1116.90s | I was replacing paths with like UNC paths 1116.90s - 1119.12s | to see if I could force it to reach out to a remote server. 1120.60s - 1123.60s | I found that you could include settings for a project in a file. 1123.60s - 1124.52s | That was kind of interesting, 1124.52s - 1127.36s | but couldn't really do anything malicious with it at the time. 1128.26s - 1130.46s | I noticed that there was lots of XML. 1130.46s - 1134.00s | So I started spraying around various XXE payloads in there 1134.00s - 1135.36s | and seeing if they would trigger. 1135.36s - 1136.22s | No luck. 1136.22s - 1138.98s | Symbolic links, I was kind of playing around with those. 1140.12s - 1142.92s | And nothing's really


chunk_text:
game component pieces 1098.20s - 1101.16s | that were being processed and try to do something with those. 1101.56s - 1105.40s | So I started going down these paths and I checked out, 1105.46s - 1107.20s | open a malicious file. 1107.20s - 1112.12s | So I broke apart some of the file extensions 1112.12s - 1114.36s | associated with this and looked at the structure. 1114.36s - 1116.90s | I was replacing paths with like UNC paths 1116.90s - 1119.12s | to see if I could force it to reach out to a remote server. 1120.60s - 1123.60s | I found that you could include settings for a project in a file. 1123.60s - 1124.52s | That was kind of interesting, 1124.52s - 1127.36s | but couldn't really do anything malicious with it at the time. 1128.26s - 1130.46s | I noticed that there was lots of XML. 1130.46s - 1134.00s | So I started spraying around various XXE payloads in there 1134.00s - 1135.36s | and seeing if they would trigger. 1135.36s - 1136.22s | No luck. 1136.22s - 1138.98s | Symbolic links, I was kind of playing around with those. 1140.12s - 1142.92s | And nothing's really working, kind of meh, 1142.92s - 1146.02s | feeling kind of insufficient at this point to look at this target. 1146.02s - 1148.56s | So I move along to the next attack factor. 1149.66s - 1151.52s | So that was connect to a malicious server. 1151.52s - 1153.52s | So what do I mean by that? 1153.52s - 1158.62s | This software had the ability to connect to remote version control servers 1158.62s - 1160.22s | so that you could store your code 1160.22s - 1163.72s | that you were developing in a remote version control. 1164.38s - 1166.34s | And there were multiple types, 1166.34s - 1168.78s | and Perforce was one of those types. 1168.78s - 1172.58s | And that was something that I hadn't really heard of before. 1172.58s - 1177.18s | And I know from a lot of the work of like Alex Chapman 1177.18s - 1181.58s | and some of the other great Git version control hackers out there, 1181.58s - 1183.82s | that version control can be hella sketchy. 1185.02s - 1187.38s | And so I kind of went down this route. 1188.94s - 1192.34s | So I started looking up the Perforce protocol


chunk_text:
working, kind of meh, 1142.92s - 1146.02s | feeling kind of insufficient at this point to look at this target. 1146.02s - 1148.56s | So I move along to the next attack factor. 1149.66s - 1151.52s | So that was connect to a malicious server. 1151.52s - 1153.52s | So what do I mean by that? 1153.52s - 1158.62s | This software had the ability to connect to remote version control servers 1158.62s - 1160.22s | so that you could store your code 1160.22s - 1163.72s | that you were developing in a remote version control. 1164.38s - 1166.34s | And there were multiple types, 1166.34s - 1168.78s | and Perforce was one of those types. 1168.78s - 1172.58s | And that was something that I hadn't really heard of before. 1172.58s - 1177.18s | And I know from a lot of the work of like Alex Chapman 1177.18s - 1181.58s | and some of the other great Git version control hackers out there, 1181.58s - 1183.82s | that version control can be hella sketchy. 1185.02s - 1187.38s | And so I kind of went down this route. 1188.94s - 1192.34s | So I started looking up the Perforce protocol spec, 1192.36s - 1196.04s | and I found this awesome article that told me about that. 1196.04s - 1198.26s | Funny side note that I don't have in the slides, 1198.26s - 1199.76s | the guy I just mentioned, Alex Chapman, 1199.76s - 1203.44s | he was also working on this target at the same time. 1203.44s - 1206.40s | And he actually had a public blog 1206.40s - 1209.94s | on how to exploit this specific protocol 1209.94s - 1213.10s | that I didn't find a little bit until a little bit later. 1213.10s - 1216.74s | And then I realized, oh shit, he's going to find that same bug. 1216.74s - 1220.10s | And we did have a bug collision, but it still worked out great. 1220.10s - 1221.86s | So anyway, I clicked on this article, 1222.68s - 1227.08s | and it was a really great article describing how this protocol works. 1227.08s - 1229.28s | It broke down the RPC structure. 1229.28s - 1230.36s | It's a binary protocol, 1230.36s - 1233.12s | which I was a little bit uncomfortable with as a web guy, 1233.12s - 1235.42s | but I decided to try to continue


chunk_text:
spec, 1192.36s - 1196.04s | and I found this awesome article that told me about that. 1196.04s - 1198.26s | Funny side note that I don't have in the slides, 1198.26s - 1199.76s | the guy I just mentioned, Alex Chapman, 1199.76s - 1203.44s | he was also working on this target at the same time. 1203.44s - 1206.40s | And he actually had a public blog 1206.40s - 1209.94s | on how to exploit this specific protocol 1209.94s - 1213.10s | that I didn't find a little bit until a little bit later. 1213.10s - 1216.74s | And then I realized, oh shit, he's going to find that same bug. 1216.74s - 1220.10s | And we did have a bug collision, but it still worked out great. 1220.10s - 1221.86s | So anyway, I clicked on this article, 1222.68s - 1227.08s | and it was a really great article describing how this protocol works. 1227.08s - 1229.28s | It broke down the RPC structure. 1229.28s - 1230.36s | It's a binary protocol, 1230.36s - 1233.12s | which I was a little bit uncomfortable with as a web guy, 1233.12s - 1235.42s | but I decided to try to continue working on it. 1235.42s - 1236.86s | And as I was reading through the article, 1236.86s - 1241.08s | I see this very convenient file synchronization flow 1241.08s - 1242.38s | on the right-hand side there. 1242.38s - 1243.58s | Now, if you read that for a second, 1243.58s - 1246.28s | you'll see something a little bit odd, right? 1246.28s - 1251.52s | The server says, client open file, client write file. 1251.54s - 1254.98s | And I was like, hmm, that seems odd 1254.98s - 1257.28s | that the server can just say write files, 1257.28s - 1258.88s | but it is a version control system. 1258.88s - 1260.68s | I wonder if there's any path traversals 1260.68s - 1263.44s | or something nasty that I can do with that. 1263.44s - 1268.78s | So on a hunch, I started developing this malicious Perforce server. 1268.78s - 1270.18s | And this was, I'm not going to lie to you guys, 1270.18s - 1273.78s | this was really intimidating to me because I'm a web guy, like I said, 1273.78s - 1275.72s | and I don't really deal a lot with binary protocols. 1275.72s - 1279.12s | But I


chunk_text:
working on it. 1235.42s - 1236.86s | And as I was reading through the article, 1236.86s - 1241.08s | I see this very convenient file synchronization flow 1241.08s - 1242.38s | on the right-hand side there. 1242.38s - 1243.58s | Now, if you read that for a second, 1243.58s - 1246.28s | you'll see something a little bit odd, right? 1246.28s - 1251.52s | The server says, client open file, client write file. 1251.54s - 1254.98s | And I was like, hmm, that seems odd 1254.98s - 1257.28s | that the server can just say write files, 1257.28s - 1258.88s | but it is a version control system. 1258.88s - 1260.68s | I wonder if there's any path traversals 1260.68s - 1263.44s | or something nasty that I can do with that. 1263.44s - 1268.78s | So on a hunch, I started developing this malicious Perforce server. 1268.78s - 1270.18s | And this was, I'm not going to lie to you guys, 1270.18s - 1273.78s | this was really intimidating to me because I'm a web guy, like I said, 1273.78s - 1275.72s | and I don't really deal a lot with binary protocols. 1275.72s - 1279.12s | But I thought, now is probably the best chance I'll ever get 1279.14s - 1281.84s | because this article literally breaks everything out 1281.84s - 1283.42s | as clean as can possibly be. 1283.42s - 1285.38s | So I decided to go down that path. 1285.38s - 1288.02s | And in the end, the code was actually really simple. 1288.02s - 1292.28s | I just created a function that would pass in a JSON blob, 1292.28s - 1294.58s | and those names and values would then be encoded 1294.58s - 1297.22s | into the binary format that was described in the article, 1297.22s - 1300.52s | which was essentially the parameter name, a null byte, 1300.52s - 1305.48s | the value length, and then the actual value itself, 1305.48s - 1307.82s | and then a null byte, and then that would be sort of packed 1307.82s - 1313.94s | into a bigger sort of call that would pass through the socket, okay? 1313.94s - 1321.32s | So, man, working with struct.pack was really scary to me. 1321.32s - 1323.52s | Whenever I saw those exploits where it's like, 1323.52s - 1327.94s | all right, less than and B and I and H,


chunk_text:
thought, now is probably the best chance I'll ever get 1279.14s - 1281.84s | because this article literally breaks everything out 1281.84s - 1283.42s | as clean as can possibly be. 1283.42s - 1285.38s | So I decided to go down that path. 1285.38s - 1288.02s | And in the end, the code was actually really simple. 1288.02s - 1292.28s | I just created a function that would pass in a JSON blob, 1292.28s - 1294.58s | and those names and values would then be encoded 1294.58s - 1297.22s | into the binary format that was described in the article, 1297.22s - 1300.52s | which was essentially the parameter name, a null byte, 1300.52s - 1305.48s | the value length, and then the actual value itself, 1305.48s - 1307.82s | and then a null byte, and then that would be sort of packed 1307.82s - 1313.94s | into a bigger sort of call that would pass through the socket, okay? 1313.94s - 1321.32s | So, man, working with struct.pack was really scary to me. 1321.32s - 1323.52s | Whenever I saw those exploits where it's like, 1323.52s - 1327.94s | all right, less than and B and I and H, 1327.94s - 1330.34s | I was thinking like, wow, this is really complicated. 1330.34s - 1334.54s | But one, ChatGPT is really helpful for that nowadays. 1334.56s - 1339.34s | And two, you just kind of put your head down and keep working at it. 1339.34s - 1341.84s | I think it comes pretty quickly. 1341.84s - 1343.74s | So I was able to build the whole exploit. 1343.74s - 1347.64s | And essentially, this is a funny part that I wanted to highlight for you guys. 1347.64s - 1350.56s | When the client connects, of course, it's going to try to auth, right? 1350.56s - 1353.76s | And my server was just like, yes, yes, you've authed correctly. 1353.76s - 1357.84s | Let's go, and just ignored the whole auth part, which was really funny, 1357.84s - 1359.80s | and then just said, write a file. 1359.80s - 1362.16s | And essentially, what it would do is write a file 1362.16s - 1365.06s | to anywhere on the file system via path traversal. 1365.06s - 1368.32s | And so how do we convert that to RCE? 1368.32s - 1369.68s | Well, it was really easy. 1369.68s - 1372.92s |


chunk_text:
1327.94s - 1330.34s | I was thinking like, wow, this is really complicated. 1330.34s - 1334.54s | But one, ChatGPT is really helpful for that nowadays. 1334.56s - 1339.34s | And two, you just kind of put your head down and keep working at it. 1339.34s - 1341.84s | I think it comes pretty quickly. 1341.84s - 1343.74s | So I was able to build the whole exploit. 1343.74s - 1347.64s | And essentially, this is a funny part that I wanted to highlight for you guys. 1347.64s - 1350.56s | When the client connects, of course, it's going to try to auth, right? 1350.56s - 1353.76s | And my server was just like, yes, yes, you've authed correctly. 1353.76s - 1357.84s | Let's go, and just ignored the whole auth part, which was really funny, 1357.84s - 1359.80s | and then just said, write a file. 1359.80s - 1362.16s | And essentially, what it would do is write a file 1362.16s - 1365.06s | to anywhere on the file system via path traversal. 1365.06s - 1368.32s | And so how do we convert that to RCE? 1368.32s - 1369.68s | Well, it was really easy. 1369.68s - 1372.92s | There was an exe file that was getting run every two seconds. 1372.92s - 1378.92s | So you just take your malicious exe file, overwrite that file, 1378.92s - 1383.08s | and then it gets run two seconds later and you pop a shell. 1383.08s - 1387.36s | And yeah, how do we actually make this a plausible attack? 1387.36s - 1389.46s | Well, as I mentioned earlier, 1389.46s - 1393.88s | there was the ability to include malicious settings for the project. 1393.88s - 1398.68s | And one of those settings, which was not super present in the documentation, 1398.68s - 1403.82s | was the ability to provide a version control server to connect to. 1403.82s - 1406.78s | And when it opened the file, it would automatically connect to that server. 1406.78s - 1409.06s | So I could provide a victim with a file. 1409.06s - 1410.98s | They'd open it, connect to my server. 1410.98s - 1415.06s | My server would push a file down and shell the device. 1415.06s - 1417.92s | So that was an RCE via malicious file. 1417.94s - 1420.88s | And the bounty for that was $15,000 to $30,000. 1420.88s - 1422.88s


chunk_text:
There was an exe file that was getting run every two seconds. 1372.92s - 1378.92s | So you just take your malicious exe file, overwrite that file, 1378.92s - 1383.08s | and then it gets run two seconds later and you pop a shell. 1383.08s - 1387.36s | And yeah, how do we actually make this a plausible attack? 1387.36s - 1389.46s | Well, as I mentioned earlier, 1389.46s - 1393.88s | there was the ability to include malicious settings for the project. 1393.88s - 1398.68s | And one of those settings, which was not super present in the documentation, 1398.68s - 1403.82s | was the ability to provide a version control server to connect to. 1403.82s - 1406.78s | And when it opened the file, it would automatically connect to that server. 1406.78s - 1409.06s | So I could provide a victim with a file. 1409.06s - 1410.98s | They'd open it, connect to my server. 1410.98s - 1415.06s | My server would push a file down and shell the device. 1415.06s - 1417.92s | So that was an RCE via malicious file. 1417.94s - 1420.88s | And the bounty for that was $15,000 to $30,000. 1420.88s - 1422.88s | Critical, critical, critical, of course. 1422.88s - 1425.28s | And that was, again, on a public program. 1425.28s - 1427.08s | Takeaways from this, read the freaking docs. 1427.08s - 1428.04s | It really helps. 1428.04s - 1429.52s | And articles. 1429.52s - 1431.22s | Don't shy away from targets you're scared of. 1431.22s - 1438.28s | And use your super amazing hacker brain for any struct pack calls or chat GPT, 1438.28s - 1440.14s | whichever you're more comfortable with. 1440.14s - 1443.92s | Okay, Joel, I've got some Easter eggs for you in this one, man. 1443.92s - 1445.18s | You're going to like this, okay? 1445.20s - 1450.90s | So the next bug that I wanted to talk about was shelling a public program router. 1450.90s - 1454.40s | Once again, I wasn't super familiar with IoT devices before this. 1454.40s - 1460.98s | And so I leaned heavily on my boy, Joel Margolis, my podcast co-host here. 1460.98s - 1464.14s | And as cute as we are together there in that picture, 1464.14s - 1467.28s | we are both independently married, although that would be great. 1471.14s - 1474.58s | So let's get to the


chunk_text:
| Critical, critical, critical, of course. 1422.88s - 1425.28s | And that was, again, on a public program. 1425.28s - 1427.08s | Takeaways from this, read the freaking docs. 1427.08s - 1428.04s | It really helps. 1428.04s - 1429.52s | And articles. 1429.52s - 1431.22s | Don't shy away from targets you're scared of. 1431.22s - 1438.28s | And use your super amazing hacker brain for any struct pack calls or chat GPT, 1438.28s - 1440.14s | whichever you're more comfortable with. 1440.14s - 1443.92s | Okay, Joel, I've got some Easter eggs for you in this one, man. 1443.92s - 1445.18s | You're going to like this, okay? 1445.20s - 1450.90s | So the next bug that I wanted to talk about was shelling a public program router. 1450.90s - 1454.40s | Once again, I wasn't super familiar with IoT devices before this. 1454.40s - 1460.98s | And so I leaned heavily on my boy, Joel Margolis, my podcast co-host here. 1460.98s - 1464.14s | And as cute as we are together there in that picture, 1464.14s - 1467.28s | we are both independently married, although that would be great. 1471.14s - 1474.58s | So let's get to the details, okay, guys? 1476.04s - 1479.24s | Essentially, what we did is we took this router that was in a public program. 1479.24s - 1480.74s | We broke it apart. 1480.74s - 1484.38s | And we used the FCC website and Google and our brain 1484.38s - 1487.24s | to identify that this chip was in, 1487.24s - 1488.88s | this is what it sounded like to me the first time, 1488.88s - 1493.70s | a BGAEMMCABC1234G74XYZ. 1493.70s - 1494.70s | This is coming out of Joel's mouth. 1494.70s - 1496.64s | And I was like, oh, my gosh, what the heck is that? 1496.64s - 1499.10s | Well, it's a lot easier than you would think. 1499.10s - 1500.18s | It's a ball grid array. 1500.18s - 1503.98s | Those are those little pieces of silver pieces there, 1504.04s - 1506.34s | the little pieces of solder, the connections. 1506.34s - 1510.54s | And then this is an EMMC, which is essentially a SD card, 1510.54s - 1515.70s | which is just attached to the firmware device or attached to the board. 1515.70s - 1516.90s | So that was really cool. 1516.90s - 1518.84s | So we wanted to


chunk_text:
details, okay, guys? 1476.04s - 1479.24s | Essentially, what we did is we took this router that was in a public program. 1479.24s - 1480.74s | We broke it apart. 1480.74s - 1484.38s | And we used the FCC website and Google and our brain 1484.38s - 1487.24s | to identify that this chip was in, 1487.24s - 1488.88s | this is what it sounded like to me the first time, 1488.88s - 1493.70s | a BGAEMMCABC1234G74XYZ. 1493.70s - 1494.70s | This is coming out of Joel's mouth. 1494.70s - 1496.64s | And I was like, oh, my gosh, what the heck is that? 1496.64s - 1499.10s | Well, it's a lot easier than you would think. 1499.10s - 1500.18s | It's a ball grid array. 1500.18s - 1503.98s | Those are those little pieces of silver pieces there, 1504.04s - 1506.34s | the little pieces of solder, the connections. 1506.34s - 1510.54s | And then this is an EMMC, which is essentially a SD card, 1510.54s - 1515.70s | which is just attached to the firmware device or attached to the board. 1515.70s - 1516.90s | So that was really cool. 1516.90s - 1518.84s | So we wanted to get that chip off. 1518.84s - 1522.64s | So and for some reason, Joel let me do it. 1522.64s - 1525.74s | So what we did was we get a hot air. 1525.74s - 1527.70s | I ordered a bunch of stuff on Amazon. 1527.70s - 1530.38s | I got the hot air rework station and lots of flux. 1530.38s - 1533.78s | And I sat down on the device and started blasting it 1533.78s - 1536.34s | with 500 degrees Fahrenheit air. 1536.34s - 1538.34s | And Joel was like, don't do that, bro. 1538.34s - 1542.54s | And then I proceeded to pull the EMMC chip off 1542.54s - 1545.18s | before the solder was completely liquid. 1545.18s - 1546.54s | And Joel was like, don't do that. 1546.54s - 1548.10s | And just give it some time. 1548.10s - 1551.18s | And then finally, after bricking three of them, 1551.18s - 1556.86s | we were actually able to get a clean read of the EMMC chip in our BGA reader 1556.86s - 1560.42s | and pull off the firmware for that device. 1560.42s - 1562.78s | Here's Joel's super awesome hardware hacking setup, 1562.78s - 1565.78s |


