# MediaChunks

chunk_text:
| budget, I want to add three more things. So if you have budget, see how she kind of looks 828.19s - 833.87s | like a badass. She's like, I have budget, hire an app sec person. Like that is the best 833.87s - 839.71s | investment you can ever make. Like hire someone from this room. Um, like seriously, the people 839.71s - 844.79s | there in this room, probably almost all of them will be amazing to work with. Um, pay 844.79s - 851.27s | for a next gen SAST. So I find that the paid SAS are a lot better than the paid tasks. 851.27s - 855.07s | I kind of think that sucks. And I remember people telling me at the beginning of my app 855.07s - 858.75s | sec career that DAS sucks. I'm like, DAS is amazing. And they're like, one day when you're 858.75s - 865.39s | a more mature app sec professional, Tanya, you'll understand. And one day I just did, 865.39s - 870.67s | I'm sorry if you make a DAS, I'm a jerk. Um, continue with your free-ish DAS. I just 870.67s - 877.23s | would never buy one. Um, and then all of step two. So still do the no budget plan. So this 877.23s - 884.47s | is model one. And now we're going to do model two. All right. Model tool. Like I call this 884.47s - 890.59s | tools, tools and more tools. Um, so this is the most common thing. I see this absolutely 890.59s - 895.15s | all the time. Actually, let me go back for a second. So this is SAS plus DAS, perhaps 895.15s - 901.91s | one other tool, a little bit of governance. Okay. So partially rolled out tools. This 901.91s - 909.63s | is the most common thing. So partially rolled out. So we've paid $75,000 for a DAS and like 909.63s - 915.67s | $60,000 for a SAS. And we are totally using 20% of our licenses, which I hate. I work 915.67s - 923.37s | for a vendor. Take every penny you can. You paid for it. Lots of bug reports, but ain't 923.37s - 927.05s | no one fixing anything. So we've got lots of reports. They're not getting to the right 927.05s - 931.85s | people. Maybe there's lots of false positives. Maybe we're just


chunk_text:
and then all of step two. So still do the no budget plan. So this 877.23s - 884.47s | is model one. And now we're going to do model two. All right. Model tool. Like I call this 884.47s - 890.59s | tools, tools and more tools. Um, so this is the most common thing. I see this absolutely 890.59s - 895.15s | all the time. Actually, let me go back for a second. So this is SAS plus DAS, perhaps 895.15s - 901.91s | one other tool, a little bit of governance. Okay. So partially rolled out tools. This 901.91s - 909.63s | is the most common thing. So partially rolled out. So we've paid $75,000 for a DAS and like 909.63s - 915.67s | $60,000 for a SAS. And we are totally using 20% of our licenses, which I hate. I work 915.67s - 923.37s | for a vendor. Take every penny you can. You paid for it. Lots of bug reports, but ain't 923.37s - 927.05s | no one fixing anything. So we've got lots of reports. They're not getting to the right 927.05s - 931.85s | people. Maybe there's lots of false positives. Maybe we're just not distributing them well. 931.85s - 936.81s | Maybe we're just not scanning the right things. Maybe we're scanning so rarely that it's unhelpful, 936.81s - 943.29s | but things are just not getting fixed. Um, inconsistent program. So I see this a lot. 943.29s - 947.89s | I see huge inconsistencies. Like one team has to do this huge architecture review. And 947.89s - 954.05s | I worked at this one place and they had an 80 page template. So it was like 160 pages when 954.05s - 957.93s | you filled it out. And guess how many people filled it out? Zero. You can't see I'm doing 957.93s - 963.41s | this. Yeah. Um, no, that doesn't work. And usually they always have a SAS and a DAS, 963.41s - 968.45s | um, little to no documentation. And the most common thing anyone ever says is, 968.45s - 973.65s | why won't the devs fix the bugs? I'm never going to talk to them or interact with them 973.81s - 977.89s | or provide support. I'm not going to even ask them this question. I'm going to ask everyone 977.89s - 981.65s | else in the entire company