chunk_text:
get that chip off. 1518.84s - 1522.64s | So and for some reason, Joel let me do it. 1522.64s - 1525.74s | So what we did was we get a hot air. 1525.74s - 1527.70s | I ordered a bunch of stuff on Amazon. 1527.70s - 1530.38s | I got the hot air rework station and lots of flux. 1530.38s - 1533.78s | And I sat down on the device and started blasting it 1533.78s - 1536.34s | with 500 degrees Fahrenheit air. 1536.34s - 1538.34s | And Joel was like, don't do that, bro. 1538.34s - 1542.54s | And then I proceeded to pull the EMMC chip off 1542.54s - 1545.18s | before the solder was completely liquid. 1545.18s - 1546.54s | And Joel was like, don't do that. 1546.54s - 1548.10s | And just give it some time. 1548.10s - 1551.18s | And then finally, after bricking three of them, 1551.18s - 1556.86s | we were actually able to get a clean read of the EMMC chip in our BGA reader 1556.86s - 1560.42s | and pull off the firmware for that device. 1560.42s - 1562.78s | Here's Joel's super awesome hardware hacking setup, 1562.78s - 1565.78s | by the way, which I'm jealous of. 1565.78s - 1566.94s | Yeah, bricked three of them. 1566.94s - 1567.74s | Not a great feeling. 1567.74s - 1568.98s | But the company paid for it. 1568.98s - 1570.46s | So that was great. 1570.46s - 1573.38s | So now we've got the firmware so we can start hunting reliably. 1573.38s - 1575.22s | And it's time to shell that. 1575.22s - 1577.74s | So what we did then, we were hoping it was 1577.74s - 1579.34s | going to be a lot easier than it was. 1579.34s - 1582.98s | But it was several days of weeding through Python code 1582.98s - 1588.10s | to find the actual attack vector that we ended up getting RCE with. 1588.10s - 1590.86s | And so the attack chain that we ended up going with 1590.86s - 1595.06s | started with us using an HTTP request to the cloud provider 1595.06s - 1599.74s | for this specific device that sent a certificate up. 1599.74s - 1601.90s | And that certificate was then pushed to the device 1601.90s - 1608.02s | and controlled certificate-based access to the Google RPC service 1608.02s - 1610.34s | listening


chunk_text:
by the way, which I'm jealous of. 1565.78s - 1566.94s | Yeah, bricked three of them. 1566.94s - 1567.74s | Not a great feeling. 1567.74s - 1568.98s | But the company paid for it. 1568.98s - 1570.46s | So that was great. 1570.46s - 1573.38s | So now we've got the firmware so we can start hunting reliably. 1573.38s - 1575.22s | And it's time to shell that. 1575.22s - 1577.74s | So what we did then, we were hoping it was 1577.74s - 1579.34s | going to be a lot easier than it was. 1579.34s - 1582.98s | But it was several days of weeding through Python code 1582.98s - 1588.10s | to find the actual attack vector that we ended up getting RCE with. 1588.10s - 1590.86s | And so the attack chain that we ended up going with 1590.86s - 1595.06s | started with us using an HTTP request to the cloud provider 1595.06s - 1599.74s | for this specific device that sent a certificate up. 1599.74s - 1601.90s | And that certificate was then pushed to the device 1601.90s - 1608.02s | and controlled certificate-based access to the Google RPC service 1608.02s - 1610.34s | listening on a port on the device. 1610.34s - 1612.38s | So once we pushed up that certificate, we 1612.38s - 1615.46s | were able to communicate with gRPC, which we thought 1615.46s - 1617.66s | was going to be super helpful. 1617.66s - 1620.62s | But there was still not a lot of vulnerable code in there. 1620.62s - 1623.06s | So we spent a couple of days continuing to look. 1623.06s - 1626.30s | Then finally, we came across this specific piece 1626.30s - 1629.50s | of functionality, which is write reservations. 1629.50s - 1635.02s | And as you can see in there, there's a Jinja 2 template being referenced. 1635.02s - 1637.74s | So everyone's probably thinking template injection. 1637.74s - 1638.46s | But it's not. 1638.46s - 1640.06s | They're using it correctly. 1640.06s - 1643.62s | What it is, however, is configuration file injection, 1643.62s - 1650.30s | which is a much rarer and, I think, totally underrated vulnerability class. 1650.30s - 1652.18s | And it kind of looks like this. 1652.18s - 1655.70s | This functionality would, what was this functionality doing? 1655.70s - 1659.62s | Yeah, it was writing static IP reservations for the


chunk_text:
on a port on the device. 1610.34s - 1612.38s | So once we pushed up that certificate, we 1612.38s - 1615.46s | were able to communicate with gRPC, which we thought 1615.46s - 1617.66s | was going to be super helpful. 1617.66s - 1620.62s | But there was still not a lot of vulnerable code in there. 1620.62s - 1623.06s | So we spent a couple of days continuing to look. 1623.06s - 1626.30s | Then finally, we came across this specific piece 1626.30s - 1629.50s | of functionality, which is write reservations. 1629.50s - 1635.02s | And as you can see in there, there's a Jinja 2 template being referenced. 1635.02s - 1637.74s | So everyone's probably thinking template injection. 1637.74s - 1638.46s | But it's not. 1638.46s - 1640.06s | They're using it correctly. 1640.06s - 1643.62s | What it is, however, is configuration file injection, 1643.62s - 1650.30s | which is a much rarer and, I think, totally underrated vulnerability class. 1650.30s - 1652.18s | And it kind of looks like this. 1652.18s - 1655.70s | This functionality would, what was this functionality doing? 1655.70s - 1659.62s | Yeah, it was writing static IP reservations for the router, right? 1659.62s - 1664.14s | And so what it would do is dynamically generate this DHCPD file, config file. 1664.14s - 1666.50s | And it would put the IP address that we wanted to static 1666.50s - 1668.38s | into the fixed address attribute. 1668.38s - 1670.66s | However, it wasn't escaping the characters 1670.66s - 1673.78s | that would allow us to write other DHCPD commands. 1673.78s - 1676.62s | So we were able to identify a command that 1676.62s - 1682.74s | would run a shell command when a new DHCP lease was issued. 1682.74s - 1686.58s | And we were able to code golf it so that it keeps the correct syntax 1686.58s - 1688.74s | and doesn't break anything. 1688.74s - 1692.46s | And so then after we got that in place and the exploit went off successfully, 1692.46s - 1695.02s | we grabbed our phones, connected to the device, 1695.02s - 1698.06s | and we saw that beautiful shell connection come back, 1698.06s - 1701.06s | which is one of my favorite moments I've ever had hacking. 1701.06s - 1704.58s | Joel knows that I jumped up and screamed, and it was amazing. 1704.58s


chunk_text:
router, right? 1659.62s - 1664.14s | And so what it would do is dynamically generate this DHCPD file, config file. 1664.14s - 1666.50s | And it would put the IP address that we wanted to static 1666.50s - 1668.38s | into the fixed address attribute. 1668.38s - 1670.66s | However, it wasn't escaping the characters 1670.66s - 1673.78s | that would allow us to write other DHCPD commands. 1673.78s - 1676.62s | So we were able to identify a command that 1676.62s - 1682.74s | would run a shell command when a new DHCP lease was issued. 1682.74s - 1686.58s | And we were able to code golf it so that it keeps the correct syntax 1686.58s - 1688.74s | and doesn't break anything. 1688.74s - 1692.46s | And so then after we got that in place and the exploit went off successfully, 1692.46s - 1695.02s | we grabbed our phones, connected to the device, 1695.02s - 1698.06s | and we saw that beautiful shell connection come back, 1698.06s - 1701.06s | which is one of my favorite moments I've ever had hacking. 1701.06s - 1704.58s | Joel knows that I jumped up and screamed, and it was amazing. 1704.58s - 1708.42s | So that one was 20 to 32K, once again, on a public program. 1708.42s - 1710.26s | And I'm pretty proud of this fact. 1710.26s - 1714.46s | It took us from zero, from knowing nothing about this target, 1714.46s - 1716.86s | about 10 days to get that shell. 1716.86s - 1720.26s | And so I thought it was going to be a lot harder than that. 1720.26s - 1722.26s | So don't shy away from these sort of things 1722.26s - 1724.94s | if you're intimidated by it like I was. 1724.94s - 1728.58s | Takeaways from this one is hack with a collaborator or Joel Margolis, 1728.58s - 1730.06s | one of those two. 1730.06s - 1733.86s | Don't be afraid of hacking different types of scope. 1733.86s - 1737.34s | Get your hands on source code as much as you possibly can. 1737.34s - 1740.06s | And obviously, configuration file injection 1740.06s - 1744.10s | is a pretty underrated vuln class, I think, especially in the IoT world. 1744.10s - 1747.30s | OK, we're just going to do it again real quick, 1747.30s - 1749.26s | and then we'll move on to the


chunk_text:
- 1708.42s | So that one was 20 to 32K, once again, on a public program. 1708.42s - 1710.26s | And I'm pretty proud of this fact. 1710.26s - 1714.46s | It took us from zero, from knowing nothing about this target, 1714.46s - 1716.86s | about 10 days to get that shell. 1716.86s - 1720.26s | And so I thought it was going to be a lot harder than that. 1720.26s - 1722.26s | So don't shy away from these sort of things 1722.26s - 1724.94s | if you're intimidated by it like I was. 1724.94s - 1728.58s | Takeaways from this one is hack with a collaborator or Joel Margolis, 1728.58s - 1730.06s | one of those two. 1730.06s - 1733.86s | Don't be afraid of hacking different types of scope. 1733.86s - 1737.34s | Get your hands on source code as much as you possibly can. 1737.34s - 1740.06s | And obviously, configuration file injection 1740.06s - 1744.10s | is a pretty underrated vuln class, I think, especially in the IoT world. 1744.10s - 1747.30s | OK, we're just going to do it again real quick, 1747.30s - 1749.26s | and then we'll move on to the next one. 1749.26s - 1752.02s | This one was really interesting, though, so I wanted to include it. 1752.02s - 1753.98s | Another vulnerable endpoint on that same target 1753.98s - 1756.66s | was doing the same thing for DNS mask. 1756.66s - 1759.14s | So we're like, OK, let's see if we can do the same thing there. 1759.14s - 1763.34s | So of course, we Google how to execute code with DNS mask config, 1763.34s - 1765.42s | and nothing comes up. 1765.42s - 1767.54s | Unfortunately, there's not a great way to do that. 1767.54s - 1771.14s | However, what every good DNS caching software needs 1771.14s - 1774.22s | is a built-in TFTP server. 1774.22s - 1775.26s | Yeah. 1775.26s - 1780.26s | So essentially, that can be turned on via a DHCPD configuration. 1780.26s - 1785.50s | And then you will just be able to have FTP on the whole file system, 1785.50s - 1788.62s | and we're able to grab another file that can have a lot of impact. 1788.62s - 1792.10s | The problem was is that we had double injection points this time 1792.10s - 1793.90s | around in the template, OK?


chunk_text:
next one. 1749.26s - 1752.02s | This one was really interesting, though, so I wanted to include it. 1752.02s - 1753.98s | Another vulnerable endpoint on that same target 1753.98s - 1756.66s | was doing the same thing for DNS mask. 1756.66s - 1759.14s | So we're like, OK, let's see if we can do the same thing there. 1759.14s - 1763.34s | So of course, we Google how to execute code with DNS mask config, 1763.34s - 1765.42s | and nothing comes up. 1765.42s - 1767.54s | Unfortunately, there's not a great way to do that. 1767.54s - 1771.14s | However, what every good DNS caching software needs 1771.14s - 1774.22s | is a built-in TFTP server. 1774.22s - 1775.26s | Yeah. 1775.26s - 1780.26s | So essentially, that can be turned on via a DHCPD configuration. 1780.26s - 1785.50s | And then you will just be able to have FTP on the whole file system, 1785.50s - 1788.62s | and we're able to grab another file that can have a lot of impact. 1788.62s - 1792.10s | The problem was is that we had double injection points this time 1792.10s - 1793.90s | around in the template, OK? 1793.90s - 1796.78s | And we really got stuck here for a long time 1796.78s - 1800.30s | because the user root directive, which 1800.30s - 1806.70s | is required to open up this TFTP server, cannot be duplicated twice. 1806.70s - 1807.78s | Just that one directive. 1807.78s - 1811.86s | Everything else can be duplicated, but the user root cannot. 1811.86s - 1814.94s | And so because of the double injection points, 1814.94s - 1817.82s | we were having a really hard time with that. 1817.82s - 1820.42s | So the solution, of course, is to reach out 1820.42s - 1826.30s | to Sam Erb, a Googler and double time black badge guy, 1826.30s - 1828.50s | and say, hey, we've got this problem. 1828.50s - 1829.34s | And what does Sam do? 1829.34s - 1832.66s | Of course, he just opens up the C code for DNS mask 1832.66s - 1836.02s | and starts reviewing how lines are getting parsed, 1836.02s - 1840.26s | which is very Sam Erb of him to do. 1840.26s - 1842.06s | And he comes back and he says, hey, there's 1842.06s - 1846.98s | a maximum character length on a config


chunk_text:
1793.90s - 1796.78s | And we really got stuck here for a long time 1796.78s - 1800.30s | because the user root directive, which 1800.30s - 1806.70s | is required to open up this TFTP server, cannot be duplicated twice. 1806.70s - 1807.78s | Just that one directive. 1807.78s - 1811.86s | Everything else can be duplicated, but the user root cannot. 1811.86s - 1814.94s | And so because of the double injection points, 1814.94s - 1817.82s | we were having a really hard time with that. 1817.82s - 1820.42s | So the solution, of course, is to reach out 1820.42s - 1826.30s | to Sam Erb, a Googler and double time black badge guy, 1826.30s - 1828.50s | and say, hey, we've got this problem. 1828.50s - 1829.34s | And what does Sam do? 1829.34s - 1832.66s | Of course, he just opens up the C code for DNS mask 1832.66s - 1836.02s | and starts reviewing how lines are getting parsed, 1836.02s - 1840.26s | which is very Sam Erb of him to do. 1840.26s - 1842.06s | And he comes back and he says, hey, there's 1842.06s - 1846.98s | a maximum character length on a config line for DNS mask, 1846.98s - 1849.22s | and that's 1,025. 1849.22s - 1854.62s | So you might be able to essentially align the directive that you need 1854.62s - 1858.34s | and essentially utilize that maximum length 1858.34s - 1863.06s | to create a discrepancy between your two injection points. 1863.06s - 1865.18s | That's the code that's vulnerable. 1865.18s - 1868.30s | It's not really vulnerable, it's just useful in this scenario. 1868.30s - 1872.06s | And so what we did is one of those two double injection points 1872.06s - 1874.90s | was the line was much longer than the other one. 1874.90s - 1880.98s | So on the shorter line, we created an injection 1880.98s - 1885.14s | that would not exceed the 1,025 byte limit. 1885.14s - 1890.58s | And our user root directive would be placed inside of a comment 1890.58s - 1892.74s | at the end of that, towards the end of that line, 1892.74s - 1893.98s | but not at the end. 1893.98s - 1897.02s | And then on the longer injection, let me see if I can show you. 1897.02s - 1901.02s | Yeah, at the longer injection, the line would


chunk_text:
line for DNS mask, 1846.98s - 1849.22s | and that's 1,025. 1849.22s - 1854.62s | So you might be able to essentially align the directive that you need 1854.62s - 1858.34s | and essentially utilize that maximum length 1858.34s - 1863.06s | to create a discrepancy between your two injection points. 1863.06s - 1865.18s | That's the code that's vulnerable. 1865.18s - 1868.30s | It's not really vulnerable, it's just useful in this scenario. 1868.30s - 1872.06s | And so what we did is one of those two double injection points 1872.06s - 1874.90s | was the line was much longer than the other one. 1874.90s - 1880.98s | So on the shorter line, we created an injection 1880.98s - 1885.14s | that would not exceed the 1,025 byte limit. 1885.14s - 1890.58s | And our user root directive would be placed inside of a comment 1890.58s - 1892.74s | at the end of that, towards the end of that line, 1892.74s - 1893.98s | but not at the end. 1893.98s - 1897.02s | And then on the longer injection, let me see if I can show you. 1897.02s - 1901.02s | Yeah, at the longer injection, the line would overflow, 1901.02s - 1903.98s | the comments would be longer, and line up user root 1903.98s - 1909.86s | just on the new line that would be read when parsing the config file. 1909.86s - 1913.66s | So that was able to get one of our user root directives 1913.66s - 1915.82s | in a commented out state, and the other one 1915.82s - 1920.06s | would get bumped to the next line of the DNS mask config file. 1920.06s - 1922.18s | So this is what the exploit looked like at the end. 1922.18s - 1928.78s | You can see the top comment has user colon root at the end, 1928.78s - 1930.98s | and then all the other directives, which are fine to repeat. 1930.98s - 1933.78s | And then the IP set line has a bunch of A's, 1933.78s - 1938.70s | and then the A's are right up to that 1,025 byte limit. 1938.70s - 1941.78s | And then user root gets dropped down into the next line 1941.78s - 1944.98s | and gets parsed and executed. 1944.98s - 1949.06s | So using that, we were able to open up a TFTP server on port 69


chunk_text:
overflow, 1901.02s - 1903.98s | the comments would be longer, and line up user root 1903.98s - 1909.86s | just on the new line that would be read when parsing the config file. 1909.86s - 1913.66s | So that was able to get one of our user root directives 1913.66s - 1915.82s | in a commented out state, and the other one 1915.82s - 1920.06s | would get bumped to the next line of the DNS mask config file. 1920.06s - 1922.18s | So this is what the exploit looked like at the end. 1922.18s - 1928.78s | You can see the top comment has user colon root at the end, 1928.78s - 1930.98s | and then all the other directives, which are fine to repeat. 1930.98s - 1933.78s | And then the IP set line has a bunch of A's, 1933.78s - 1938.70s | and then the A's are right up to that 1,025 byte limit. 1938.70s - 1941.78s | And then user root gets dropped down into the next line 1941.78s - 1944.98s | and gets parsed and executed. 1944.98s - 1949.06s | So using that, we were able to open up a TFTP server on port 69 1949.06s - 1953.14s | and connect and exfiltrate data that we needed 1953.14s - 1955.94s | to get our C on the target again. 1955.94s - 1958.54s | That was another one, same program. 1958.54s - 1961.06s | I think maybe this was a little bit after the 10 days. 1961.06s - 1962.74s | It might have been 11 days or 12 days, 1962.74s - 1966.26s | but we found it pretty quickly afterwards. 1966.26s - 1969.34s | Takeaway for this one is if it works, do it again. 1969.34s - 1971.02s | That's one of the big principles of bug bounty, 1971.02s - 1974.06s | is if you find a bug in one particular area, 1974.06s - 1977.86s | there's very likely to be bugs that are similar to it 1977.90s - 1979.74s | in a similar location. 1979.74s - 1983.50s | So definitely do your due diligence and go down that route. 1983.50s - 1985.18s | Okay, we're gonna do another one really quick, 1985.18s - 1991.22s | but I'm gonna get a drink of water first. 1991.22s - 1992.90s | Okay, bug number nine. 1992.90s - 1993.74s | We're doing really good. 1993.74s - 1995.98s | Actually,


chunk_text:
1949.06s - 1953.14s | and connect and exfiltrate data that we needed 1953.14s - 1955.94s | to get our C on the target again. 1955.94s - 1958.54s | That was another one, same program. 1958.54s - 1961.06s | I think maybe this was a little bit after the 10 days. 1961.06s - 1962.74s | It might have been 11 days or 12 days, 1962.74s - 1966.26s | but we found it pretty quickly afterwards. 1966.26s - 1969.34s | Takeaway for this one is if it works, do it again. 1969.34s - 1971.02s | That's one of the big principles of bug bounty, 1971.02s - 1974.06s | is if you find a bug in one particular area, 1974.06s - 1977.86s | there's very likely to be bugs that are similar to it 1977.90s - 1979.74s | in a similar location. 1979.74s - 1983.50s | So definitely do your due diligence and go down that route. 1983.50s - 1985.18s | Okay, we're gonna do another one really quick, 1985.18s - 1991.22s | but I'm gonna get a drink of water first. 1991.22s - 1992.90s | Okay, bug number nine. 1992.90s - 1993.74s | We're doing really good. 1993.74s - 1995.98s | Actually, I'm moving a little fast. 1995.98s - 1998.22s | I may not use my full time block. 2000.82s - 2002.14s | Okay, so this time we've got 2002.14s - 2004.54s | a version control binary SQL injection. 2004.54s - 2006.02s | And I'm gonna make this one a little bit shorter 2006.02s - 2008.42s | because it's kind of complicated. 2008.42s - 2010.94s | So we get this version control binary and I'm like, 2011.06s - 2014.26s | let me see if I can do something out of my comfort zone 2014.26s - 2016.14s | and load it up into Ghidra. 2016.14s - 2017.06s | And then I get a bunch of errors 2017.06s - 2020.54s | relating to Microsoft and CLR and .NET. 2020.54s - 2022.58s | So I loaded up into .peek 2022.58s - 2024.98s | and we were able to get the source code out, 2024.98s - 2026.14s | which was great because apparently 2026.14s - 2029.62s | you can decompile those binaries 2029.62s - 2031.58s | and you get some really clean source code. 2031.58s - 2032.94s | So we were looking at the source code 2032.94s - 2034.98s | and essentially what was happening is


chunk_text:
I'm moving a little fast. 1995.98s - 1998.22s | I may not use my full time block. 2000.82s - 2002.14s | Okay, so this time we've got 2002.14s - 2004.54s | a version control binary SQL injection. 2004.54s - 2006.02s | And I'm gonna make this one a little bit shorter 2006.02s - 2008.42s | because it's kind of complicated. 2008.42s - 2010.94s | So we get this version control binary and I'm like, 2011.06s - 2014.26s | let me see if I can do something out of my comfort zone 2014.26s - 2016.14s | and load it up into Ghidra. 2016.14s - 2017.06s | And then I get a bunch of errors 2017.06s - 2020.54s | relating to Microsoft and CLR and .NET. 2020.54s - 2022.58s | So I loaded up into .peek 2022.58s - 2024.98s | and we were able to get the source code out, 2024.98s - 2026.14s | which was great because apparently 2026.14s - 2029.62s | you can decompile those binaries 2029.62s - 2031.58s | and you get some really clean source code. 2031.58s - 2032.94s | So we were looking at the source code 2032.94s - 2034.98s | and essentially what was happening is 2035.86s - 2037.42s | we would be able to upload a file 2037.42s - 2040.10s | to a web version control interface. 2040.22s - 2042.26s | And that file could have a malicious name. 2042.26s - 2043.62s | And then it would be stored 2043.62s - 2044.90s | in the version control environment. 2044.90s - 2046.70s | And the next time the user opened up 2046.70s - 2048.70s | and used that version control binary, 2048.70s - 2051.78s | it would pull the malicious file down 2051.78s - 2055.78s | and insert it into a SQLite database. 2055.78s - 2060.02s | So if you name a file, an SQL injection payload, 2060.02s - 2063.94s | it would fire that and escape the string 2063.94s - 2068.10s | in the SQLite query and run arbitrary SQL 2068.10s - 2069.34s | on the victim's machine. 2069.38s - 2070.46s | This was found in collaboration 2070.46s - 2072.62s | with an amazing hacker named Udyotuk. 2072.62s - 2075.50s | And he reads C-sharp code to fall asleep at night. 2075.50s - 2078.78s | So he was the original one who found this sink. 2079.78s - 2082.02s | So how we exploited this was


chunk_text:
2035.86s - 2037.42s | we would be able to upload a file 2037.42s - 2040.10s | to a web version control interface. 2040.22s - 2042.26s | And that file could have a malicious name. 2042.26s - 2043.62s | And then it would be stored 2043.62s - 2044.90s | in the version control environment. 2044.90s - 2046.70s | And the next time the user opened up 2046.70s - 2048.70s | and used that version control binary, 2048.70s - 2051.78s | it would pull the malicious file down 2051.78s - 2055.78s | and insert it into a SQLite database. 2055.78s - 2060.02s | So if you name a file, an SQL injection payload, 2060.02s - 2063.94s | it would fire that and escape the string 2063.94s - 2068.10s | in the SQLite query and run arbitrary SQL 2068.10s - 2069.34s | on the victim's machine. 2069.38s - 2070.46s | This was found in collaboration 2070.46s - 2072.62s | with an amazing hacker named Udyotuk. 2072.62s - 2075.50s | And he reads C-sharp code to fall asleep at night. 2075.50s - 2078.78s | So he was the original one who found this sink. 2079.78s - 2082.02s | So how we exploited this was 2082.02s - 2084.66s | we were able to upload the file, sink it down. 2084.66s - 2088.26s | And then in the end, we weren't able to get code execution, 2088.26s - 2091.98s | but what we were able to do was actually run code, 2091.98s - 2095.54s | which would attach the user's Chrome cookies, 2095.54s - 2098.54s | which are stored in a SQLite database 2099.30s - 2101.98s | and vacuum it into a B.db file, 2101.98s - 2104.50s | and then recheck that file back into version control, 2104.50s - 2106.58s | which would push it back up to the web app. 2106.58s - 2107.98s | And then we could download 2107.98s - 2110.94s | and get ATO on that victim's web version control account. 2111.94s - 2113.90s | And so that one, that was the end of the vuln. 2113.90s - 2115.14s | That was where we chained it to. 2115.14s - 2116.70s | That one was 30, 40K. 2116.70s - 2118.86s | And once again, wanted to reiterate, 2118.86s - 2120.90s | definitely hack with other hackers. 2120.90s - 2122.90s | It really expands your knowledge, 2122.90s - 2125.26s | especially in areas where you're


chunk_text:
2082.02s - 2084.66s | we were able to upload the file, sink it down. 2084.66s - 2088.26s | And then in the end, we weren't able to get code execution, 2088.26s - 2091.98s | but what we were able to do was actually run code, 2091.98s - 2095.54s | which would attach the user's Chrome cookies, 2095.54s - 2098.54s | which are stored in a SQLite database 2099.30s - 2101.98s | and vacuum it into a B.db file, 2101.98s - 2104.50s | and then recheck that file back into version control, 2104.50s - 2106.58s | which would push it back up to the web app. 2106.58s - 2107.98s | And then we could download 2107.98s - 2110.94s | and get ATO on that victim's web version control account. 2111.94s - 2113.90s | And so that one, that was the end of the vuln. 2113.90s - 2115.14s | That was where we chained it to. 2115.14s - 2116.70s | That one was 30, 40K. 2116.70s - 2118.86s | And once again, wanted to reiterate, 2118.86s - 2120.90s | definitely hack with other hackers. 2120.90s - 2122.90s | It really expands your knowledge, 2122.90s - 2125.26s | especially in areas where you're uncomfortable. 2126.22s - 2129.30s | I have to admit, I kind of underestimated SQLite. 2129.30s - 2131.30s | I kind of thought SQLite was a thing of the past, 2131.30s - 2132.26s | but they're out there, 2132.26s - 2135.18s | and we see them pretty often in the live hacking events. 2135.18s - 2136.58s | They're just a little bit deeper. 2136.58s - 2138.46s | And sometimes they're not even just a little bit deeper. 2138.46s - 2139.46s | They're out there. 2140.70s - 2141.94s | .peek is super helpful 2141.94s - 2143.86s | for those sort of decompilation scenarios 2143.86s - 2147.30s | when the base language is, I think like .net or C-sharp. 2147.30s - 2149.58s | So definitely check that out. 2149.58s - 2152.62s | And yeah, I really liked the exploitation scenario 2152.62s - 2153.62s | that we came up with there, 2153.62s - 2156.98s | where we were able to vacuum the user's cookies 2156.98s - 2158.14s | into the version control 2158.14s - 2160.42s | and use that to exfiltrate the file as well. 2162.22s - 2164.30s | Yeah, and maybe don't roll your own version control. 2164.30s - 2166.10s | That's a


chunk_text:
uncomfortable. 2126.22s - 2129.30s | I have to admit, I kind of underestimated SQLite. 2129.30s - 2131.30s | I kind of thought SQLite was a thing of the past, 2131.30s - 2132.26s | but they're out there, 2132.26s - 2135.18s | and we see them pretty often in the live hacking events. 2135.18s - 2136.58s | They're just a little bit deeper. 2136.58s - 2138.46s | And sometimes they're not even just a little bit deeper. 2138.46s - 2139.46s | They're out there. 2140.70s - 2141.94s | .peek is super helpful 2141.94s - 2143.86s | for those sort of decompilation scenarios 2143.86s - 2147.30s | when the base language is, I think like .net or C-sharp. 2147.30s - 2149.58s | So definitely check that out. 2149.58s - 2152.62s | And yeah, I really liked the exploitation scenario 2152.62s - 2153.62s | that we came up with there, 2153.62s - 2156.98s | where we were able to vacuum the user's cookies 2156.98s - 2158.14s | into the version control 2158.14s - 2160.42s | and use that to exfiltrate the file as well. 2162.22s - 2164.30s | Yeah, and maybe don't roll your own version control. 2164.30s - 2166.10s | That's a nice takeaway as well. 2166.10s - 2168.26s | That never seems to end well. 2168.26s - 2172.86s | Okay, now we are on to the very hard exploits. 2172.86s - 2174.58s | So buckle up. 2174.58s - 2176.70s | This one's gonna take a hot second. 2176.70s - 2184.03s | I'm gonna get water again. 2184.03s - 2187.79s | Okay, target for this one was an in-home tabletop IoT device 2187.79s - 2189.19s | with camera and microphone. 2189.19s - 2190.31s | There's a couple out there. 2190.31s - 2192.55s | It's probably not the one you're thinking of, 2192.55s - 2195.07s | but it is one of the top four or five 2195.07s - 2196.31s | you would be thinking of. 2198.83s - 2200.99s | The end goal of this was, once again, 2200.99s - 2203.91s | I wanted to do creepy shit that people always say, 2203.91s - 2206.71s | okay, it's possible, but I haven't seen before. 2206.71s - 2208.03s | And now I have. 2208.03s - 2210.87s | So I wanted to do no user interaction spying 2212.67s - 2214.03s | in somebody's house 2214.03s - 2217.71s | and essentially just teleport myself into their house.


chunk_text:
nice takeaway as well. 2166.10s - 2168.26s | That never seems to end well. 2168.26s - 2172.86s | Okay, now we are on to the very hard exploits. 2172.86s - 2174.58s | So buckle up. 2174.58s - 2176.70s | This one's gonna take a hot second. 2176.70s - 2184.03s | I'm gonna get water again. 2184.03s - 2187.79s | Okay, target for this one was an in-home tabletop IoT device 2187.79s - 2189.19s | with camera and microphone. 2189.19s - 2190.31s | There's a couple out there. 2190.31s - 2192.55s | It's probably not the one you're thinking of, 2192.55s - 2195.07s | but it is one of the top four or five 2195.07s - 2196.31s | you would be thinking of. 2198.83s - 2200.99s | The end goal of this was, once again, 2200.99s - 2203.91s | I wanted to do creepy shit that people always say, 2203.91s - 2206.71s | okay, it's possible, but I haven't seen before. 2206.71s - 2208.03s | And now I have. 2208.03s - 2210.87s | So I wanted to do no user interaction spying 2212.67s - 2214.03s | in somebody's house 2214.03s - 2217.71s | and essentially just teleport myself into their house. 2218.47s - 2219.31s | And so I started going after that path 2219.31s - 2220.15s | and I started ideating 2220.15s - 2222.31s | on what the possibilities for this were. 2222.31s - 2223.15s | Here are a couple. 2223.15s - 2224.83s | We could get a no interaction shell on the device. 2224.83s - 2226.63s | That would be really challenging. 2226.63s - 2230.19s | We could gain some sort of, insert company name here, 2230.19s - 2231.95s | admin functionality on the device, 2231.95s - 2234.23s | and maybe that would allow us to do it. 2234.23s - 2236.63s | We could bypass auth specifically for the cam 2236.63s - 2238.47s | and mic-related endpoints. 2238.47s - 2241.39s | We could compromise storage for video and audio feeds 2241.39s - 2243.23s | and maybe get access that way. 2243.23s - 2245.51s | Or we could access the built-in functionality 2245.55s - 2249.23s | to access the cam and mic stuff 2249.23s - 2252.27s | via a full authentication bypass on that person's account. 2253.19s - 2254.55s | So which one are we feeling, guys? 2254.55s - 2256.31s | Raise your hands, put them up. 2256.31s - 2258.43s |


chunk_text:
2218.47s - 2219.31s | And so I started going after that path 2219.31s - 2220.15s | and I started ideating 2220.15s - 2222.31s | on what the possibilities for this were. 2222.31s - 2223.15s | Here are a couple. 2223.15s - 2224.83s | We could get a no interaction shell on the device. 2224.83s - 2226.63s | That would be really challenging. 2226.63s - 2230.19s | We could gain some sort of, insert company name here, 2230.19s - 2231.95s | admin functionality on the device, 2231.95s - 2234.23s | and maybe that would allow us to do it. 2234.23s - 2236.63s | We could bypass auth specifically for the cam 2236.63s - 2238.47s | and mic-related endpoints. 2238.47s - 2241.39s | We could compromise storage for video and audio feeds 2241.39s - 2243.23s | and maybe get access that way. 2243.23s - 2245.51s | Or we could access the built-in functionality 2245.55s - 2249.23s | to access the cam and mic stuff 2249.23s - 2252.27s | via a full authentication bypass on that person's account. 2253.19s - 2254.55s | So which one are we feeling, guys? 2254.55s - 2256.31s | Raise your hands, put them up. 2256.31s - 2258.43s | I'm gonna give a critical thinking t-shirt 2258.43s - 2263.55s | to anybody who gets it right. 2263.55s - 2264.47s | It was number three, 2264.47s - 2265.91s | and the first person I see with number three 2265.91s - 2266.91s | is this guy right here. 2266.91s - 2268.19s | So I'll get you a t-shirt right after. 2268.19s - 2269.27s | Come up and get it. 2269.27s - 2271.27s | So it was bypass auth specifically 2271.27s - 2273.43s | for the cam and mic-related endpoints. 2273.43s - 2274.27s | That's how we got it. 2274.27s - 2276.27s | So let's go ahead and go down that path. 2277.23s - 2280.43s | Okay, this IoT device has a Android app, 2280.43s - 2282.91s | and you can use that Android app 2282.91s - 2286.43s | to video chat with this tabletop device, okay? 2286.43s - 2289.75s | And when you call yourself from the mobile app, 2289.75s - 2291.99s | there's an automatic answer on the IoT device 2291.99s - 2294.39s | just allowing you sort of pop into your house 2294.39s - 2297.31s | and say like, hey, cat, how's it going, right? 2297.31s - 2298.99s |


chunk_text:
I'm gonna give a critical thinking t-shirt 2258.43s - 2263.55s | to anybody who gets it right. 2263.55s - 2264.47s | It was number three, 2264.47s - 2265.91s | and the first person I see with number three 2265.91s - 2266.91s | is this guy right here. 2266.91s - 2268.19s | So I'll get you a t-shirt right after. 2268.19s - 2269.27s | Come up and get it. 2269.27s - 2271.27s | So it was bypass auth specifically 2271.27s - 2273.43s | for the cam and mic-related endpoints. 2273.43s - 2274.27s | That's how we got it. 2274.27s - 2276.27s | So let's go ahead and go down that path. 2277.23s - 2280.43s | Okay, this IoT device has a Android app, 2280.43s - 2282.91s | and you can use that Android app 2282.91s - 2286.43s | to video chat with this tabletop device, okay? 2286.43s - 2289.75s | And when you call yourself from the mobile app, 2289.75s - 2291.99s | there's an automatic answer on the IoT device 2291.99s - 2294.39s | just allowing you sort of pop into your house 2294.39s - 2297.31s | and say like, hey, cat, how's it going, right? 2297.31s - 2298.99s | So I thought that was really sus 2298.99s - 2301.95s | and was a prime feature for accomplishing the goal 2301.95s - 2303.15s | that I mentioned before. 2304.11s - 2306.39s | So I started, I took the mobile app 2306.39s - 2308.63s | and I threw it into JADx and decompiled it 2308.63s - 2310.51s | and got the source code. 2310.51s - 2313.15s | And then the never-ending story began, okay? 2313.15s - 2316.15s | So this app was kind of locked down. 2316.15s - 2319.07s | So the first thing was it had root detection 2319.07s - 2321.71s | and there was some weird stuff with Google Play. 2321.71s - 2324.75s | So essentially what I had to do was patch the APK 2324.75s - 2328.59s | to run Frida, and I did that with objection. 2328.59s - 2330.35s | And then I would overwrite 2330.35s - 2332.83s | all of the root detection on the app 2333.51s - 2334.83s | so that it would think that I'm not, 2334.83s - 2336.59s | I wasn't in a environment. 2336.59s - 2339.75s | And then, and there was some other emulator detection 2339.75s - 2340.67s | as well


chunk_text:
So I thought that was really sus 2298.99s - 2301.95s | and was a prime feature for accomplishing the goal 2301.95s - 2303.15s | that I mentioned before. 2304.11s - 2306.39s | So I started, I took the mobile app 2306.39s - 2308.63s | and I threw it into JADx and decompiled it 2308.63s - 2310.51s | and got the source code. 2310.51s - 2313.15s | And then the never-ending story began, okay? 2313.15s - 2316.15s | So this app was kind of locked down. 2316.15s - 2319.07s | So the first thing was it had root detection 2319.07s - 2321.71s | and there was some weird stuff with Google Play. 2321.71s - 2324.75s | So essentially what I had to do was patch the APK 2324.75s - 2328.59s | to run Frida, and I did that with objection. 2328.59s - 2330.35s | And then I would overwrite 2330.35s - 2332.83s | all of the root detection on the app 2333.51s - 2334.83s | so that it would think that I'm not, 2334.83s - 2336.59s | I wasn't in a environment. 2336.59s - 2339.75s | And then, and there was some other emulator detection 2339.75s - 2340.67s | as well in there. 2341.63s - 2345.43s | And so then the next one was bypassing TLS, 2345.43s - 2346.83s | pinning for HTTP. 2346.83s - 2348.19s | Of course, they had that in place. 2348.19s - 2349.87s | Most apps do nowadays. 2349.87s - 2353.31s | And so I had to come up 2353.31s - 2355.95s | and they had unfortunately a custom cert pinning solution. 2355.95s - 2358.67s | Most of the time, Joel, my boy here 2358.71s - 2363.23s | has a public TLS cert pinning script 2363.23s - 2365.19s | that will just unpin most of the apps, 2365.19s - 2366.39s | which is super helpful, 2366.39s - 2367.59s | but this one was not so easy. 2367.59s - 2368.83s | So I had to break, you know, 2368.83s - 2370.31s | go into the code and find exactly 2370.31s - 2373.27s | where the cert pinning was occurring 2373.27s - 2374.39s | and overwrite those functions 2374.39s - 2378.55s | with the JavaScript in the Frida code. 2378.55s - 2380.31s | I'm gonna check my time really quickly. 2380.31s - 2382.15s | Nope, my phone died, so I'm not. 2383.95s - 2385.35s | What you got? 2385.35s


chunk_text:
in there. 2341.63s - 2345.43s | And so then the next one was bypassing TLS, 2345.43s - 2346.83s | pinning for HTTP. 2346.83s - 2348.19s | Of course, they had that in place. 2348.19s - 2349.87s | Most apps do nowadays. 2349.87s - 2353.31s | And so I had to come up 2353.31s - 2355.95s | and they had unfortunately a custom cert pinning solution. 2355.95s - 2358.67s | Most of the time, Joel, my boy here 2358.71s - 2363.23s | has a public TLS cert pinning script 2363.23s - 2365.19s | that will just unpin most of the apps, 2365.19s - 2366.39s | which is super helpful, 2366.39s - 2367.59s | but this one was not so easy. 2367.59s - 2368.83s | So I had to break, you know, 2368.83s - 2370.31s | go into the code and find exactly 2370.31s - 2373.27s | where the cert pinning was occurring 2373.27s - 2374.39s | and overwrite those functions 2374.39s - 2378.55s | with the JavaScript in the Frida code. 2378.55s - 2380.31s | I'm gonna check my time really quickly. 2380.31s - 2382.15s | Nope, my phone died, so I'm not. 2383.95s - 2385.35s | What you got? 2385.35s - 2386.91s | 536, all right, thanks guys. 2386.91s - 2389.67s | I was running my hotspot off of it for the last workshop 2389.67s - 2391.83s | and then I looked down and it was dead. 2391.83s - 2393.39s | Okay, so at that point, cool, 2393.39s - 2395.31s | we bypassed cert pinning 2395.31s - 2398.91s | and we've got HTTP introspection, great. 2398.91s - 2401.67s | Now let's see how this whole calling thing works, right? 2401.67s - 2404.87s | Nope, because the calling thing is behind SIP 2404.87s - 2407.23s | and more specifically SIPs, 2407.23s - 2410.55s | which is the secure version of the SIP protocol. 2410.55s - 2411.39s | Okay, what is SIP? 2411.39s - 2413.11s | Well, let me tell you. 2413.11s - 2414.83s | The session mission protocol SIP 2414.83s - 2415.99s | is a signaling protocol 2415.99s - 2419.43s | to initiate, maintain and terminate real time sessions 2419.43s - 2421.15s | that involve video, voice, messaging 2421.15s - 2423.95s | and other communication applications and services. 2423.95s - 2427.19s | SIP is widely used for voice and video calls. 2427.19s - 2429.95s | Great, now I've got to deal