chunk_text:
not distributing them well. 931.85s - 936.81s | Maybe we're just not scanning the right things. Maybe we're scanning so rarely that it's unhelpful, 936.81s - 943.29s | but things are just not getting fixed. Um, inconsistent program. So I see this a lot. 943.29s - 947.89s | I see huge inconsistencies. Like one team has to do this huge architecture review. And 947.89s - 954.05s | I worked at this one place and they had an 80 page template. So it was like 160 pages when 954.05s - 957.93s | you filled it out. And guess how many people filled it out? Zero. You can't see I'm doing 957.93s - 963.41s | this. Yeah. Um, no, that doesn't work. And usually they always have a SAS and a DAS, 963.41s - 968.45s | um, little to no documentation. And the most common thing anyone ever says is, 968.45s - 973.65s | why won't the devs fix the bugs? I'm never going to talk to them or interact with them 973.81s - 977.89s | or provide support. I'm not going to even ask them this question. I'm going to ask everyone 977.89s - 981.65s | else in the entire company this question. This is a thing that I hear all the time. I'm like, 981.65s - 986.21s | did you ask the devs why they're not fixing it? No. When's the last time you talked to them? Never. 987.25s - 992.69s | I see the beginning of your problem. So why is this model bad? I really like dragons and I just 992.69s - 999.09s | wanted to have dragons in my presentation. Um, okay. So the coverage is bad. It's not terrible. 999.09s - 1005.25s | It's not like the last one, but the coverage is bad. Not much is fixed. So we as an industry are 1005.25s - 1012.05s | not here to find bugs. We are here to reduce organizational risk in a meaningful and lasting 1012.05s - 1017.73s | way. That's our job. It does not matter if you find 45,000 bugs, you've found every bug that 1017.73s - 1023.49s | exists. If no one's fixing anything, in my opinion, your paycheck is too big. What we 1023.49s - 1027.97s | want to do is fix the things. We want to prevent the things from happening in the first place. 1027.97s - 1033.81s | We want


chunk_text:
this question. This is a thing that I hear all the time. I'm like, 981.65s - 986.21s | did you ask the devs why they're not fixing it? No. When's the last time you talked to them? Never. 987.25s - 992.69s | I see the beginning of your problem. So why is this model bad? I really like dragons and I just 992.69s - 999.09s | wanted to have dragons in my presentation. Um, okay. So the coverage is bad. It's not terrible. 999.09s - 1005.25s | It's not like the last one, but the coverage is bad. Not much is fixed. So we as an industry are 1005.25s - 1012.05s | not here to find bugs. We are here to reduce organizational risk in a meaningful and lasting 1012.05s - 1017.73s | way. That's our job. It does not matter if you find 45,000 bugs, you've found every bug that 1017.73s - 1023.49s | exists. If no one's fixing anything, in my opinion, your paycheck is too big. What we 1023.49s - 1027.97s | want to do is fix the things. We want to prevent the things from happening in the first place. 1027.97s - 1033.81s | We want to protect artworks and you're just not doing it as well as you could with this program. 1033.81s - 1040.53s | And so how do we mature it? I used an AI to make this. I was like, show me a little girl 1040.53s - 1045.01s | growing up and becoming more mature. And this is what the AI gave me. I'm like, I'll take it. 1045.01s - 1049.89s | Sounds good. Okay. So we want to do everything from the previous maturity model. I was like, 1049.89s - 1053.81s | show me a little girl maturing. And this is, I guess this is how little girls mature now. 1054.29s - 1059.33s | Okay. So then the number one thing I would do is hire more AppSec folks. And I realize I am 1059.33s - 1067.41s | an AppSec folks. So I am biased, but I kind of think we're awesome. But really though, AppSec folks. 1068.53s - 1074.05s | Okay. So one of the pieces of advice is your entire AppSec team can not just be pen testers. 1075.25s - 1080.29s | You have to have one of those people at least because we need them, but you can't