chunk_text:
- 2386.91s | 536, all right, thanks guys. 2386.91s - 2389.67s | I was running my hotspot off of it for the last workshop 2389.67s - 2391.83s | and then I looked down and it was dead. 2391.83s - 2393.39s | Okay, so at that point, cool, 2393.39s - 2395.31s | we bypassed cert pinning 2395.31s - 2398.91s | and we've got HTTP introspection, great. 2398.91s - 2401.67s | Now let's see how this whole calling thing works, right? 2401.67s - 2404.87s | Nope, because the calling thing is behind SIP 2404.87s - 2407.23s | and more specifically SIPs, 2407.23s - 2410.55s | which is the secure version of the SIP protocol. 2410.55s - 2411.39s | Okay, what is SIP? 2411.39s - 2413.11s | Well, let me tell you. 2413.11s - 2414.83s | The session mission protocol SIP 2414.83s - 2415.99s | is a signaling protocol 2415.99s - 2419.43s | to initiate, maintain and terminate real time sessions 2419.43s - 2421.15s | that involve video, voice, messaging 2421.15s - 2423.95s | and other communication applications and services. 2423.95s - 2427.19s | SIP is widely used for voice and video calls. 2427.19s - 2429.95s | Great, now I've got to deal with another protocol 2429.95s - 2432.27s | and it is also TLS wrapped. 2432.27s - 2435.19s | So a bunch of stuff kind of going on there. 2435.19s - 2436.23s | So I start working on that 2436.23s - 2439.31s | and find a custom cert pinning solution for SIPs 2439.31s - 2442.03s | and kind of am able to disable that. 2442.87s - 2446.31s | But Burp, while it is SIPs friendly, 2446.31s - 2449.59s | is not SIPs compatible 2449.59s - 2452.15s | and will break the application if you try to proxy it. 2452.15s - 2455.07s | So what I realized I needed is, 2455.07s - 2456.43s | and this is kind of how it looks right there, 2456.43s - 2460.23s | it'll issue the register requests with the SIP HTTP verb 2460.23s - 2461.95s | or the register HTTP verb 2461.95s - 2463.83s | that's associated with SIP protocol, 2463.83s - 2466.11s | but then it'll just break the response. 2466.99s - 2470.23s | So I had to find a transparent proxy 2470.23s - 2472.75s | and for this I used PolarProxy. 2472.75s - 2476.67s | It's a transparent TLS and SSL inspection proxy. 2476.67s -


chunk_text:
with another protocol 2429.95s - 2432.27s | and it is also TLS wrapped. 2432.27s - 2435.19s | So a bunch of stuff kind of going on there. 2435.19s - 2436.23s | So I start working on that 2436.23s - 2439.31s | and find a custom cert pinning solution for SIPs 2439.31s - 2442.03s | and kind of am able to disable that. 2442.87s - 2446.31s | But Burp, while it is SIPs friendly, 2446.31s - 2449.59s | is not SIPs compatible 2449.59s - 2452.15s | and will break the application if you try to proxy it. 2452.15s - 2455.07s | So what I realized I needed is, 2455.07s - 2456.43s | and this is kind of how it looks right there, 2456.43s - 2460.23s | it'll issue the register requests with the SIP HTTP verb 2460.23s - 2461.95s | or the register HTTP verb 2461.95s - 2463.83s | that's associated with SIP protocol, 2463.83s - 2466.11s | but then it'll just break the response. 2466.99s - 2470.23s | So I had to find a transparent proxy 2470.23s - 2472.75s | and for this I used PolarProxy. 2472.75s - 2476.67s | It's a transparent TLS and SSL inspection proxy. 2476.67s - 2478.95s | So I took that and I took the cert for that 2478.95s - 2481.03s | and I inserted it into the trust store 2481.03s - 2482.75s | for that specific mobile app 2482.75s - 2486.63s | and then I proxied all the stuff through PolarProxy 2486.63s - 2489.23s | and that would output a PCAP file 2489.23s - 2492.67s | and then finally we had access to reading 2492.67s - 2495.59s | what was going on and I was able to get introspection 2495.59s - 2497.83s | on SIPs without breaking the whole app. 2497.83s - 2501.75s | We are probably a week or two 2501.75s - 2503.63s | into looking at this target at this point 2503.63s - 2508.63s | with no leads, no potential loans, no gadgets, nothing. 2508.63s - 2510.55s | Just set up at this point, 2510.55s - 2512.23s | which is amazing to me as a bug hunter 2512.23s - 2514.75s | because normally I spend a lot of time 2514.75s - 2515.79s | looking to find gadgets 2515.79s - 2517.99s | and I feel sort of accomplished going along the way, 2517.99s - 2519.43s | but this was a big upfront investment


chunk_text:
2478.95s | So I took that and I took the cert for that 2478.95s - 2481.03s | and I inserted it into the trust store 2481.03s - 2482.75s | for that specific mobile app 2482.75s - 2486.63s | and then I proxied all the stuff through PolarProxy 2486.63s - 2489.23s | and that would output a PCAP file 2489.23s - 2492.67s | and then finally we had access to reading 2492.67s - 2495.59s | what was going on and I was able to get introspection 2495.59s - 2497.83s | on SIPs without breaking the whole app. 2497.83s - 2501.75s | We are probably a week or two 2501.75s - 2503.63s | into looking at this target at this point 2503.63s - 2508.63s | with no leads, no potential loans, no gadgets, nothing. 2508.63s - 2510.55s | Just set up at this point, 2510.55s - 2512.23s | which is amazing to me as a bug hunter 2512.23s - 2514.75s | because normally I spend a lot of time 2514.75s - 2515.79s | looking to find gadgets 2515.79s - 2517.99s | and I feel sort of accomplished going along the way, 2517.99s - 2519.43s | but this was a big upfront investment 2519.43s - 2522.07s | and I think people that do this sort of thing, 2522.07s - 2525.07s | mobile hacking or IoT device hacking 2525.07s - 2527.79s | have a lot more upfront, which is really tricky. 2527.79s - 2529.71s | That's something from a bug bounty perspective 2529.71s - 2531.55s | that the programs really need to help 2531.55s - 2533.27s | and minimize as much as possible 2533.27s - 2534.39s | if you want your mobile apps 2534.39s - 2537.43s | and your IoT devices and your desktop applications 2537.43s - 2541.79s | to get as much interest as your web applications do. 2543.11s - 2545.59s | Okay, so now we finally get to see how all this works. 2545.59s - 2547.43s | So let's talk through that flow a little bit. 2547.43s - 2550.91s | So step one is let's talk about getting a call, 2550.91s - 2551.75s | receiving a call. 2551.75s - 2553.11s | So you open up the app 2553.19s - 2555.55s | and it right away does a call 2555.55s - 2558.11s | to slash API slash get SIP auth token, okay, 2558.11s - 2561.43s | with your auth token associated with your


chunk_text:
2519.43s - 2522.07s | and I think people that do this sort of thing, 2522.07s - 2525.07s | mobile hacking or IoT device hacking 2525.07s - 2527.79s | have a lot more upfront, which is really tricky. 2527.79s - 2529.71s | That's something from a bug bounty perspective 2529.71s - 2531.55s | that the programs really need to help 2531.55s - 2533.27s | and minimize as much as possible 2533.27s - 2534.39s | if you want your mobile apps 2534.39s - 2537.43s | and your IoT devices and your desktop applications 2537.43s - 2541.79s | to get as much interest as your web applications do. 2543.11s - 2545.59s | Okay, so now we finally get to see how all this works. 2545.59s - 2547.43s | So let's talk through that flow a little bit. 2547.43s - 2550.91s | So step one is let's talk about getting a call, 2550.91s - 2551.75s | receiving a call. 2551.75s - 2553.11s | So you open up the app 2553.19s - 2555.55s | and it right away does a call 2555.55s - 2558.11s | to slash API slash get SIP auth token, okay, 2558.11s - 2561.43s | with your auth token associated with your account. 2561.43s - 2563.03s | And then it will return a token 2563.03s - 2564.59s | that sort of looks like this. 2564.59s - 2565.79s | It's sort of like a JWT, 2565.79s - 2569.79s | but it's not actually Base64 encoded 2569.79s - 2572.91s | and it has these various delimiters in them. 2572.91s - 2574.39s | The ones that's most interesting to us 2574.39s - 2576.27s | is the payload delimiter, okay? 2576.27s - 2577.75s | And in that payload delimiter, 2577.75s - 2582.75s | there is a from field and a to field 2583.15s - 2584.11s | and a bunch of other fields. 2584.11s - 2585.31s | But the ones that are most interesting 2585.31s - 2587.23s | are the from and to fields, okay? 2588.39s - 2589.79s | So then what would happen then 2589.79s - 2591.03s | is they would take that auth token 2591.03s - 2592.63s | that they got from the API request. 2592.63s - 2594.59s | They would put that as a header and SIP protocol, 2594.59s - 2596.51s | which is very similar to HTTP in a lot of ways. 2596.51s - 2598.65s | The concepts are very similar. 2598.65s -


chunk_text:
account. 2561.43s - 2563.03s | And then it will return a token 2563.03s - 2564.59s | that sort of looks like this. 2564.59s - 2565.79s | It's sort of like a JWT, 2565.79s - 2569.79s | but it's not actually Base64 encoded 2569.79s - 2572.91s | and it has these various delimiters in them. 2572.91s - 2574.39s | The ones that's most interesting to us 2574.39s - 2576.27s | is the payload delimiter, okay? 2576.27s - 2577.75s | And in that payload delimiter, 2577.75s - 2582.75s | there is a from field and a to field 2583.15s - 2584.11s | and a bunch of other fields. 2584.11s - 2585.31s | But the ones that are most interesting 2585.31s - 2587.23s | are the from and to fields, okay? 2588.39s - 2589.79s | So then what would happen then 2589.79s - 2591.03s | is they would take that auth token 2591.03s - 2592.63s | that they got from the API request. 2592.63s - 2594.59s | They would put that as a header and SIP protocol, 2594.59s - 2596.51s | which is very similar to HTTP in a lot of ways. 2596.51s - 2598.65s | The concepts are very similar. 2598.65s - 2599.95s | There's headers and stuff like that, 2599.95s - 2601.11s | and they look similar. 2601.11s - 2603.59s | And then it would put that auth token into the request 2603.59s - 2608.03s | with its own SIP level from to and contact headers. 2608.03s - 2609.55s | And that would essentially allow you 2609.55s - 2614.47s | to register the address of record 2614.47s - 2616.95s | that is in the to header, okay? 2616.95s - 2620.03s | And when it does this registration, 2620.03s - 2622.47s | it validates that the from and to fields 2622.47s - 2624.59s | from the auth token match the from and to fields 2624.59s - 2626.47s | in the SIP request. 2626.47s - 2628.63s | And then somehow through black magic, 2628.63s - 2631.77s | when somebody calls, your phone will ring. 2631.77s - 2632.61s | It's kind of nut. 2632.61s - 2634.83s | I don't know how all that transport stuff 2634.83s - 2636.13s | happens in the background. 2637.13s - 2638.11s | But I thought that was interesting. 2638.11s - 2640.51s | So I went ahead and moved along. 2640.51s - 2642.83s | And so now let's look at


chunk_text:
2599.95s | There's headers and stuff like that, 2599.95s - 2601.11s | and they look similar. 2601.11s - 2603.59s | And then it would put that auth token into the request 2603.59s - 2608.03s | with its own SIP level from to and contact headers. 2608.03s - 2609.55s | And that would essentially allow you 2609.55s - 2614.47s | to register the address of record 2614.47s - 2616.95s | that is in the to header, okay? 2616.95s - 2620.03s | And when it does this registration, 2620.03s - 2622.47s | it validates that the from and to fields 2622.47s - 2624.59s | from the auth token match the from and to fields 2624.59s - 2626.47s | in the SIP request. 2626.47s - 2628.63s | And then somehow through black magic, 2628.63s - 2631.77s | when somebody calls, your phone will ring. 2631.77s - 2632.61s | It's kind of nut. 2632.61s - 2634.83s | I don't know how all that transport stuff 2634.83s - 2636.13s | happens in the background. 2637.13s - 2638.11s | But I thought that was interesting. 2638.11s - 2640.51s | So I went ahead and moved along. 2640.51s - 2642.83s | And so now let's look at making a call, okay? 2642.83s - 2644.63s | So say we want to call somebody else. 2644.63s - 2648.23s | So we go ahead and send a request to slash API 2648.23s - 2653.11s | slash init call auth, and we provide as a post parameter 2653.11s - 2654.87s | to that a target, okay? 2654.87s - 2659.87s | And this target, sorry, this target will be reflected 2660.23s - 2662.59s | in the payload in the from field, 2662.59s - 2663.63s | or I'm sorry, the to fields, 2663.63s - 2665.03s | because we're making a call. 2666.11s - 2667.11s | And that was great. 2667.11s - 2671.63s | And then you use that in an invite SIP request 2671.63s - 2676.63s | with the from and to headers matching the values 2676.63s - 2677.83s | in the auth token. 2677.83s - 2680.83s | And then somehow through black magic, 2680.83s - 2682.67s | the other person's device starts ringing 2682.67s - 2684.87s | and you go through all these networks 2684.87s - 2686.15s | and you send the TCP data through 2686.15s - 2689.49s | or the UDP data depending on the flow. 2689.49s - 2690.33s | Okay.


chunk_text:
making a call, okay? 2642.83s - 2644.63s | So say we want to call somebody else. 2644.63s - 2648.23s | So we go ahead and send a request to slash API 2648.23s - 2653.11s | slash init call auth, and we provide as a post parameter 2653.11s - 2654.87s | to that a target, okay? 2654.87s - 2659.87s | And this target, sorry, this target will be reflected 2660.23s - 2662.59s | in the payload in the from field, 2662.59s - 2663.63s | or I'm sorry, the to fields, 2663.63s - 2665.03s | because we're making a call. 2666.11s - 2667.11s | And that was great. 2667.11s - 2671.63s | And then you use that in an invite SIP request 2671.63s - 2676.63s | with the from and to headers matching the values 2676.63s - 2677.83s | in the auth token. 2677.83s - 2680.83s | And then somehow through black magic, 2680.83s - 2682.67s | the other person's device starts ringing 2682.67s - 2684.87s | and you go through all these networks 2684.87s - 2686.15s | and you send the TCP data through 2686.15s - 2689.49s | or the UDP data depending on the flow. 2689.49s - 2690.33s | Okay. 2690.33s - 2692.75s | And once again, I'm gonna reiterate for that to happen, 2692.75s - 2695.23s | the from and to headers in the SIP request 2695.23s - 2698.61s | have to match the auth token, right? 2699.55s - 2704.11s | So let's talk a little bit about how we could fake a call. 2704.11s - 2709.11s | So in the API slash init call request or call auth request, 2709.35s - 2711.19s | the target that we would specify 2711.19s - 2714.11s | was actually accepted arbitrary data. 2714.11s - 2715.59s | And so what that would allow us to do 2715.59s - 2718.19s | is then inject arbitrary data into that auth token 2718.19s - 2719.95s | that is used at the SIP level. 2719.95s - 2722.19s | And so then what we proceeded to do 2722.19s - 2726.31s | was close the little delimiter there 2726.31s - 2728.97s | or put the person in for the two headers 2728.97s - 2730.27s | so it doesn't fail. 2730.27s - 2733.67s | Semi colon out and then provide another header. 2733.67s - 2734.51s | Five minutes. 2734.51s - 2735.35s | Oh, wow. 2735.35s - 2736.43s | Okay, I


chunk_text:
2690.33s - 2692.75s | And once again, I'm gonna reiterate for that to happen, 2692.75s - 2695.23s | the from and to headers in the SIP request 2695.23s - 2698.61s | have to match the auth token, right? 2699.55s - 2704.11s | So let's talk a little bit about how we could fake a call. 2704.11s - 2709.11s | So in the API slash init call request or call auth request, 2709.35s - 2711.19s | the target that we would specify 2711.19s - 2714.11s | was actually accepted arbitrary data. 2714.11s - 2715.59s | And so what that would allow us to do 2715.59s - 2718.19s | is then inject arbitrary data into that auth token 2718.19s - 2719.95s | that is used at the SIP level. 2719.95s - 2722.19s | And so then what we proceeded to do 2722.19s - 2726.31s | was close the little delimiter there 2726.31s - 2728.97s | or put the person in for the two headers 2728.97s - 2730.27s | so it doesn't fail. 2730.27s - 2733.67s | Semi colon out and then provide another header. 2733.67s - 2734.51s | Five minutes. 2734.51s - 2735.35s | Oh, wow. 2735.35s - 2736.43s | Okay, I gotta move. 2736.43s - 2741.03s | Then provide another from header as person two. 2742.03s - 2747.03s | So this would look like the call was coming from person two, 2747.15s - 2749.99s | the person receiving the call and to person two, 2749.99s - 2751.91s | which right, we discussed earlier 2751.91s - 2755.11s | was how you automatically auth into the device 2755.11s - 2756.73s | and check on your cat or whatever 2756.73s - 2758.51s | if you're calling from the mobile device. 2758.51s - 2761.27s | So we were able to smuggle in that from field 2761.27s - 2765.69s | and we would generate the token with request number one, 2765.69s - 2769.07s | put it into the invite SIP request. 2769.07s - 2773.33s | And since the from and to fields matched 2773.33s - 2777.83s | and the auth token validated those two things, 2777.83s - 2780.11s | the call would happen and it would auto answer. 2780.11s - 2783.91s | However, there was no contact field in the auth token 2783.91s - 2785.03s | so that wasn't validated. 2785.03s - 2787.17s | And the contact thing is actually where, 2787.17s - 2788.87s | the


chunk_text:
gotta move. 2736.43s - 2741.03s | Then provide another from header as person two. 2742.03s - 2747.03s | So this would look like the call was coming from person two, 2747.15s - 2749.99s | the person receiving the call and to person two, 2749.99s - 2751.91s | which right, we discussed earlier 2751.91s - 2755.11s | was how you automatically auth into the device 2755.11s - 2756.73s | and check on your cat or whatever 2756.73s - 2758.51s | if you're calling from the mobile device. 2758.51s - 2761.27s | So we were able to smuggle in that from field 2761.27s - 2765.69s | and we would generate the token with request number one, 2765.69s - 2769.07s | put it into the invite SIP request. 2769.07s - 2773.33s | And since the from and to fields matched 2773.33s - 2777.83s | and the auth token validated those two things, 2777.83s - 2780.11s | the call would happen and it would auto answer. 2780.11s - 2783.91s | However, there was no contact field in the auth token 2783.91s - 2785.03s | so that wasn't validated. 2785.03s - 2787.17s | And the contact thing is actually where, 2787.17s - 2788.87s | the contact header is where the call 2788.87s - 2790.71s | gets actually routed to. 2790.71s - 2792.41s | So then you could see it on your device 2792.41s - 2795.79s | and you would be looking through that person's IoT device, 2796.67s - 2798.97s | which was nuts and I cannot believe it worked. 2800.53s - 2801.65s | But wait, you might ask, 2801.65s - 2805.43s | what is up with the from header there, right? 2805.43s - 2808.95s | Well, the from header was an interesting situation 2808.95s - 2812.15s | because as much as we thought we had source code, 2812.15s - 2814.55s | there was one more challenge that awaited for us 2814.55s - 2818.11s | at that point, which was, we're using PolarProxy, 2818.11s - 2822.23s | so how do we do repeater or intercept on these things 2822.23s - 2824.51s | to modify the requests as they were going through? 2824.51s - 2829.51s | Well, the answer to that is a shit ton of Frida calls 2829.81s - 2832.71s | to overwrite and actually use the mobile client 2832.71s - 2836.43s | as our own proxy to send stuff through, 2836.43s - 2838.51s | which


chunk_text:
contact header is where the call 2788.87s - 2790.71s | gets actually routed to. 2790.71s - 2792.41s | So then you could see it on your device 2792.41s - 2795.79s | and you would be looking through that person's IoT device, 2796.67s - 2798.97s | which was nuts and I cannot believe it worked. 2800.53s - 2801.65s | But wait, you might ask, 2801.65s - 2805.43s | what is up with the from header there, right? 2805.43s - 2808.95s | Well, the from header was an interesting situation 2808.95s - 2812.15s | because as much as we thought we had source code, 2812.15s - 2814.55s | there was one more challenge that awaited for us 2814.55s - 2818.11s | at that point, which was, we're using PolarProxy, 2818.11s - 2822.23s | so how do we do repeater or intercept on these things 2822.23s - 2824.51s | to modify the requests as they were going through? 2824.51s - 2829.51s | Well, the answer to that is a shit ton of Frida calls 2829.81s - 2832.71s | to overwrite and actually use the mobile client 2832.71s - 2836.43s | as our own proxy to send stuff through, 2836.43s - 2838.51s | which was really painful. 2838.51s - 2841.27s | And unfortunately, the section that set that from header 2841.27s - 2844.11s | was automatically done inside of a .so file, 2844.11s - 2847.03s | a binary file within the app. 2847.99s - 2850.43s | So it couldn't be hooked very easily with Frida 2850.43s - 2851.51s | because of the situation. 2851.51s - 2854.17s | So I was kind of lost at this point, what do I do? 2855.05s - 2857.31s | And I was talking to another awesome hacker 2857.31s - 2860.35s | named Spacer Coon and he advised, 2860.39s - 2863.17s | hey man, why don't you just patch the binary? 2864.07s - 2866.35s | And I was like, that's scary as hell. 2866.35s - 2867.67s | I don't know how to do that. 2867.67s - 2871.01s | And then he realized, or he told me that it's just a string. 2871.01s - 2873.59s | So just search the binary for that string 2873.59s - 2875.51s | and replace the O with an A 2875.51s - 2877.49s | and it will automatically put in a different header. 2877.49s - 2880.19s | So I did that in a hex editor and


chunk_text:
was really painful. 2838.51s - 2841.27s | And unfortunately, the section that set that from header 2841.27s - 2844.11s | was automatically done inside of a .so file, 2844.11s - 2847.03s | a binary file within the app. 2847.99s - 2850.43s | So it couldn't be hooked very easily with Frida 2850.43s - 2851.51s | because of the situation. 2851.51s - 2854.17s | So I was kind of lost at this point, what do I do? 2855.05s - 2857.31s | And I was talking to another awesome hacker 2857.31s - 2860.35s | named Spacer Coon and he advised, 2860.39s - 2863.17s | hey man, why don't you just patch the binary? 2864.07s - 2866.35s | And I was like, that's scary as hell. 2866.35s - 2867.67s | I don't know how to do that. 2867.67s - 2871.01s | And then he realized, or he told me that it's just a string. 2871.01s - 2873.59s | So just search the binary for that string 2873.59s - 2875.51s | and replace the O with an A 2875.51s - 2877.49s | and it will automatically put in a different header. 2877.49s - 2880.19s | So I did that in a hex editor and it worked. 2880.19s - 2882.77s | And then I was able to add another from header 2882.77s - 2886.11s | via the Java bindings, which matched the auth token 2886.11s - 2888.07s | and allowed me to bypass auth 2888.07s - 2891.47s | and peer through anybody's desktop IoT device. 2892.87s - 2897.23s | Okay, and that was a 20 to 50K bug. 2897.23s - 2900.47s | And takeaways for that were set a goal 2900.47s - 2901.59s | and go after it really hard 2901.59s - 2904.51s | because some of this crazy stuff that they talk about 2904.51s - 2907.19s | in the horror stories is really possible. 2907.19s - 2911.05s | And I've become a believer in that since this happened. 2911.05s - 2913.35s | Last bug is really quick 2913.35s - 2916.39s | and I should be able to go through pretty quickly 2916.39s - 2918.83s | because it's in the same stack. 2918.83s - 2922.67s | This was a bug where you could hijack calls 2922.67s - 2923.99s | going to other people. 2923.99s - 2927.95s | And the way that you did that was using that token, 2927.95s - 2929.67s | the call auth


chunk_text:
it worked. 2880.19s - 2882.77s | And then I was able to add another from header 2882.77s - 2886.11s | via the Java bindings, which matched the auth token 2886.11s - 2888.07s | and allowed me to bypass auth 2888.07s - 2891.47s | and peer through anybody's desktop IoT device. 2892.87s - 2897.23s | Okay, and that was a 20 to 50K bug. 2897.23s - 2900.47s | And takeaways for that were set a goal 2900.47s - 2901.59s | and go after it really hard 2901.59s - 2904.51s | because some of this crazy stuff that they talk about 2904.51s - 2907.19s | in the horror stories is really possible. 2907.19s - 2911.05s | And I've become a believer in that since this happened. 2911.05s - 2913.35s | Last bug is really quick 2913.35s - 2916.39s | and I should be able to go through pretty quickly 2916.39s - 2918.83s | because it's in the same stack. 2918.83s - 2922.67s | This was a bug where you could hijack calls 2922.67s - 2923.99s | going to other people. 2923.99s - 2927.95s | And the way that you did that was using that token, 2927.95s - 2929.67s | the call auth token. 2930.75s - 2933.11s | So let me, yeah. 2933.11s - 2934.55s | So you can see here, right? 2934.55s - 2937.07s | That the register token, as a reminder, 2937.07s - 2939.21s | the register token where you register your name 2939.21s - 2941.47s | has a to and from field that match. 2941.47s - 2944.67s | The call token has a from and to field 2944.67s - 2945.99s | that are different from each other 2946.55s - 2948.55s | because you're calling somebody else, right? 2948.55s - 2951.85s | When we look at the register SIP request that occurs, 2951.85s - 2954.27s | there's this caveat in the from section, 2954.27s - 2956.61s | which essentially allows for this feature 2956.61s - 2958.07s | called third-party registration 2958.07s - 2960.67s | where you are registering for somebody else. 2960.67s - 2962.79s | Now, when we use the init call, 2964.47s - 2967.17s | HTTP request to generate the token, 2967.17s - 2969.55s | we can specify a different from 2969.55s - 2972.79s | or a different to header in that auth token, right? 2972.79s - 2975.01s | Because that's the person we're calling to. 2975.01s - 2976.53s |


chunk_text:
token. 2930.75s - 2933.11s | So let me, yeah. 2933.11s - 2934.55s | So you can see here, right? 2934.55s - 2937.07s | That the register token, as a reminder, 2937.07s - 2939.21s | the register token where you register your name 2939.21s - 2941.47s | has a to and from field that match. 2941.47s - 2944.67s | The call token has a from and to field 2944.67s - 2945.99s | that are different from each other 2946.55s - 2948.55s | because you're calling somebody else, right? 2948.55s - 2951.85s | When we look at the register SIP request that occurs, 2951.85s - 2954.27s | there's this caveat in the from section, 2954.27s - 2956.61s | which essentially allows for this feature 2956.61s - 2958.07s | called third-party registration 2958.07s - 2960.67s | where you are registering for somebody else. 2960.67s - 2962.79s | Now, when we use the init call, 2964.47s - 2967.17s | HTTP request to generate the token, 2967.17s - 2969.55s | we can specify a different from 2969.55s - 2972.79s | or a different to header in that auth token, right? 2972.79s - 2975.01s | Because that's the person we're calling to. 2975.01s - 2976.53s | So then we could take that token, 2976.53s - 2978.41s | which has the same signature, 2978.41s - 2980.79s | and apply it to the register header. 2980.79s - 2982.31s | And it will have a from header 2982.31s - 2983.97s | that is different from the to header. 2983.97s - 2987.31s | And the to header can be any one that we specify. 2987.31s - 2989.49s | So then we could register, 2989.49s - 2992.41s | essentially do a third-party register for any other user 2992.41s - 2995.17s | and map their address of record, right? 2995.17s - 2996.89s | The thing that routes the call to them 2996.89s - 3000.05s | to our contact location. 3000.05s - 3002.93s | And then when somebody calls that user, 3002.97s - 3004.61s | our device would start ringing. 3005.61s - 3008.37s | And that one was another 20 to 50K, 3008.37s - 3010.73s | critical, critical, critical on a public program. 3010.73s - 3014.03s | And takeaways are pretty much the same. 3014.03s - 3016.17s | But don't be afraid of new protocols. 3016.17s - 3018.23s | And that is one of the biggest takeaways I've found 3018.23s - 3020.13s |


chunk_text:
So then we could take that token, 2976.53s - 2978.41s | which has the same signature, 2978.41s - 2980.79s | and apply it to the register header. 2980.79s - 2982.31s | And it will have a from header 2982.31s - 2983.97s | that is different from the to header. 2983.97s - 2987.31s | And the to header can be any one that we specify. 2987.31s - 2989.49s | So then we could register, 2989.49s - 2992.41s | essentially do a third-party register for any other user 2992.41s - 2995.17s | and map their address of record, right? 2995.17s - 2996.89s | The thing that routes the call to them 2996.89s - 3000.05s | to our contact location. 3000.05s - 3002.93s | And then when somebody calls that user, 3002.97s - 3004.61s | our device would start ringing. 3005.61s - 3008.37s | And that one was another 20 to 50K, 3008.37s - 3010.73s | critical, critical, critical on a public program. 3010.73s - 3014.03s | And takeaways are pretty much the same. 3014.03s - 3016.17s | But don't be afraid of new protocols. 3016.17s - 3018.23s | And that is one of the biggest takeaways I've found 3018.23s - 3020.13s | in my many, many years of bug bounty. 3020.97s - 3022.29s | All right, that was the recap. 3022.29s - 3024.05s | 11 bugs, all paid as critical. 3024.05s - 3028.51s | The grand total for this was somewhere between 225 and 400K 3028.51s - 3030.21s | for all those bugs. 3030.21s - 3031.33s | And that's it. 3031.33s - 3032.17s | Thank you guys.


chunk_text:
in my many, many years of bug bounty. 3020.97s - 3022.29s | All right, that was the recap. 3022.29s - 3024.05s | 11 bugs, all paid as critical. 3024.05s - 3028.51s | The grand total for this was somewhere between 225 and 400K 3028.51s - 3030.21s | for all those bugs. 3030.21s - 3031.33s | And that's it. 3031.33s - 3032.17s | Thank you guys.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=8BC0oHu5QGQ", "title": "DEF CON 32 - Bridging Space and Medicine - Fernando De La Pe\u00f1a Llaca", "description": "In the vast expanse of space, holographic teleportation\u2014a futuristic blend of holography and teleportation\u2014has revolutionized astronaut communication. Imagine beaming a lifelike 3D image of yourself across light-years. Now, consider its potential in medicine: remote surgeries, expert consultations, and training\u2014where distance dissolves, and expertise transcends borders. Buckle up; holoconnect is our cosmic ticket to healing!", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2132, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 8.69s - 13.69s | This text was transcribed using whisper model: large-v2 a device called the HoloLens, which essentially is a mixed reality computer. 13.69s - 21.69s | So, if you are wearing the huge headset back in the day, you can interact with the people, 21.69s - 25.69s | but also you can interact with holograms, and the holograms can interact with you. 25.69s - 32.69s | So, one of the NASA surgeons in Houston was assisting one of the astronauts. 32.69s - 35.69s | Her name is Samantha Cristoforetti, as you can see over there. 35.69s - 43.69s | In her view, she could see holograms about where to make the incisions, what to measure. 43.69s - 51.69s | She was able to see x-rays and information to help her to perform a medical procedure. 51.69s - 58.69s | It was a huge success. We performed this procedure with no issues at all. 58.69s - 67.48s | This mission was led by the NASA surgeon and also Air Force General Dr. George Smith. 67.48s - 72.48s | And after that, he came to me and said, hey, Fernando, I really like this. 72.48s - 78.48s | It was cool. What else can we do? And that's Dr. George Smith and I. 78.48s - 86.48s | And I said, well, I heard that Microsoft is developing something called holographic teleportation. 86.48s - 88.48s | And he told me, okay, what's holographic teleportation? 88.48s - 96.48s | I said, okay, they have this studio. They have 109 cameras with a laser, with a LiDAR. 96.48s - 104.48s | You come into the studio, they capture you, and a couple of weeks later, they deliver you a file, which is huge. 104.48s - 109.48s | You put it in the HoloLens, and you can see a hologram of yourself. 109.48s - 112.48s | It's not live, but


chunk_text:
measure. 43.69s - 51.69s | She was able to see x-rays and information to help her to perform a medical procedure. 51.69s - 58.69s | It was a huge success. We performed this procedure with no issues at all. 58.69s - 67.48s | This mission was led by the NASA surgeon and also Air Force General Dr. George Smith. 67.48s - 72.48s | And after that, he came to me and said, hey, Fernando, I really like this. 72.48s - 78.48s | It was cool. What else can we do? And that's Dr. George Smith and I. 78.48s - 86.48s | And I said, well, I heard that Microsoft is developing something called holographic teleportation. 86.48s - 88.48s | And he told me, okay, what's holographic teleportation? 88.48s - 96.48s | I said, okay, they have this studio. They have 109 cameras with a laser, with a LiDAR. 96.48s - 104.48s | You come into the studio, they capture you, and a couple of weeks later, they deliver you a file, which is huge. 104.48s - 109.48s | You put it in the HoloLens, and you can see a hologram of yourself. 109.48s - 112.48s | It's not live, but it's a hologram of yourself. 112.48s - 121.48s | And he told me, hey, I really like this. I want you to make this happen on a station, and I want you to make it live. 121.48s - 126.48s | And I said, okay, we can do that. That was 2018. 126.48s - 133.48s | And to give you an idea about what is holographic teleportation, the best analogy for me is 3D printing. 133.48s - 141.48s | With a 3D printer, you have thousands of layers of material until you have a solid object. 141.48s - 147.48s | With holoportation, it is the same. We call it actually volumetric video. 147.48s - 153.48s | You have thousands of layers of video until you have a solid hologram of someone. 153.48s - 161.48s | You can interact with a hologram. You can feel the hologram with something we call haptics, and they can see you. 161.48s - 165.48s | Why this is better compared with FaceTime or any video conference? 165.48s - 168.48s | Well, you have six axes of freedom. 168.48s - 180.48s | So going back to my story, Joe told me like, okay, let's put it on


chunk_text:
it's a hologram of yourself. 112.48s - 121.48s | And he told me, hey, I really like this. I want you to make this happen on a station, and I want you to make it live. 121.48s - 126.48s | And I said, okay, we can do that. That was 2018. 126.48s - 133.48s | And to give you an idea about what is holographic teleportation, the best analogy for me is 3D printing. 133.48s - 141.48s | With a 3D printer, you have thousands of layers of material until you have a solid object. 141.48s - 147.48s | With holoportation, it is the same. We call it actually volumetric video. 147.48s - 153.48s | You have thousands of layers of video until you have a solid hologram of someone. 153.48s - 161.48s | You can interact with a hologram. You can feel the hologram with something we call haptics, and they can see you. 161.48s - 165.48s | Why this is better compared with FaceTime or any video conference? 165.48s - 168.48s | Well, you have six axes of freedom. 168.48s - 180.48s | So going back to my story, Joe told me like, okay, let's put it on a station, but we have multiple limitations. 180.48s - 186.48s | One, here on Earth, Microsoft has a studio with 109 cameras. 186.48s - 188.48s | On a station, we only have one. 188.48s - 196.48s | Second, here on Earth, it was recorded and processed using very powerful gaming computers. 196.48s - 201.48s | On a station, it needs to be live and with very old computers. 201.48s - 207.48s | Believe it or not, on the Space Station, we have something called SSE computers, Space Station computers. 207.48s - 218.48s | And those are very old computers because those computers don't receive big damage from radiation or atomic oxygen or conditions in space. 218.48s - 224.48s | Then the other challenge was we don't have a constant communication. 224.48s - 228.48s | Here on Earth, we have a satellite. We have an antenna. 228.48s - 234.48s | We just aim to any of the satellites, and we have communication. 234.48s - 244.48s | On a station, the station is moving so fast, every 90 minutes, it completes an orbit on Earth. 244.48s - 249.48s | So what happened, we have an antenna that aims down instead of up.


chunk_text:
a station, but we have multiple limitations. 180.48s - 186.48s | One, here on Earth, Microsoft has a studio with 109 cameras. 186.48s - 188.48s | On a station, we only have one. 188.48s - 196.48s | Second, here on Earth, it was recorded and processed using very powerful gaming computers. 196.48s - 201.48s | On a station, it needs to be live and with very old computers. 201.48s - 207.48s | Believe it or not, on the Space Station, we have something called SSE computers, Space Station computers. 207.48s - 218.48s | And those are very old computers because those computers don't receive big damage from radiation or atomic oxygen or conditions in space. 218.48s - 224.48s | Then the other challenge was we don't have a constant communication. 224.48s - 228.48s | Here on Earth, we have a satellite. We have an antenna. 228.48s - 234.48s | We just aim to any of the satellites, and we have communication. 234.48s - 244.48s | On a station, the station is moving so fast, every 90 minutes, it completes an orbit on Earth. 244.48s - 249.48s | So what happened, we have an antenna that aims down instead of up. 249.48s - 260.48s | But because the station is moving so fast, we need to adjust that antenna, like maybe every 15, every 20 minutes, and aim to another satellite. 260.48s - 263.48s | So in those gaps, we don't have any communication. 263.48s - 265.48s | We call it satellite handovers. 265.48s - 268.48s | Then we have multiple firewalls. 268.48s - 271.48s | And then the biggest limitation is bandwidth. 271.48s - 278.48s | On a station, we have something called Skynet, which is not related with the movie. 278.48s - 282.48s | We have something called CloudNet, which is our internet on a station. 282.48s - 285.48s | But we have 20 megabits per second. 285.48s - 293.48s | It's super slow, and we use 20 megabits per second for everything, to run the station, trying to dock spacecrafts and everything. 293.48s - 300.48s | So when we came with the idea of using holoportation, they only gave us 5 megabits per second. 301.48s - 312.48s | And to give you a better idea how a hologram looks like, that picture is one of my employees in Alabama holoporting next to me in Texas. 312.48s - 314.48s


chunk_text:
249.48s - 260.48s | But because the station is moving so fast, we need to adjust that antenna, like maybe every 15, every 20 minutes, and aim to another satellite. 260.48s - 263.48s | So in those gaps, we don't have any communication. 263.48s - 265.48s | We call it satellite handovers. 265.48s - 268.48s | Then we have multiple firewalls. 268.48s - 271.48s | And then the biggest limitation is bandwidth. 271.48s - 278.48s | On a station, we have something called Skynet, which is not related with the movie. 278.48s - 282.48s | We have something called CloudNet, which is our internet on a station. 282.48s - 285.48s | But we have 20 megabits per second. 285.48s - 293.48s | It's super slow, and we use 20 megabits per second for everything, to run the station, trying to dock spacecrafts and everything. 293.48s - 300.48s | So when we came with the idea of using holoportation, they only gave us 5 megabits per second. 301.48s - 312.48s | And to give you a better idea how a hologram looks like, that picture is one of my employees in Alabama holoporting next to me in Texas. 312.48s - 314.48s | So really, you can see the person. 314.48s - 323.48s | You can see if I have a camera, and I'm aiming to this auditorium, I can beam you up and make you holograms everywhere. 323.48s - 325.48s | And I have a very cool video. 325.48s - 332.77s | Hopefully, it will play here about telemedicine. 333.77s - 334.77s | Yes. 334.77s - 342.18s | Let me fast-forward. 350.18s - 355.18s | Though neither Nathan nor I have any medical experience or expertise, 355.18s - 363.18s | we'd like to show you a few steps from the stroke evaluation test, as well as a few physical therapy exercises, 363.18s - 368.18s | to give you a sense for the power of this software, as well as some potential use cases. 368.18s - 370.18s | So let's get started. 370.18s - 375.73s | Nathan, thanks for joining us today. 375.73s - 379.73s | I'd like to go through a few steps of a stroke evaluation, 379.73s - 384.73s | and then we'll do a couple of physical therapy-type exercises, 384.73s - 389.73s | just to give our viewers an illustration of some of the power of this. 389.73s -