chunk_text:
to protect artworks and you're just not doing it as well as you could with this program. 1033.81s - 1040.53s | And so how do we mature it? I used an AI to make this. I was like, show me a little girl 1040.53s - 1045.01s | growing up and becoming more mature. And this is what the AI gave me. I'm like, I'll take it. 1045.01s - 1049.89s | Sounds good. Okay. So we want to do everything from the previous maturity model. I was like, 1049.89s - 1053.81s | show me a little girl maturing. And this is, I guess this is how little girls mature now. 1054.29s - 1059.33s | Okay. So then the number one thing I would do is hire more AppSec folks. And I realize I am 1059.33s - 1067.41s | an AppSec folks. So I am biased, but I kind of think we're awesome. But really though, AppSec folks. 1068.53s - 1074.05s | Okay. So one of the pieces of advice is your entire AppSec team can not just be pen testers. 1075.25s - 1080.29s | You have to have one of those people at least because we need them, but you can't have a team 1080.37s - 1084.21s | but you can't have a team where you have five AppSec folks and every single one of them's just 1084.21s - 1088.85s | got the pen testing skills. And like, they don't, none of them have ever been a dev. None of them 1088.85s - 1092.61s | know how to read code or maybe they do know how to read code, but like they just know how to do 1092.61s - 1096.53s | pen testing. They don't know how to do code review. They don't know how to do a threat model. 1096.53s - 1101.97s | They don't know how to write a policy. So you need a well-rounded AppSec team with a whole bunch of 1101.97s - 1106.61s | different types of skill sets. That's very important. One of them needs to have that pen 1106.61s - 1110.93s | tester. I'm going to F up your shit type of thing. But the rest of them, like you have to 1110.93s - 1116.61s | have a rainbow type of team. This is one of those times when diversity can, like diversity of 1116.61s - 1123.81s | experience and like skillset will really, really


chunk_text:
have a team 1080.37s - 1084.21s | but you can't have a team where you have five AppSec folks and every single one of them's just 1084.21s - 1088.85s | got the pen testing skills. And like, they don't, none of them have ever been a dev. None of them 1088.85s - 1092.61s | know how to read code or maybe they do know how to read code, but like they just know how to do 1092.61s - 1096.53s | pen testing. They don't know how to do code review. They don't know how to do a threat model. 1096.53s - 1101.97s | They don't know how to write a policy. So you need a well-rounded AppSec team with a whole bunch of 1101.97s - 1106.61s | different types of skill sets. That's very important. One of them needs to have that pen 1106.61s - 1110.93s | tester. I'm going to F up your shit type of thing. But the rest of them, like you have to 1110.93s - 1116.61s | have a rainbow type of team. This is one of those times when diversity can, like diversity of 1116.61s - 1123.81s | experience and like skillset will really, really bring you a lot of value. Reassess your tools. 1123.81s - 1129.73s | So if it's been two or three years and you still haven't rolled your SAS, DAST, AST, whatever 1129.73s - 1135.49s | acronym thing out, it's the wrong tool. Done. You're done with it. Switch tools. 1136.29s - 1139.97s | I find that I'll work with companies and they're like, well, we've had it five years. And I'm like, 1139.97s - 1144.77s | yeah, and you're using 30% of your licenses. So for five years, you've been paying for 70% 1144.77s - 1151.17s | of things you're not using. You've wasted this many dollars. It's not working for you. It's like 1151.17s - 1158.05s | the sunk cost fallacy applies. Just get rid of it. Start again. Find a tool and make sure you 1158.05s - 1164.13s | evaluate it with your devs and make sure the rollout is fast. Don't buy a tool if it's going 1164.13s - 1168.45s | to take you two years to roll it out. I wanted to buy this IAST once. I was like so in love with it. 1168.45s - 1172.69s | I really, really wanted to buy it. And


chunk_text:
bring you a lot of value. Reassess your tools. 1123.81s - 1129.73s | So if it's been two or three years and you still haven't rolled your SAS, DAST, AST, whatever 1129.73s - 1135.49s | acronym thing out, it's the wrong tool. Done. You're done with it. Switch tools. 1136.29s - 1139.97s | I find that I'll work with companies and they're like, well, we've had it five years. And I'm like, 1139.97s - 1144.77s | yeah, and you're using 30% of your licenses. So for five years, you've been paying for 70% 1144.77s - 1151.17s | of things you're not using. You've wasted this many dollars. It's not working for you. It's like 1151.17s - 1158.05s | the sunk cost fallacy applies. Just get rid of it. Start again. Find a tool and make sure you 1158.05s - 1164.13s | evaluate it with your devs and make sure the rollout is fast. Don't buy a tool if it's going 1164.13s - 1168.45s | to take you two years to roll it out. I wanted to buy this IAST once. I was like so in love with it. 1168.45s - 1172.69s | I really, really wanted to buy it. And after three months, we still had not finished the proof of 1172.69s - 1177.01s | concept because I just couldn't get the team to roll it out. And my boss was like, you're going 1177.01s - 1182.29s | to roll this out for the rest of your career if we buy it. So it needs to be something that rolls 1182.29s - 1190.05s | out fast. Ensure your rollout's complete. Make the vendor give you every penny of value you paid for. 1190.05s - 1194.61s | Put us through our paces. I know that may sound like strange advice from a person that 1194.61s - 1199.33s | works at one of those places, but you should get every single bit of value you can for that thing 1199.33s - 1204.69s | you're paying for. And the thing you can do is if at six months, you still are not able to roll out 1204.69s - 1208.69s | all the licenses, you can say, well, you know what? It's been six months and we haven't been 1208.69s - 1212.77s | able to roll them out. Maybe I don't want to pay for the rest of the six months for those licenses