chunk_text:
| So really, you can see the person. 314.48s - 323.48s | You can see if I have a camera, and I'm aiming to this auditorium, I can beam you up and make you holograms everywhere. 323.48s - 325.48s | And I have a very cool video. 325.48s - 332.77s | Hopefully, it will play here about telemedicine. 333.77s - 334.77s | Yes. 334.77s - 342.18s | Let me fast-forward. 350.18s - 355.18s | Though neither Nathan nor I have any medical experience or expertise, 355.18s - 363.18s | we'd like to show you a few steps from the stroke evaluation test, as well as a few physical therapy exercises, 363.18s - 368.18s | to give you a sense for the power of this software, as well as some potential use cases. 368.18s - 370.18s | So let's get started. 370.18s - 375.73s | Nathan, thanks for joining us today. 375.73s - 379.73s | I'd like to go through a few steps of a stroke evaluation, 379.73s - 384.73s | and then we'll do a couple of physical therapy-type exercises, 384.73s - 389.73s | just to give our viewers an illustration of some of the power of this. 389.73s - 392.73s | So let's start with the stroke evaluation. 392.73s - 394.73s | So that's a stroke evaluation. 394.73s - 396.73s | I don't know if you can hear it clearly. 396.73s - 401.73s | But in front of my colleague, Mark, is Nathan Rehm in Alabama. 401.73s - 404.73s | So for Mark, Nathan is right there. 404.73s - 407.73s | And from Nathan, Mark is right there. 407.73s - 409.73s | We are right here, person to person. 418.73s - 421.73s | So he's asking to raise the hands and all the procedure. 421.73s - 424.73s | And I'm going to move forward to the next slide. 424.73s - 430.73s | But that will give you some idea about this technology. 430.73s - 440.96s | So going back to using this technology on a station, on the space station, 440.96s - 447.96s | during 2019, as you know, we had COVID and we had isolation. 447.96s - 452.96s | And NASA was very sensitive about pushing the gas for technologies 452.96s - 456.96s | that will help us in isolation situations 456.96s - 460.96s | and also to literally bridge medicine 460.96s - 463.96s | and trying to


chunk_text:
392.73s | So let's start with the stroke evaluation. 392.73s - 394.73s | So that's a stroke evaluation. 394.73s - 396.73s | I don't know if you can hear it clearly. 396.73s - 401.73s | But in front of my colleague, Mark, is Nathan Rehm in Alabama. 401.73s - 404.73s | So for Mark, Nathan is right there. 404.73s - 407.73s | And from Nathan, Mark is right there. 407.73s - 409.73s | We are right here, person to person. 418.73s - 421.73s | So he's asking to raise the hands and all the procedure. 421.73s - 424.73s | And I'm going to move forward to the next slide. 424.73s - 430.73s | But that will give you some idea about this technology. 430.73s - 440.96s | So going back to using this technology on a station, on the space station, 440.96s - 447.96s | during 2019, as you know, we had COVID and we had isolation. 447.96s - 452.96s | And NASA was very sensitive about pushing the gas for technologies 452.96s - 456.96s | that will help us in isolation situations 456.96s - 460.96s | and also to literally bridge medicine 460.96s - 463.96s | and trying to bring the best physicians to the station 463.96s - 465.96s | and perform medical evaluations. 465.96s - 467.96s | So we did it. 467.96s - 471.96s | Dr. George Smith was the first human holoporter to the space station. 471.96s - 473.96s | The second one was me. 473.96s - 478.96s | And he performed a couple of medical evaluations to some of the astronauts. 478.96s - 482.96s | That was a one-way holoportation. 482.96s - 484.96s | So just to give you an idea, 484.96s - 489.96s | that's Dr. George Smith at NASA's Mission Control, Building 30, 489.96s - 491.96s | interacting with one of the astronauts. 491.96s - 496.96s | So for the astronaut, for the crew member, Dr. Smith was there. 496.96s - 500.96s | But for Dr. Smith, he was looking to a computer screen. 500.96s - 505.96s | He was watching a computer screen just to try to interact with the astronaut. 505.96s - 507.96s | It was very successful. 507.96s - 514.96s | NASA sent a press release, which became viral in at least 15 different languages. 514.96s - 520.96s | And one of the reasons is Dr. Smith is a huge fan


chunk_text:
bring the best physicians to the station 463.96s - 465.96s | and perform medical evaluations. 465.96s - 467.96s | So we did it. 467.96s - 471.96s | Dr. George Smith was the first human holoporter to the space station. 471.96s - 473.96s | The second one was me. 473.96s - 478.96s | And he performed a couple of medical evaluations to some of the astronauts. 478.96s - 482.96s | That was a one-way holoportation. 482.96s - 484.96s | So just to give you an idea, 484.96s - 489.96s | that's Dr. George Smith at NASA's Mission Control, Building 30, 489.96s - 491.96s | interacting with one of the astronauts. 491.96s - 496.96s | So for the astronaut, for the crew member, Dr. Smith was there. 496.96s - 500.96s | But for Dr. Smith, he was looking to a computer screen. 500.96s - 505.96s | He was watching a computer screen just to try to interact with the astronaut. 505.96s - 507.96s | It was very successful. 507.96s - 514.96s | NASA sent a press release, which became viral in at least 15 different languages. 514.96s - 520.96s | And one of the reasons is Dr. Smith is a huge fan of Star Trek, 520.96s - 524.96s | so he made Live Long and Prosper from Spock. 524.96s - 527.96s | So let me tell you a story. 527.96s - 531.96s | His wife is from Japan, from a very remote island in Japan. 531.96s - 535.96s | According to Dr. Smith, they don't have any television. 535.96s - 539.96s | They only have radio, which was cool. 539.96s - 543.96s | And then he was on vacation in Japan. 543.96s - 545.96s | His brother-in-law came running and said, 545.96s - 547.96s | Hey, Joe, Joe, guess what? 547.96s - 550.96s | NASA invented some technology called holoportation, 550.96s - 556.96s | and they sent a NASA surgeon to the space station as a hologram, blah, blah, blah. 556.96s - 559.96s | And Joe asked him, Hey, how do you know that? 559.96s - 561.96s | And he said, Well, it was on the radio. 561.96s - 564.96s | He said, On the radio here in this remote island of Japan? 564.96s - 565.96s | And he said, Yes. 565.96s - 569.96s | So what happened then, he called me and said, Hey, Fernando, guess what? 569.96s - 571.96s |


chunk_text:
of Star Trek, 520.96s - 524.96s | so he made Live Long and Prosper from Spock. 524.96s - 527.96s | So let me tell you a story. 527.96s - 531.96s | His wife is from Japan, from a very remote island in Japan. 531.96s - 535.96s | According to Dr. Smith, they don't have any television. 535.96s - 539.96s | They only have radio, which was cool. 539.96s - 543.96s | And then he was on vacation in Japan. 543.96s - 545.96s | His brother-in-law came running and said, 545.96s - 547.96s | Hey, Joe, Joe, guess what? 547.96s - 550.96s | NASA invented some technology called holoportation, 550.96s - 556.96s | and they sent a NASA surgeon to the space station as a hologram, blah, blah, blah. 556.96s - 559.96s | And Joe asked him, Hey, how do you know that? 559.96s - 561.96s | And he said, Well, it was on the radio. 561.96s - 564.96s | He said, On the radio here in this remote island of Japan? 564.96s - 565.96s | And he said, Yes. 565.96s - 569.96s | So what happened then, he called me and said, Hey, Fernando, guess what? 569.96s - 571.96s | The news are here in Japan. 571.96s - 573.96s | I said, No, Joe, the news are everywhere. 573.96s - 577.96s | This was one of the most viral press releases from NASA. 577.96s - 578.96s | So NASA got excited. 578.96s - 580.96s | I got excited. 580.96s - 584.96s | And then that happened in October 2019. 584.96s - 587.96s | We continue with the holoportations. 587.96s - 594.96s | And then December 2019, NASA called me and I was like, Okay, I'm going to receive an award. 594.96s - 595.96s | That's pretty cool. 595.96s - 597.96s | They're going to give me a prize. 597.96s - 602.96s | They told me, Hey, we need to move forward and have a two-way holoportation. 602.96s - 607.96s | So that means like the astronaut on a station will be beamed down as a hologram 607.96s - 611.96s | while someone at mission control will be beamed up as a hologram 611.96s - 613.96s | and they can interact with each other. 613.96s - 614.96s | And I said, Okay, that's cool. 614.96s - 616.96s | And I was just taking notes. 616.96s - 621.96s | I said, Okay,


chunk_text:
The news are here in Japan. 571.96s - 573.96s | I said, No, Joe, the news are everywhere. 573.96s - 577.96s | This was one of the most viral press releases from NASA. 577.96s - 578.96s | So NASA got excited. 578.96s - 580.96s | I got excited. 580.96s - 584.96s | And then that happened in October 2019. 584.96s - 587.96s | We continue with the holoportations. 587.96s - 594.96s | And then December 2019, NASA called me and I was like, Okay, I'm going to receive an award. 594.96s - 595.96s | That's pretty cool. 595.96s - 597.96s | They're going to give me a prize. 597.96s - 602.96s | They told me, Hey, we need to move forward and have a two-way holoportation. 602.96s - 607.96s | So that means like the astronaut on a station will be beamed down as a hologram 607.96s - 611.96s | while someone at mission control will be beamed up as a hologram 611.96s - 613.96s | and they can interact with each other. 613.96s - 614.96s | And I said, Okay, that's cool. 614.96s - 616.96s | And I was just taking notes. 616.96s - 621.96s | I said, Okay, it's going to be the first mission with private citizens. 621.96s - 624.96s | The name of the company is Axiom. 624.96s - 626.96s | It's Axiom One Mission. 626.96s - 628.96s | It's going to be the first time that this happened. 628.96s - 629.96s | I was just taking notes. 629.96s - 632.96s | I said, It's going to happen in April. 632.96s - 637.96s | And most of the projects with the government take like four to five years at least. 637.96s - 639.96s | So I was like, That was 2019. 639.96s - 641.96s | And I asked, Okay, that's pretty cool. 641.96s - 644.96s | So you're talking April 2024, 2025. 644.96s - 647.96s | And they told me, No, it's April 2020. 647.96s - 649.96s | So you need to move forward. 649.96s - 651.96s | You need to make this fast. 651.96s - 657.96s | You need to send all the equipment to the station because we want this to happen. 657.96s - 664.96s | And they said the guy managing this is a billionaire from Montreal, from Canada, 664.96s - 665.96s | and he wants to make this happen. 665.96s - 670.96s


chunk_text:
it's going to be the first mission with private citizens. 621.96s - 624.96s | The name of the company is Axiom. 624.96s - 626.96s | It's Axiom One Mission. 626.96s - 628.96s | It's going to be the first time that this happened. 628.96s - 629.96s | I was just taking notes. 629.96s - 632.96s | I said, It's going to happen in April. 632.96s - 637.96s | And most of the projects with the government take like four to five years at least. 637.96s - 639.96s | So I was like, That was 2019. 639.96s - 641.96s | And I asked, Okay, that's pretty cool. 641.96s - 644.96s | So you're talking April 2024, 2025. 644.96s - 647.96s | And they told me, No, it's April 2020. 647.96s - 649.96s | So you need to move forward. 649.96s - 651.96s | You need to make this fast. 651.96s - 657.96s | You need to send all the equipment to the station because we want this to happen. 657.96s - 664.96s | And they said the guy managing this is a billionaire from Montreal, from Canada, 664.96s - 665.96s | and he wants to make this happen. 665.96s - 670.96s | And I was like, Okay, you want me to risk my reputation, my success, 670.96s - 675.96s | trying to put something together in three months with a crew member that didn't have all the training? 675.96s - 676.96s | And they said, Yes. 676.96s - 681.96s | I said, Okay, just to be sure, did you say millionaire with an M or billionaire with a B? 681.96s - 682.96s | And they said billionaire. 682.96s - 684.96s | And I said, Okay, that changed everything. 684.96s - 686.96s | That means like money is not an issue. 686.96s - 688.96s | So we moved forward. 688.96s - 689.96s | It was hard. 689.96s - 693.96s | We tested all the equipment that we needed on the station. 693.96s - 701.96s | It was hard during Christmas to test all the equipment for radiation or radio frequencies and everything. 701.96s - 705.96s | And it was very hard to try to find someone willing to stay. 705.96s - 712.96s | Like this room, this chamber is like maybe this size, but it really isolate everything. 712.96s - 713.96s | There's no light. 713.96s - 714.96s | There's no sound.


chunk_text:
| And I was like, Okay, you want me to risk my reputation, my success, 670.96s - 675.96s | trying to put something together in three months with a crew member that didn't have all the training? 675.96s - 676.96s | And they said, Yes. 676.96s - 681.96s | I said, Okay, just to be sure, did you say millionaire with an M or billionaire with a B? 681.96s - 682.96s | And they said billionaire. 682.96s - 684.96s | And I said, Okay, that changed everything. 684.96s - 686.96s | That means like money is not an issue. 686.96s - 688.96s | So we moved forward. 688.96s - 689.96s | It was hard. 689.96s - 693.96s | We tested all the equipment that we needed on the station. 693.96s - 701.96s | It was hard during Christmas to test all the equipment for radiation or radio frequencies and everything. 701.96s - 705.96s | And it was very hard to try to find someone willing to stay. 705.96s - 712.96s | Like this room, this chamber is like maybe this size, but it really isolate everything. 712.96s - 713.96s | There's no light. 713.96s - 714.96s | There's no sound. 714.96s - 716.96s | You can hear your heartbeat. 716.96s - 718.96s | There is no radio frequencies. 718.96s - 726.96s | And what they want to do is to put the equipment there and be sure that there is no light coming from the equipment, no sound, no radio frequencies. 726.96s - 731.96s | I was like, Well, it's going to be very hard to find an idiot to be there during Christmas. 731.96s - 733.96s | But they found that it was me. 733.96s - 737.96s | So I tested, which was a huge success. 737.96s - 750.96s | And then during this period, NASA is one of the most positive agencies, always taking the best solutions and showing solutions. 750.96s - 752.96s | We tried to make this happen. 752.96s - 757.96s | We have a facility in Houston that simulates the space station. 757.96s - 759.96s | It didn't work. 759.96s - 761.96s | We work a full Friday. 761.96s - 763.96s | We have 10 NASA centers. 763.96s - 765.96s | And someone just connected trying to throw a solution. 765.96s - 767.96s | It didn't work. 767.96s - 769.96s | They said, Yeah, it's


chunk_text:
714.96s - 716.96s | You can hear your heartbeat. 716.96s - 718.96s | There is no radio frequencies. 718.96s - 726.96s | And what they want to do is to put the equipment there and be sure that there is no light coming from the equipment, no sound, no radio frequencies. 726.96s - 731.96s | I was like, Well, it's going to be very hard to find an idiot to be there during Christmas. 731.96s - 733.96s | But they found that it was me. 733.96s - 737.96s | So I tested, which was a huge success. 737.96s - 750.96s | And then during this period, NASA is one of the most positive agencies, always taking the best solutions and showing solutions. 750.96s - 752.96s | We tried to make this happen. 752.96s - 757.96s | We have a facility in Houston that simulates the space station. 757.96s - 759.96s | It didn't work. 759.96s - 761.96s | We work a full Friday. 761.96s - 763.96s | We have 10 NASA centers. 763.96s - 765.96s | And someone just connected trying to throw a solution. 765.96s - 767.96s | It didn't work. 767.96s - 769.96s | They said, Yeah, it's not going to happen. 769.96s - 771.96s | I told them, Hey, let me try it with my team. 771.96s - 773.96s | Let me create my own facility. 773.96s - 775.96s | Give me the weekend. 775.96s - 777.96s | And we figured out a way to make that happen. 777.96s - 778.96s | It worked. 778.96s - 781.96s | NASA told us four times it will not be able on that timeline. 781.96s - 783.96s | We made it happen. 783.96s - 786.96s | And they told me like, Hey, that was a huge Hail Mary. 786.96s - 791.96s | So by April, we made this a success. 791.96s - 796.96s | We had the first crew of astronauts on a station, holoporting back to Earth. 796.96s - 807.96s | So what you will see on this video that looks like Minecraft, and I will explain to you why, is Mark Patti, the first human holoported from a station to mission control. 807.96s - 812.96s | And also on the back, you may be able to see a camera of him on a station. 812.96s - 818.96s | And that was a medical evaluation from one of the


chunk_text:
not going to happen. 769.96s - 771.96s | I told them, Hey, let me try it with my team. 771.96s - 773.96s | Let me create my own facility. 773.96s - 775.96s | Give me the weekend. 775.96s - 777.96s | And we figured out a way to make that happen. 777.96s - 778.96s | It worked. 778.96s - 781.96s | NASA told us four times it will not be able on that timeline. 781.96s - 783.96s | We made it happen. 783.96s - 786.96s | And they told me like, Hey, that was a huge Hail Mary. 786.96s - 791.96s | So by April, we made this a success. 791.96s - 796.96s | We had the first crew of astronauts on a station, holoporting back to Earth. 796.96s - 807.96s | So what you will see on this video that looks like Minecraft, and I will explain to you why, is Mark Patti, the first human holoported from a station to mission control. 807.96s - 812.96s | And also on the back, you may be able to see a camera of him on a station. 812.96s - 818.96s | And that was a medical evaluation from one of the NASA surgeons holoported to a station. 818.96s - 826.94s | Meanwhile, he was holoported down to Earth. 826.94s - 840.05s | Can you point with your other hand to where that pain is? 840.05s - 844.05s | And then we have other two astronauts that want to join to the party. 844.05s - 862.13s | So this video was taken from a station, from two astronauts holoported from ground to station. 862.13s - 869.95s | This one didn't work, but at least you can see the picture of these guys holoported from ground to the station. 869.95s - 876.76s | Maybe it worked. 876.76s - 881.76s | Before I move forward, we have been doing these holoportations for a while. 881.76s - 887.76s | Let me just show you a quick video and walk you through these first holoportations on a station. 887.76s - 894.67s | So that's Dr. Joe Smith during the first holoportation. 894.67s - 899.67s | That's one of the crew members with a hololens interacting with Dr. Smith. 899.67s - 905.07s | That's Dr. Smith as a hologram on a station. 905.07s - 911.64s | Again, Dr. Smith on the ground, holoported to the station as


chunk_text:
NASA surgeons holoported to a station. 818.96s - 826.94s | Meanwhile, he was holoported down to Earth. 826.94s - 840.05s | Can you point with your other hand to where that pain is? 840.05s - 844.05s | And then we have other two astronauts that want to join to the party. 844.05s - 862.13s | So this video was taken from a station, from two astronauts holoported from ground to station. 862.13s - 869.95s | This one didn't work, but at least you can see the picture of these guys holoported from ground to the station. 869.95s - 876.76s | Maybe it worked. 876.76s - 881.76s | Before I move forward, we have been doing these holoportations for a while. 881.76s - 887.76s | Let me just show you a quick video and walk you through these first holoportations on a station. 887.76s - 894.67s | So that's Dr. Joe Smith during the first holoportation. 894.67s - 899.67s | That's one of the crew members with a hololens interacting with Dr. Smith. 899.67s - 905.07s | That's Dr. Smith as a hologram on a station. 905.07s - 911.64s | Again, Dr. Smith on the ground, holoported to the station as a hologram. 911.64s - 918.42s | Some of the crew members interacting with Dr. Smith. 918.42s - 922.42s | That's me and Dr. Smith on a station. 922.42s - 936.38s | That's Mark Patty before he was holoported from station to the ground. 936.38s - 947.84s | That's Mark Patty floating at mission control as a hologram. 947.84s - 964.57s | That's Thomas Pesquet, a French astronaut, interacting with a bunch of physicians during one medical evaluation. 964.57s - 969.57s | So then from the media perspective, it was viral. 969.57s - 972.57s | We went through CBS. We went to multiple media channels. 972.57s - 981.57s | I'm going to skip on this one, but the media was very interested on this one. 981.57s - 983.57s | Finally, NASA gave me an award. 983.57s - 989.57s | We won the NASA Innovation of the Year award, which was good. 989.57s - 993.57s | But then something happened, which was pretty interesting. 993.57s - 998.57s | So during one of the holoportations, imagine the space station is small. 998.57s - 1002.57s | It's the same size as a football field. 1002.57s - 1008.57s | The crew live on a station


chunk_text:
a hologram. 911.64s - 918.42s | Some of the crew members interacting with Dr. Smith. 918.42s - 922.42s | That's me and Dr. Smith on a station. 922.42s - 936.38s | That's Mark Patty before he was holoported from station to the ground. 936.38s - 947.84s | That's Mark Patty floating at mission control as a hologram. 947.84s - 964.57s | That's Thomas Pesquet, a French astronaut, interacting with a bunch of physicians during one medical evaluation. 964.57s - 969.57s | So then from the media perspective, it was viral. 969.57s - 972.57s | We went through CBS. We went to multiple media channels. 972.57s - 981.57s | I'm going to skip on this one, but the media was very interested on this one. 981.57s - 983.57s | Finally, NASA gave me an award. 983.57s - 989.57s | We won the NASA Innovation of the Year award, which was good. 989.57s - 993.57s | But then something happened, which was pretty interesting. 993.57s - 998.57s | So during one of the holoportations, imagine the space station is small. 998.57s - 1002.57s | It's the same size as a football field. 1002.57s - 1008.57s | The crew live on a station between six months to a full year, so they know each other. 1008.57s - 1013.57s | They know every single corner of the station, and the astronauts are very smart. 1013.57s - 1018.57s | What happened before this holoportation, one of the crew members, Kayla Barron, 1018.57s - 1023.57s | she was waiting for Dr. Smith to appear for the medical evaluation. 1023.57s - 1025.57s | She got distracted for a second. 1025.57s - 1032.57s | She moved her head to the left, and she floated forward a little bit, like a couple of inches, 1032.57s - 1038.57s | moved her head back forward, and a hologram of Dr. Smith was in front of her, 1038.57s - 1042.57s | and she shouted, like, hey, go back. You're invading my personal space. 1042.57s - 1046.57s | And then she stopped, and she laughed, and she said, Houston, 1046.57s - 1050.57s | I never believed that a hologram can invade my personal space, but that happened. 1050.57s - 1056.57s | But that was very important because at that point, the Human Health Performance Division at NASA told me, 1056.57s - 1062.57s | Space Medicine told me, like, hey, if in her mind


chunk_text:
between six months to a full year, so they know each other. 1008.57s - 1013.57s | They know every single corner of the station, and the astronauts are very smart. 1013.57s - 1018.57s | What happened before this holoportation, one of the crew members, Kayla Barron, 1018.57s - 1023.57s | she was waiting for Dr. Smith to appear for the medical evaluation. 1023.57s - 1025.57s | She got distracted for a second. 1025.57s - 1032.57s | She moved her head to the left, and she floated forward a little bit, like a couple of inches, 1032.57s - 1038.57s | moved her head back forward, and a hologram of Dr. Smith was in front of her, 1038.57s - 1042.57s | and she shouted, like, hey, go back. You're invading my personal space. 1042.57s - 1046.57s | And then she stopped, and she laughed, and she said, Houston, 1046.57s - 1050.57s | I never believed that a hologram can invade my personal space, but that happened. 1050.57s - 1056.57s | But that was very important because at that point, the Human Health Performance Division at NASA told me, 1056.57s - 1062.57s | Space Medicine told me, like, hey, if in her mind the doctor was there, this is very powerful 1062.57s - 1065.57s | because at least for a second she believed that the doctor was there. 1065.57s - 1069.57s | Let me show you the video. I believe this one has audio. 1070.57s - 1078.94s | Something that isn't just predefined. 1078.94s - 1082.94s | Houston Station reporting that I can now hear audio. 1082.94s - 1088.94s | The hologram image, however, has gotten really, really close to me. 1088.94s - 1095.94s | Didn't know a hologram could invade my personal space, but it's happening. 1095.94s - 1097.94s | So that was so nice. 1097.94s - 1102.94s | So what happened, Dr. Smith came again with me and said, hey, Fernando, what else can we do? 1102.94s - 1108.94s | And I say, well, what if we really build a holodeck, a room that doesn't require glasses, 1108.94s - 1116.94s | technology that we don't require those special $4,000 VisionPros or Hololens, 1116.94s - 1127.94s | and we create a way that whatever is happening on the moon, we can see it in this room from ceiling, floor, all the walls. 1127.94s - 1131.94s | So you can bring a subject


chunk_text:
the doctor was there, this is very powerful 1062.57s - 1065.57s | because at least for a second she believed that the doctor was there. 1065.57s - 1069.57s | Let me show you the video. I believe this one has audio. 1070.57s - 1078.94s | Something that isn't just predefined. 1078.94s - 1082.94s | Houston Station reporting that I can now hear audio. 1082.94s - 1088.94s | The hologram image, however, has gotten really, really close to me. 1088.94s - 1095.94s | Didn't know a hologram could invade my personal space, but it's happening. 1095.94s - 1097.94s | So that was so nice. 1097.94s - 1102.94s | So what happened, Dr. Smith came again with me and said, hey, Fernando, what else can we do? 1102.94s - 1108.94s | And I say, well, what if we really build a holodeck, a room that doesn't require glasses, 1108.94s - 1116.94s | technology that we don't require those special $4,000 VisionPros or Hololens, 1116.94s - 1127.94s | and we create a way that whatever is happening on the moon, we can see it in this room from ceiling, floor, all the walls. 1127.94s - 1131.94s | So you can bring a subject matter expert if they need to fix something. 1131.94s - 1140.94s | You can bring family members. You can bring personnel for training, future astronauts, also politicians. 1140.94s - 1144.94s | I said, OK, let's do it. So we're building four holodecks. 1144.94s - 1150.94s | This one was we put it on the operation in October 2023. 1150.94s - 1154.94s | It's at the Johnson Space Center, building 268. 1154.94s - 1157.94s | And that's Joe making a little message. 1157.94s - 1159.94s | Welcome to the future. 1159.94s - 1163.94s | We are now experiencing what our astronauts experience on board the International Space Station. 1163.94s - 1166.94s | We were all aboard the space station. 1166.94s - 1169.94s | Now I'm all afforded to view there in the holodeck. 1169.94s - 1177.94s | The future is now. 1177.94s - 1184.94s | So when that happened, we when I say we as my company, we came with the idea like, hey, this is very powerful. 1184.94s - 1190.94s | We are at least five companies working in different ways to use Holoportation. 1190.94s - 1194.94s | There is Microsoft, which we have a great partnership with them. 1194.94s


chunk_text:
matter expert if they need to fix something. 1131.94s - 1140.94s | You can bring family members. You can bring personnel for training, future astronauts, also politicians. 1140.94s - 1144.94s | I said, OK, let's do it. So we're building four holodecks. 1144.94s - 1150.94s | This one was we put it on the operation in October 2023. 1150.94s - 1154.94s | It's at the Johnson Space Center, building 268. 1154.94s - 1157.94s | And that's Joe making a little message. 1157.94s - 1159.94s | Welcome to the future. 1159.94s - 1163.94s | We are now experiencing what our astronauts experience on board the International Space Station. 1163.94s - 1166.94s | We were all aboard the space station. 1166.94s - 1169.94s | Now I'm all afforded to view there in the holodeck. 1169.94s - 1177.94s | The future is now. 1177.94s - 1184.94s | So when that happened, we when I say we as my company, we came with the idea like, hey, this is very powerful. 1184.94s - 1190.94s | We are at least five companies working in different ways to use Holoportation. 1190.94s - 1194.94s | There is Microsoft, which we have a great partnership with them. 1194.94s - 1203.94s | There is Google. They are launching a special device that is like a telephone booth, but it's two way. 1203.94s - 1208.94s | You can see the other person. That price will be like one million dollars, which is pretty cool. 1208.94s - 1212.94s | There is a company in California. We have a very good relation with them. 1212.94s - 1224.94s | The name of the company is Portal. It's also you walk into a studio and then you have a telephone booth on the other side and you can see yourself like you're inside a box. 1224.94s - 1227.94s | And that's pretty cool. It's $150,000. 1227.94s - 1232.94s | There is Samsung trying to do something meta, Cisco, Webex. 1232.94s - 1237.94s | They also have some technology based on those glasses, the magic lips and the HoloLens. 1237.94s - 1241.94s | And I was like, hey, this is very powerful, but it's very expensive. 1241.94s - 1245.94s | What if we figure out a way to make this device agnostic? 1245.94s - 1250.94s | What if we also figure out a way to project the HoloLens without the glasses? 1250.94s - 1258.94s |


chunk_text:
- 1203.94s | There is Google. They are launching a special device that is like a telephone booth, but it's two way. 1203.94s - 1208.94s | You can see the other person. That price will be like one million dollars, which is pretty cool. 1208.94s - 1212.94s | There is a company in California. We have a very good relation with them. 1212.94s - 1224.94s | The name of the company is Portal. It's also you walk into a studio and then you have a telephone booth on the other side and you can see yourself like you're inside a box. 1224.94s - 1227.94s | And that's pretty cool. It's $150,000. 1227.94s - 1232.94s | There is Samsung trying to do something meta, Cisco, Webex. 1232.94s - 1237.94s | They also have some technology based on those glasses, the magic lips and the HoloLens. 1237.94s - 1241.94s | And I was like, hey, this is very powerful, but it's very expensive. 1241.94s - 1245.94s | What if we figure out a way to make this device agnostic? 1245.94s - 1250.94s | What if we also figure out a way to project the HoloLens without the glasses? 1250.94s - 1258.94s | So, again, when I say we, it's my company, we took the decision to split the company to two companies, 1258.94s - 1267.94s | Aerospace, which serves the government, the U.S. government, and AXA Tech, which will serve the commercial market. 1267.94s - 1275.94s | And then we came with the idea like, hey, a lot of people from here, maybe they have a Kinect camera from their Xbox, but not all the people have that. 1275.94s - 1279.94s | But everyone has this. Everyone has a cell phone. 1279.94s - 1283.94s | What if we can capture a three dimensional hologram with this camera? 1283.94s - 1291.94s | And what if instead of telling you what device you need to use to visualize the hologram, 1291.94s - 1303.94s | you can use the fancy HoloLens or Vision Pros, or you can use a $300 MetaQuest 3 device, or you can use also a smartphone or a tablet. 1303.94s - 1307.94s | Right now, my technology works on 2,300 devices. 1307.94s - 1312.94s | And I will show you the QR code right now for a limited time. It's free. 1313.94s - 1320.94s | Because I really believe that this


chunk_text:
So, again, when I say we, it's my company, we took the decision to split the company to two companies, 1258.94s - 1267.94s | Aerospace, which serves the government, the U.S. government, and AXA Tech, which will serve the commercial market. 1267.94s - 1275.94s | And then we came with the idea like, hey, a lot of people from here, maybe they have a Kinect camera from their Xbox, but not all the people have that. 1275.94s - 1279.94s | But everyone has this. Everyone has a cell phone. 1279.94s - 1283.94s | What if we can capture a three dimensional hologram with this camera? 1283.94s - 1291.94s | And what if instead of telling you what device you need to use to visualize the hologram, 1291.94s - 1303.94s | you can use the fancy HoloLens or Vision Pros, or you can use a $300 MetaQuest 3 device, or you can use also a smartphone or a tablet. 1303.94s - 1307.94s | Right now, my technology works on 2,300 devices. 1307.94s - 1312.94s | And I will show you the QR code right now for a limited time. It's free. 1313.94s - 1320.94s | Because I really believe that this technology can help a lot of people, not only in space, everywhere. 1320.94s - 1325.94s | And also, we will be able to create more applications based on this technology. 1325.94s - 1333.94s | And also, from the other side, a lot of people either with augmented reality or mixed reality or virtual reality, some people, they don't like it. 1333.94s - 1339.94s | So we built a device called HoloConnector, which we have two sizes. 1339.94s - 1348.94s | One is the human size. The other one is table size, which will help you to project holograms without glasses. 1348.94s - 1356.94s | So my technology, we made it available. We launched this device during a comic convention in Houston, Comicpalooza. 1356.94s - 1364.94s | Then we made the official presentation at the Smithsonian Museum in Washington, D.C. two weeks ago. 1365.94s - 1372.94s | So trying to figure out something, and what you can see there, there's people and the holograms projected next to them. 1372.94s - 1375.94s | And you can play with this technology as well. 1375.94s - 1383.91s | And this is kind of a render of the HoloConnector. 1383.91s - 1387.91s | And now


chunk_text:
technology can help a lot of people, not only in space, everywhere. 1320.94s - 1325.94s | And also, we will be able to create more applications based on this technology. 1325.94s - 1333.94s | And also, from the other side, a lot of people either with augmented reality or mixed reality or virtual reality, some people, they don't like it. 1333.94s - 1339.94s | So we built a device called HoloConnector, which we have two sizes. 1339.94s - 1348.94s | One is the human size. The other one is table size, which will help you to project holograms without glasses. 1348.94s - 1356.94s | So my technology, we made it available. We launched this device during a comic convention in Houston, Comicpalooza. 1356.94s - 1364.94s | Then we made the official presentation at the Smithsonian Museum in Washington, D.C. two weeks ago. 1365.94s - 1372.94s | So trying to figure out something, and what you can see there, there's people and the holograms projected next to them. 1372.94s - 1375.94s | And you can play with this technology as well. 1375.94s - 1383.91s | And this is kind of a render of the HoloConnector. 1383.91s - 1387.91s | And now let me share a story before I go back to the application. 1387.91s - 1389.91s | I have two children, and they say, 1390.91s - 1394.91s | You should be an influencer and interview people with your technology. 1394.91s - 1400.91s | And I was like, eh, I'm not an influencer, and I'm not that kind of guy. 1400.91s - 1407.91s | But I'm going to show you how being an influencer is just fake and is not going to work. 1407.91s - 1412.91s | So I launched a YouTube channel, which you can join if you want to. There's a QR code. 1412.91s - 1416.91s | I started interviewing people with my technology as holograms. 1416.91s - 1421.91s | And later on, you will be able to visualize these interviews as holograms as well. 1421.91s - 1426.91s | For instance, I have one of the guys that invented the Internet, Dr. Vinton Cerf. 1426.91s - 1428.91s | I have so many people. 1428.91s - 1433.91s | And then after one month, YouTube sent me this creator award. 1433.91s - 1435.91s | Like, now you are an influencer. 1435.91s - 1438.91s | Right now, I believe we reached 3.5 million


chunk_text:
let me share a story before I go back to the application. 1387.91s - 1389.91s | I have two children, and they say, 1390.91s - 1394.91s | You should be an influencer and interview people with your technology. 1394.91s - 1400.91s | And I was like, eh, I'm not an influencer, and I'm not that kind of guy. 1400.91s - 1407.91s | But I'm going to show you how being an influencer is just fake and is not going to work. 1407.91s - 1412.91s | So I launched a YouTube channel, which you can join if you want to. There's a QR code. 1412.91s - 1416.91s | I started interviewing people with my technology as holograms. 1416.91s - 1421.91s | And later on, you will be able to visualize these interviews as holograms as well. 1421.91s - 1426.91s | For instance, I have one of the guys that invented the Internet, Dr. Vinton Cerf. 1426.91s - 1428.91s | I have so many people. 1428.91s - 1433.91s | And then after one month, YouTube sent me this creator award. 1433.91s - 1435.91s | Like, now you are an influencer. 1435.91s - 1438.91s | Right now, I believe we reached 3.5 million views. 1438.91s - 1442.91s | We reached 650,000 subscribers. 1442.91s - 1445.91s | And right now I'm receiving a check every month. 1445.91s - 1448.91s | And I was like, yeah, this story really backfired me. 1448.91s - 1451.91s | But I noticed, like, this technology is really powerful. 1451.91s - 1456.91s | So I decided to make it available for anyone and go from there. 1459.91s - 1462.91s | Because the applications are unlimited. 1462.91s - 1466.91s | You can have your mechanic next to your car and helping you. 1466.91s - 1471.91s | You can take your best buddy to you during a trip, capture unique memories. 1471.91s - 1474.91s | You can do whatever you want to. 1474.91s - 1479.91s | So that's why, and hopefully you can scan this one, 1479.91s - 1483.91s | I decided with my company to make this technology available for anyone. 1483.91s - 1485.91s | Right now it's free. 1485.91s - 1488.91s | At some point, we're going to charge like $9 a month 1488.91s - 1493.91s | because we don't really want to make money and charge you a lot of money. 1493.91s - 1495.91s | We want people to


chunk_text:
views. 1438.91s - 1442.91s | We reached 650,000 subscribers. 1442.91s - 1445.91s | And right now I'm receiving a check every month. 1445.91s - 1448.91s | And I was like, yeah, this story really backfired me. 1448.91s - 1451.91s | But I noticed, like, this technology is really powerful. 1451.91s - 1456.91s | So I decided to make it available for anyone and go from there. 1459.91s - 1462.91s | Because the applications are unlimited. 1462.91s - 1466.91s | You can have your mechanic next to your car and helping you. 1466.91s - 1471.91s | You can take your best buddy to you during a trip, capture unique memories. 1471.91s - 1474.91s | You can do whatever you want to. 1474.91s - 1479.91s | So that's why, and hopefully you can scan this one, 1479.91s - 1483.91s | I decided with my company to make this technology available for anyone. 1483.91s - 1485.91s | Right now it's free. 1485.91s - 1488.91s | At some point, we're going to charge like $9 a month 1488.91s - 1493.91s | because we don't really want to make money and charge you a lot of money. 1493.91s - 1495.91s | We want people to use this technology. 1495.91s - 1498.91s | At some point, we're going to release a software developer kit 1498.91s - 1501.91s | so you can use this technology as a testbed 1501.91s - 1506.91s | because I believe that we can lead the market of holographic communications. 1506.91s - 1513.91s | Right now I have surgeons from the Houston Medical Center training people in Africa. 1513.91s - 1517.91s | And we reduce the bandwidth from 5 megabits per second to 1 megabit per second 1517.91s - 1520.91s | because you don't have great coverage on those areas. 1520.91s - 1525.91s | So the real idea is to help not only medicine but help anyone. 1525.91s - 1529.91s | So if you want to download it, it's free for now. 1529.91s - 1537.91s | And saying that, I tried to go fast, especially because I started late, 1537.91s - 1541.91s | but also to give you the opportunity to make questions. 1541.91s - 1544.91s | So if you have any questions, I believe that we have some time. 1544.91s - 1546.91s | Hopefully you like my presentation. 1546.91s - 1547.91s | I tried to rush. 1547.91s - 1550.91s | I know


chunk_text:
use this technology. 1495.91s - 1498.91s | At some point, we're going to release a software developer kit 1498.91s - 1501.91s | so you can use this technology as a testbed 1501.91s - 1506.91s | because I believe that we can lead the market of holographic communications. 1506.91s - 1513.91s | Right now I have surgeons from the Houston Medical Center training people in Africa. 1513.91s - 1517.91s | And we reduce the bandwidth from 5 megabits per second to 1 megabit per second 1517.91s - 1520.91s | because you don't have great coverage on those areas. 1520.91s - 1525.91s | So the real idea is to help not only medicine but help anyone. 1525.91s - 1529.91s | So if you want to download it, it's free for now. 1529.91s - 1537.91s | And saying that, I tried to go fast, especially because I started late, 1537.91s - 1541.91s | but also to give you the opportunity to make questions. 1541.91s - 1544.91s | So if you have any questions, I believe that we have some time. 1544.91s - 1546.91s | Hopefully you like my presentation. 1546.91s - 1547.91s | I tried to rush. 1547.91s - 1550.91s | I know that you have a very full program today, 1550.91s - 1553.91s | so I don't want to bore you during your first session. 1553.91s - 1556.91s | And thank you so much for being here. 1557.91s - 1563.44s | And with this light, I cannot see you. 1563.44s - 1565.44s | It's like an interrogation room. 1565.44s - 1570.44s | So if someone has a question, just let me know or try to do something, 1570.44s - 1573.44s | turn on your device, and I will be happy to answer it. 1573.44s - 1591.62s | Ideally, we love to have 5 megabits per second. 1591.62s - 1594.62s | Right now it's working with 1 megabit per second. 1594.62s - 1600.62s | And we are going to release a way to make it like ultra-high definition. 1600.62s - 1607.62s | The biggest milestone is to get it like maybe 12 megabits per second 1607.62s - 1609.62s | for ultra-high definition. 1609.62s - 1612.62s | But what's going to happen is, and that's important, 1612.62s - 1617.62s | every two weeks we push an update so the technology is changing every two weeks. 1617.62s - 1621.62s | And I want this technology


chunk_text:
that you have a very full program today, 1550.91s - 1553.91s | so I don't want to bore you during your first session. 1553.91s - 1556.91s | And thank you so much for being here. 1557.91s - 1563.44s | And with this light, I cannot see you. 1563.44s - 1565.44s | It's like an interrogation room. 1565.44s - 1570.44s | So if someone has a question, just let me know or try to do something, 1570.44s - 1573.44s | turn on your device, and I will be happy to answer it. 1573.44s - 1591.62s | Ideally, we love to have 5 megabits per second. 1591.62s - 1594.62s | Right now it's working with 1 megabit per second. 1594.62s - 1600.62s | And we are going to release a way to make it like ultra-high definition. 1600.62s - 1607.62s | The biggest milestone is to get it like maybe 12 megabits per second 1607.62s - 1609.62s | for ultra-high definition. 1609.62s - 1612.62s | But what's going to happen is, and that's important, 1612.62s - 1617.62s | every two weeks we push an update so the technology is changing every two weeks. 1617.62s - 1621.62s | And I want this technology to make it your technology. 1621.62s - 1625.62s | So every time that we have input, let me give you an example, 1625.62s - 1628.62s | and I'm going to go back to your question. 1628.62s - 1632.62s | Someday I receive an email like, hey, Fernando, can you add a selfie mode? 1632.62s - 1635.62s | And I was like, what? A selfie mode? 1635.62s - 1638.62s | Yeah, I want to love to have pictures or videos with my friends 1638.62s - 1640.62s | while I'm on vacation. 1640.62s - 1642.62s | I was like, okay, and we did it. 1642.62s - 1647.62s | So every time someone comes with a question or a suggestion, we implement it. 1647.62s - 1651.62s | Right now it's working with 1 up to 5 megabits per second. 1651.62s - 1656.62s | We have in the backlog a way that if you have 12 megabits per second, 1656.62s - 1658.62s | at some point it's going to take the 12, 1658.62s - 1662.62s | and it will ask you if you want to go to like ultra-high definition. 1662.62s - 1665.62s | And if not, you can go to 5 or 1.