chunk_text:
after three months, we still had not finished the proof of 1172.69s - 1177.01s | concept because I just couldn't get the team to roll it out. And my boss was like, you're going 1177.01s - 1182.29s | to roll this out for the rest of your career if we buy it. So it needs to be something that rolls 1182.29s - 1190.05s | out fast. Ensure your rollout's complete. Make the vendor give you every penny of value you paid for. 1190.05s - 1194.61s | Put us through our paces. I know that may sound like strange advice from a person that 1194.61s - 1199.33s | works at one of those places, but you should get every single bit of value you can for that thing 1199.33s - 1204.69s | you're paying for. And the thing you can do is if at six months, you still are not able to roll out 1204.69s - 1208.69s | all the licenses, you can say, well, you know what? It's been six months and we haven't been 1208.69s - 1212.77s | able to roll them out. Maybe I don't want to pay for the rest of the six months for those licenses 1212.77s - 1218.45s | we're not using. Some companies I've been able to do is I'll say, I want to buy half in the first 1218.45s - 1221.89s | six months and the other half in the next six months, because I know it's going to take a long 1221.89s - 1227.49s | time. But ideally just get something that's easy to roll out if that is a possibility for you and 1227.49s - 1232.85s | the way that your stack looks, because it's not always possible. The hardest advice ever, 1232.85s - 1239.33s | provide support, make friends, talk to people, build trust. This is hard. So this can mean 1239.33s - 1245.89s | writing a one pager with security guidance, helping them with their frameworks. Being available is 1245.89s - 1250.13s | really, really hard because I know all of you are probably really, really busy, but this is 1250.13s - 1254.13s | something that creates a ton of value and you don't have to dye your hair purple. It just helps. All 1254.13s - 1259.09s | of you actually look really good in purple. Some of you just don't know it yet. Start to manage 1259.09s -


chunk_text:
1212.77s - 1218.45s | we're not using. Some companies I've been able to do is I'll say, I want to buy half in the first 1218.45s - 1221.89s | six months and the other half in the next six months, because I know it's going to take a long 1221.89s - 1227.49s | time. But ideally just get something that's easy to roll out if that is a possibility for you and 1227.49s - 1232.85s | the way that your stack looks, because it's not always possible. The hardest advice ever, 1232.85s - 1239.33s | provide support, make friends, talk to people, build trust. This is hard. So this can mean 1239.33s - 1245.89s | writing a one pager with security guidance, helping them with their frameworks. Being available is 1245.89s - 1250.13s | really, really hard because I know all of you are probably really, really busy, but this is 1250.13s - 1254.13s | something that creates a ton of value and you don't have to dye your hair purple. It just helps. All 1254.13s - 1259.09s | of you actually look really good in purple. Some of you just don't know it yet. Start to manage 1259.09s - 1265.01s | incidents better. Send your team on incident response training if you can. Figure out a way 1265.01s - 1270.21s | for actually, let me do this. Create a way to report incidents really quickly. Do incident 1270.21s - 1274.61s | training for devs so they know what it looks like and they can tell you when they see something bad 1274.61s - 1279.89s | and then create an incident response process. Make sure everyone knows it that needs to know it. 1279.89s - 1284.05s | A lot of these companies, they don't got nothing. They're really good at responding to malware. 1284.05s - 1288.29s | They're ready for ransomware. Everything else, they have no plan whatsoever. 1289.41s - 1294.05s | Model three. And we have how many minutes left? We have five minutes. Okay. I call this the 1294.05s - 1301.89s | stranglehold big spend. So you have every single tool. You have like 11 tools. You've spent all 1301.89s - 1307.57s | the money. You have a stranglehold governance. No one can breathe. It takes three weeks to make 1307.57s - 1313.97s | a one line change of code. There's constant friction. The security posture is not


chunk_text:
1265.01s | incidents better. Send your team on incident response training if you can. Figure out a way 1265.01s - 1270.21s | for actually, let me do this. Create a way to report incidents really quickly. Do incident 1270.21s - 1274.61s | training for devs so they know what it looks like and they can tell you when they see something bad 1274.61s - 1279.89s | and then create an incident response process. Make sure everyone knows it that needs to know it. 1279.89s - 1284.05s | A lot of these companies, they don't got nothing. They're really good at responding to malware. 1284.05s - 1288.29s | They're ready for ransomware. Everything else, they have no plan whatsoever. 1289.41s - 1294.05s | Model three. And we have how many minutes left? We have five minutes. Okay. I call this the 1294.05s - 1301.89s | stranglehold big spend. So you have every single tool. You have like 11 tools. You've spent all 1301.89s - 1307.57s | the money. You have a stranglehold governance. No one can breathe. It takes three weeks to make 1307.57s - 1313.97s | a one line change of code. There's constant friction. The security posture is not satisfying 1313.97s - 1320.37s | for how much you're spending and sec and dev don't talk unless they're yelling. I have worked here 1320.37s - 1327.01s | so many times. And you come in and I remember my friend Nicole, she's like, I walk in and I'm like, 1327.01s - 1332.29s | hey, I'm Nicole. I'm from security. I come in peace. And then I put my hands out like this. 1332.29s - 1337.41s | And hopefully people laugh. Sometimes they boo. And then I know what level I'm at to start and 1337.41s - 1343.33s | how much peacemaking I need to do. But the I come in peace really works well. So why is this model 1343.33s - 1349.89s | bad? You're spending a zillion dollars and you are not getting your money's worth. You are slowing 1349.89s - 1355.57s | down innovation. Maybe even people are quitting because they just can't stand how annoying, 1355.57s - 1361.57s | how much friction there is. You, the security team are petting the cat, which is a dev backwards 1361.57s - 1367.25s | all day long. And the devs are just like, oh, I used to work somewhere where I


chunk_text:
satisfying 1313.97s - 1320.37s | for how much you're spending and sec and dev don't talk unless they're yelling. I have worked here 1320.37s - 1327.01s | so many times. And you come in and I remember my friend Nicole, she's like, I walk in and I'm like, 1327.01s - 1332.29s | hey, I'm Nicole. I'm from security. I come in peace. And then I put my hands out like this. 1332.29s - 1337.41s | And hopefully people laugh. Sometimes they boo. And then I know what level I'm at to start and 1337.41s - 1343.33s | how much peacemaking I need to do. But the I come in peace really works well. So why is this model 1343.33s - 1349.89s | bad? You're spending a zillion dollars and you are not getting your money's worth. You are slowing 1349.89s - 1355.57s | down innovation. Maybe even people are quitting because they just can't stand how annoying, 1355.57s - 1361.57s | how much friction there is. You, the security team are petting the cat, which is a dev backwards 1361.57s - 1367.25s | all day long. And the devs are just like, oh, I used to work somewhere where I literally I saw 1367.25s - 1372.69s | the security guy. And then I went like this and my boss was like, did you literally just duck? 1372.69s - 1379.49s | And I was like, I'm so busted. Don't we don't want to be that. None of us want to be that. 1379.49s - 1384.85s | We're that way because so many other cultural things have happened. That's what led us to that. 1384.85s - 1391.01s | So I suggest scaling with either a security champions program, delegation, like specific 1391.01s - 1397.17s | delegation, automation. So I have like a bunch of things I can talk about how to scale your 1397.17s - 1403.89s | program better. But if you do a champs program, it's a big undertaking. Be serious about it. Be 1403.89s - 1409.01s | intentional. Do a really good job. I would love to talk to you about that after. I'm a big giant fan. 1409.01s - 1413.33s | I'm a bit obsessive. If you're not going to do a champions program, do an advocacy program to 1413.33s - 1418.85s | change the culture where you work so it's more positive. Make it a standard. Take all