chunk_text:
to make it your technology. 1621.62s - 1625.62s | So every time that we have input, let me give you an example, 1625.62s - 1628.62s | and I'm going to go back to your question. 1628.62s - 1632.62s | Someday I receive an email like, hey, Fernando, can you add a selfie mode? 1632.62s - 1635.62s | And I was like, what? A selfie mode? 1635.62s - 1638.62s | Yeah, I want to love to have pictures or videos with my friends 1638.62s - 1640.62s | while I'm on vacation. 1640.62s - 1642.62s | I was like, okay, and we did it. 1642.62s - 1647.62s | So every time someone comes with a question or a suggestion, we implement it. 1647.62s - 1651.62s | Right now it's working with 1 up to 5 megabits per second. 1651.62s - 1656.62s | We have in the backlog a way that if you have 12 megabits per second, 1656.62s - 1658.62s | at some point it's going to take the 12, 1658.62s - 1662.62s | and it will ask you if you want to go to like ultra-high definition. 1662.62s - 1665.62s | And if not, you can go to 5 or 1. 1665.62s - 1670.62s | Now, with 12, we have something called haptics, and I forgot to mention that. 1670.62s - 1675.62s | With haptics, what happens, we have a glove that is 300 bucks 1675.62s - 1677.62s | and some other equipment. 1677.62s - 1680.62s | And as a surgeon, and I'm not a physician, 1680.62s - 1685.62s | they just touch the patient as a hologram, take the lymph nodes, 1685.62s - 1688.62s | and they do have an infection, and they do their magic. 1688.62s - 1691.62s | We have been doing that, and that's part of the technology 1691.62s - 1693.62s | that we're releasing to the public, 1693.62s - 1697.62s | the capability of having the essence of the other person there 1697.62s - 1701.62s | and also the capability of feeling the other person. 1701.62s - 1703.62s | And right now it's multiplayer. 1703.62s - 1707.62s | We can have up to four people at the same time during one session. 1707.62s - 1709.62s | You create your own rooms. 1709.62s - 1712.62s | But at some point, we want to make it unlimited, 1712.62s - 1715.62s | at least have 300 people or more


chunk_text:
1665.62s - 1670.62s | Now, with 12, we have something called haptics, and I forgot to mention that. 1670.62s - 1675.62s | With haptics, what happens, we have a glove that is 300 bucks 1675.62s - 1677.62s | and some other equipment. 1677.62s - 1680.62s | And as a surgeon, and I'm not a physician, 1680.62s - 1685.62s | they just touch the patient as a hologram, take the lymph nodes, 1685.62s - 1688.62s | and they do have an infection, and they do their magic. 1688.62s - 1691.62s | We have been doing that, and that's part of the technology 1691.62s - 1693.62s | that we're releasing to the public, 1693.62s - 1697.62s | the capability of having the essence of the other person there 1697.62s - 1701.62s | and also the capability of feeling the other person. 1701.62s - 1703.62s | And right now it's multiplayer. 1703.62s - 1707.62s | We can have up to four people at the same time during one session. 1707.62s - 1709.62s | You create your own rooms. 1709.62s - 1712.62s | But at some point, we want to make it unlimited, 1712.62s - 1715.62s | at least have 300 people or more per room, 1715.62s - 1720.62s | so you have a concert or an event, you can invite anyone. 1720.62s - 1725.62s | Any other question? 1725.62s - 1727.62s | If you have a question, just try to raise your hand 1727.62s - 1730.62s | because I cannot really see from here. 1730.62s - 1740.62s | Okay. 1740.62s - 1742.62s | So the question is if I have competition. 1742.62s - 1746.62s | And yes, we do have a bunch. 1746.62s - 1750.62s | We play nice with at least four. 1750.62s - 1753.62s | Meta or Zuckerberg, they are trying to do this. 1753.62s - 1756.62s | It's not live, but they're trying to create 1756.62s - 1759.62s | this holoportation technology as well. 1759.62s - 1763.62s | Cisco, Webex, they call it Webex Hologram. 1763.62s - 1768.62s | They have a way to capture holograms for two people. 1768.62s - 1770.62s | You have a special rail of cameras, 1770.62s - 1772.62s | and you need to have the Webex Business Edition, 1772.62s - 1774.62s | and you need to have the HoloLens, 1774.62s - 1777.62s | which is pretty cool but pretty expensive, 1777.62s - 1779.62s | but


chunk_text:
per room, 1715.62s - 1720.62s | so you have a concert or an event, you can invite anyone. 1720.62s - 1725.62s | Any other question? 1725.62s - 1727.62s | If you have a question, just try to raise your hand 1727.62s - 1730.62s | because I cannot really see from here. 1730.62s - 1740.62s | Okay. 1740.62s - 1742.62s | So the question is if I have competition. 1742.62s - 1746.62s | And yes, we do have a bunch. 1746.62s - 1750.62s | We play nice with at least four. 1750.62s - 1753.62s | Meta or Zuckerberg, they are trying to do this. 1753.62s - 1756.62s | It's not live, but they're trying to create 1756.62s - 1759.62s | this holoportation technology as well. 1759.62s - 1763.62s | Cisco, Webex, they call it Webex Hologram. 1763.62s - 1768.62s | They have a way to capture holograms for two people. 1768.62s - 1770.62s | You have a special rail of cameras, 1770.62s - 1772.62s | and you need to have the Webex Business Edition, 1772.62s - 1774.62s | and you need to have the HoloLens, 1774.62s - 1777.62s | which is pretty cool but pretty expensive, 1777.62s - 1779.62s | but that's one market. 1779.62s - 1782.62s | Samsung, we don't play with them. 1782.62s - 1783.62s | We tried to reach to them. 1783.62s - 1785.62s | They didn't respond. 1785.62s - 1788.62s | Because what I'm trying to do is to play nice with everyone 1788.62s - 1793.62s | so we can create a standard of these same practices. 1793.62s - 1795.62s | Microsoft, we have been playing very nice with them. 1795.62s - 1800.62s | Actually, they added an article on their website about us 1800.62s - 1802.62s | because also we use Microsoft technology. 1802.62s - 1805.62s | Apple, we're playing nice with them. 1805.62s - 1808.62s | Portal as well and Google as well. 1808.62s - 1810.62s | They are different technologies. 1810.62s - 1814.62s | Ours is the only one that is portable, 1814.62s - 1817.62s | multiplayer, device agnostic. 1817.62s - 1819.62s | And I don't want to challenge you. 1819.62s - 1821.62s | I will be careful to say that here, 1821.62s - 1824.62s | but it's pretty secure. 1824.62s - 1827.62s | It's encrypted because we developed this technology for NASA 1827.62s - 1829.62s | and the Department of Defense. 1829.62s -


chunk_text:
that's one market. 1779.62s - 1782.62s | Samsung, we don't play with them. 1782.62s - 1783.62s | We tried to reach to them. 1783.62s - 1785.62s | They didn't respond. 1785.62s - 1788.62s | Because what I'm trying to do is to play nice with everyone 1788.62s - 1793.62s | so we can create a standard of these same practices. 1793.62s - 1795.62s | Microsoft, we have been playing very nice with them. 1795.62s - 1800.62s | Actually, they added an article on their website about us 1800.62s - 1802.62s | because also we use Microsoft technology. 1802.62s - 1805.62s | Apple, we're playing nice with them. 1805.62s - 1808.62s | Portal as well and Google as well. 1808.62s - 1810.62s | They are different technologies. 1810.62s - 1814.62s | Ours is the only one that is portable, 1814.62s - 1817.62s | multiplayer, device agnostic. 1817.62s - 1819.62s | And I don't want to challenge you. 1819.62s - 1821.62s | I will be careful to say that here, 1821.62s - 1824.62s | but it's pretty secure. 1824.62s - 1827.62s | It's encrypted because we developed this technology for NASA 1827.62s - 1829.62s | and the Department of Defense. 1829.62s - 1831.62s | So it's not unhackable. 1831.62s - 1834.62s | Don't try it, but try that technology. 1834.62s - 1836.62s | But we try to make it pretty secure 1836.62s - 1841.62s | because if you are having a HoloPortation session with anyone, 1841.62s - 1844.62s | if it's happening, we don't have a way to know it. 1844.62s - 1846.62s | Whatever happened is your stuff, 1846.62s - 1849.62s | and we don't have a way to access it because it's your privacy. 1849.62s - 1854.62s | We know that sometimes in medicine there are a lot of sensitive issues 1854.62s - 1858.62s | or deployed military personnel overseas. 1858.62s - 1860.62s | They want to meet with their family. 1860.62s - 1862.62s | So we don't really capture that. 1862.62s - 1867.62s | So we try to keep privacy and make it pretty secure. 1867.62s - 1870.62s | Is there any other question? 1870.62s - 1874.62s | If you have one, just raise your hand or shout. 1874.62s - 1904.98s | You have one over there. 1904.98s - 1906.98s | So the question is if we are using more haptics 1906.98s - 1909.98s | other than big haptics


chunk_text:
1831.62s | So it's not unhackable. 1831.62s - 1834.62s | Don't try it, but try that technology. 1834.62s - 1836.62s | But we try to make it pretty secure 1836.62s - 1841.62s | because if you are having a HoloPortation session with anyone, 1841.62s - 1844.62s | if it's happening, we don't have a way to know it. 1844.62s - 1846.62s | Whatever happened is your stuff, 1846.62s - 1849.62s | and we don't have a way to access it because it's your privacy. 1849.62s - 1854.62s | We know that sometimes in medicine there are a lot of sensitive issues 1854.62s - 1858.62s | or deployed military personnel overseas. 1858.62s - 1860.62s | They want to meet with their family. 1860.62s - 1862.62s | So we don't really capture that. 1862.62s - 1867.62s | So we try to keep privacy and make it pretty secure. 1867.62s - 1870.62s | Is there any other question? 1870.62s - 1874.62s | If you have one, just raise your hand or shout. 1874.62s - 1904.98s | You have one over there. 1904.98s - 1906.98s | So the question is if we are using more haptics 1906.98s - 1909.98s | other than big haptics or haptics feedback. 1909.98s - 1912.98s | Yes, at NASA we have a base and we have a full suit 1912.98s - 1916.98s | that has also a compressor, which is huge. 1916.98s - 1918.98s | The sensitivity is better. 1918.98s - 1922.98s | So you can feel with that kind of haptics, 1922.98s - 1926.98s | if you are touching a holographic cat versus a holographic table, 1926.98s - 1929.98s | you can feel it. 1929.98s - 1932.98s | So we have two versions of this technology, 1932.98s - 1935.98s | the government version, which is with aerospace, 1935.98s - 1938.98s | and the commercial version, which is with AXA Tech. 1938.98s - 1941.98s | We are trying to match both technologies. 1941.98s - 1944.98s | Of course, the government version has more features, 1944.98s - 1946.98s | more bells and whistles. 1946.98s - 1948.98s | That's why on the commercial version, 1948.98s - 1951.98s | we have used a glove that costs $300. 1951.98s - 1953.98s | But it's compatible, and at some point, 1953.98s - 1957.98s | I believe that people will be more engaged using the fancy haptics. 1957.98s - 1960.98s | But for government, yes,


chunk_text:
or haptics feedback. 1909.98s - 1912.98s | Yes, at NASA we have a base and we have a full suit 1912.98s - 1916.98s | that has also a compressor, which is huge. 1916.98s - 1918.98s | The sensitivity is better. 1918.98s - 1922.98s | So you can feel with that kind of haptics, 1922.98s - 1926.98s | if you are touching a holographic cat versus a holographic table, 1926.98s - 1929.98s | you can feel it. 1929.98s - 1932.98s | So we have two versions of this technology, 1932.98s - 1935.98s | the government version, which is with aerospace, 1935.98s - 1938.98s | and the commercial version, which is with AXA Tech. 1938.98s - 1941.98s | We are trying to match both technologies. 1941.98s - 1944.98s | Of course, the government version has more features, 1944.98s - 1946.98s | more bells and whistles. 1946.98s - 1948.98s | That's why on the commercial version, 1948.98s - 1951.98s | we have used a glove that costs $300. 1951.98s - 1953.98s | But it's compatible, and at some point, 1953.98s - 1957.98s | I believe that people will be more engaged using the fancy haptics. 1957.98s - 1960.98s | But for government, yes, we have the full base. 1960.98s - 1966.98s | For the commercial version, we only have the glove. 1966.98s - 1973.98s | Is there any other question? 1973.98s - 1984.98s | I have one there, yeah. 1984.98s - 1989.98s | Yes, so let me tell you, yes. 1989.98s - 1993.98s | So if we go to Mars, let's say we have a crew on Mars, 1993.98s - 1997.98s | and we're working on that one on the NASA version. 1997.98s - 2000.98s | There is a delay in the communications between 16 to 32 minutes 2000.98s - 2002.98s | for a two-way communication. 2002.98s - 2004.98s | So imagine you are on Mars. 2004.98s - 2005.98s | You have an accident. 2005.98s - 2010.98s | You are bleeding and say, Houston, this is Mars. 2010.98s - 2011.98s | I'm bleeding. 2011.98s - 2014.98s | Thirty-two minutes later, they will say, from where? 2014.98s - 2016.98s | You may be dead by then. 2016.98s - 2020.98s | So according to the Space Medicine Division at NASA, 2020.98s - 2024.98s | there are about 440 basic medical diagnostics. 2024.98s - 2029.98s | So what we're trying to do is to put AI


chunk_text:
we have the full base. 1960.98s - 1966.98s | For the commercial version, we only have the glove. 1966.98s - 1973.98s | Is there any other question? 1973.98s - 1984.98s | I have one there, yeah. 1984.98s - 1989.98s | Yes, so let me tell you, yes. 1989.98s - 1993.98s | So if we go to Mars, let's say we have a crew on Mars, 1993.98s - 1997.98s | and we're working on that one on the NASA version. 1997.98s - 2000.98s | There is a delay in the communications between 16 to 32 minutes 2000.98s - 2002.98s | for a two-way communication. 2002.98s - 2004.98s | So imagine you are on Mars. 2004.98s - 2005.98s | You have an accident. 2005.98s - 2010.98s | You are bleeding and say, Houston, this is Mars. 2010.98s - 2011.98s | I'm bleeding. 2011.98s - 2014.98s | Thirty-two minutes later, they will say, from where? 2014.98s - 2016.98s | You may be dead by then. 2016.98s - 2020.98s | So according to the Space Medicine Division at NASA, 2020.98s - 2024.98s | there are about 440 basic medical diagnostics. 2024.98s - 2029.98s | So what we're trying to do is to put AI for this medical purpose. 2029.98s - 2033.98s | So if you have an emergency on Mars or the moon, 2033.98s - 2037.98s | the first thing that you're going to see is a hologram of a doctor 2037.98s - 2041.98s | trying to give you at least the basic procedures 2041.98s - 2045.98s | to keep you away from a bigger danger. 2045.98s - 2049.98s | And then the biggest challenge for us is that at some point, 2049.98s - 2052.98s | the communication from air will arrive, 2052.98s - 2056.98s | and the biggest challenge for us is that the crew member or the astronaut 2056.98s - 2060.98s | will not notice if he or she is still talking with the hologram, 2060.98s - 2062.98s | with the AI, or the person. 2062.98s - 2066.98s | But, yes, we are integrating that under the Space Medicine Division 2066.98s - 2073.98s | because just having a 32-minute delay in the communications is a lot. 2073.98s - 2078.98s | And at some point, I plan to integrate that also in the commercial version. 2078.98s - 2085.98s | Any other questions? 2085.98s - 2089.98s | Okay. Well, thank you so much for


chunk_text:
for this medical purpose. 2029.98s - 2033.98s | So if you have an emergency on Mars or the moon, 2033.98s - 2037.98s | the first thing that you're going to see is a hologram of a doctor 2037.98s - 2041.98s | trying to give you at least the basic procedures 2041.98s - 2045.98s | to keep you away from a bigger danger. 2045.98s - 2049.98s | And then the biggest challenge for us is that at some point, 2049.98s - 2052.98s | the communication from air will arrive, 2052.98s - 2056.98s | and the biggest challenge for us is that the crew member or the astronaut 2056.98s - 2060.98s | will not notice if he or she is still talking with the hologram, 2060.98s - 2062.98s | with the AI, or the person. 2062.98s - 2066.98s | But, yes, we are integrating that under the Space Medicine Division 2066.98s - 2073.98s | because just having a 32-minute delay in the communications is a lot. 2073.98s - 2078.98s | And at some point, I plan to integrate that also in the commercial version. 2078.98s - 2085.98s | Any other questions? 2085.98s - 2089.98s | Okay. Well, thank you so much for your time. 2089.98s - 2092.98s | If you can, download the app. It's not perfect. 2092.98s - 2095.98s | Every two weeks, we are pushing an update. 2095.98s - 2098.98s | What we want is to have an app that is working for you, 2098.98s - 2102.98s | available for anyone like you, and designed by you, by the people, 2102.98s - 2105.98s | by users for something that you really like, 2105.98s - 2107.98s | instead of us just coming with an idea and saying, 2107.98s - 2109.98s | hey, this is how it's going to work. 2109.98s - 2112.98s | So you can just download it, give us your feedback, 2112.98s - 2122.98s | and we will try to tailor the application to your designs or your needs. 2122.98s - 2124.98s | Okay? Thank you so much. 2124.98s - 2128.98s | And if you need me, that's my email, if you want also to email me. 2128.98s - 2130.98s | Thank you.