chunk_text:
literally I saw 1367.25s - 1372.69s | the security guy. And then I went like this and my boss was like, did you literally just duck? 1372.69s - 1379.49s | And I was like, I'm so busted. Don't we don't want to be that. None of us want to be that. 1379.49s - 1384.85s | We're that way because so many other cultural things have happened. That's what led us to that. 1384.85s - 1391.01s | So I suggest scaling with either a security champions program, delegation, like specific 1391.01s - 1397.17s | delegation, automation. So I have like a bunch of things I can talk about how to scale your 1397.17s - 1403.89s | program better. But if you do a champs program, it's a big undertaking. Be serious about it. Be 1403.89s - 1409.01s | intentional. Do a really good job. I would love to talk to you about that after. I'm a big giant fan. 1409.01s - 1413.33s | I'm a bit obsessive. If you're not going to do a champions program, do an advocacy program to 1413.33s - 1418.85s | change the culture where you work so it's more positive. Make it a standard. Take all your 1418.85s - 1423.41s | guidance and guidelines, turn them into standards because you're ready for that now. And then provide 1423.41s - 1429.09s | training and workshops on how to apply that and help everyone become compliant. You will make 1429.09s - 1433.09s | friends, not enemies that way. Instead of just publishing a policy and then being like, good 1433.09s - 1439.01s | luck with that. Make your tools go fast. You want fast tools. You are paying a fortune. You deserve 1439.01s - 1444.05s | fast, efficient tools full of true positives. If you're not getting it, break up. 1445.49s - 1449.97s | Examine your APIs. So at this point, you should be taking care of your APIs, not just your front 1449.97s - 1455.65s | end web apps. You should be taking care of every type of software, including mobile, including IoT, 1455.65s - 1460.37s | including WebSockets. All of those things need attention now. And you might need to get a special 1460.37s - 1464.53s | subset of your tools to make sure you pay them the special attention they deserve. 1465.33s - 1471.09s | Embrace threat modeling, threat modeling rules. You want a company-wide


chunk_text:
your 1418.85s - 1423.41s | guidance and guidelines, turn them into standards because you're ready for that now. And then provide 1423.41s - 1429.09s | training and workshops on how to apply that and help everyone become compliant. You will make 1429.09s - 1433.09s | friends, not enemies that way. Instead of just publishing a policy and then being like, good 1433.09s - 1439.01s | luck with that. Make your tools go fast. You want fast tools. You are paying a fortune. You deserve 1439.01s - 1444.05s | fast, efficient tools full of true positives. If you're not getting it, break up. 1445.49s - 1449.97s | Examine your APIs. So at this point, you should be taking care of your APIs, not just your front 1449.97s - 1455.65s | end web apps. You should be taking care of every type of software, including mobile, including IoT, 1455.65s - 1460.37s | including WebSockets. All of those things need attention now. And you might need to get a special 1460.37s - 1464.53s | subset of your tools to make sure you pay them the special attention they deserve. 1465.33s - 1471.09s | Embrace threat modeling, threat modeling rules. You want a company-wide secret management at this 1471.09s - 1476.93s | point. I do not sell a secret management tool. I wish I did because they are amazing and you need 1476.93s - 1484.21s | one. Your whole company should have a management program, like an app, but also just like a plan 1484.21s - 1489.09s | to manage your secrets as a whole so that you never, ever leak a secret again. You want to do 1489.09s - 1494.21s | continuous scanning. And I don't mean this in like a swear word marketing buzzword type of way. 1494.21s - 1498.45s | I mean like set up your tools so they're always scanning all the time and you're reviewing them 1498.45s - 1503.17s | when you see something disconcerting. You can do this with more modern tools where they're just 1503.17s - 1508.53s | kind of scanning on their own and then you review it when you have time. Training that doesn't suck. 1509.33s - 1513.97s | Evaluate the training with your devs to see if they actually like it. Do the one they like. 1514.77s - 1519.97s | Do the one that they're willing to tolerate. This might mean it's like one


chunk_text:
secret management at this 1471.09s - 1476.93s | point. I do not sell a secret management tool. I wish I did because they are amazing and you need 1476.93s - 1484.21s | one. Your whole company should have a management program, like an app, but also just like a plan 1484.21s - 1489.09s | to manage your secrets as a whole so that you never, ever leak a secret again. You want to do 1489.09s - 1494.21s | continuous scanning. And I don't mean this in like a swear word marketing buzzword type of way. 1494.21s - 1498.45s | I mean like set up your tools so they're always scanning all the time and you're reviewing them 1498.45s - 1503.17s | when you see something disconcerting. You can do this with more modern tools where they're just 1503.17s - 1508.53s | kind of scanning on their own and then you review it when you have time. Training that doesn't suck. 1509.33s - 1513.97s | Evaluate the training with your devs to see if they actually like it. Do the one they like. 1514.77s - 1519.97s | Do the one that they're willing to tolerate. This might mean it's like one day a week for 1519.97s - 1526.21s | three weeks. It might mean it's a one hour every other week. It might mean it's a full day for 1526.21s - 1531.17s | three days in a row and it's interactive and they get to like move around. There's many different 1531.17s - 1536.13s | types of trainings. Don't just go with the cheap one. Don't just go with the popular one. Go with 1536.13s - 1542.93s | the one they like the best because you will get the best results. If you have a WAF on stuff, 1542.93s - 1547.17s | if you have the money to a rasp, it's just better. I know a lot of people are going to 1547.17s - 1553.17s | swear at me about that after. Your AppSec team should be trained in incident response or your 1553.17s - 1558.85s | incident response team should have some training in AppSec so that if a real AppSec incident like 1558.85s - 1564.53s | a big one happens, you are ready. This is more advanced and that's okay. And lastly, use a data 1564.53s - 1570.85s | driven approach. See that giant smile he has? It's gorgeous.


chunk_text:
day a week for 1519.97s - 1526.21s | three weeks. It might mean it's a one hour every other week. It might mean it's a full day for 1526.21s - 1531.17s | three days in a row and it's interactive and they get to like move around. There's many different 1531.17s - 1536.13s | types of trainings. Don't just go with the cheap one. Don't just go with the popular one. Go with 1536.13s - 1542.93s | the one they like the best because you will get the best results. If you have a WAF on stuff, 1542.93s - 1547.17s | if you have the money to a rasp, it's just better. I know a lot of people are going to 1547.17s - 1553.17s | swear at me about that after. Your AppSec team should be trained in incident response or your 1553.17s - 1558.85s | incident response team should have some training in AppSec so that if a real AppSec incident like 1558.85s - 1564.53s | a big one happens, you are ready. This is more advanced and that's okay. And lastly, use a data 1564.53s - 1570.85s | driven approach. See that giant smile he has? It's gorgeous. It's wonderful because he's using data 1570.85s - 1575.41s | to improve his program. I talk about this a lot too. You should be gathering metrics on the 1575.41s - 1581.25s | regular and then using that to do experiments and then improving, improving, improving. Whatever's 1581.25s - 1585.33s | not working, you throw it out. Whatever is working, you do more of that. I know that sounds 1585.33s - 1591.17s | obvious, but taking that time every 90 days to look at your metrics and improve will bring you 1591.17s - 1597.17s | huge value over time. And I totally have one minute left. So conclusion, we learned three 1597.17s - 1601.81s | common AppSec models, how to identify the models, how to improve the models and build a better 1601.81s - 1606.53s | program. But more importantly, if you want to get your phones out, I have some resources. So 1607.25s - 1613.49s | I have free secure coding courses, AppSec courses. Next week I'm releasing incident response for devs, 1613.49s - 1618.45s | all of it's free. There is no payment except we add you to our newsletter, but me and my colleague 1618.45s - 1623.33s |


chunk_text:
It's wonderful because he's using data 1570.85s - 1575.41s | to improve his program. I talk about this a lot too. You should be gathering metrics on the 1575.41s - 1581.25s | regular and then using that to do experiments and then improving, improving, improving. Whatever's 1581.25s - 1585.33s | not working, you throw it out. Whatever is working, you do more of that. I know that sounds 1585.33s - 1591.17s | obvious, but taking that time every 90 days to look at your metrics and improve will bring you 1591.17s - 1597.17s | huge value over time. And I totally have one minute left. So conclusion, we learned three 1597.17s - 1601.81s | common AppSec models, how to identify the models, how to improve the models and build a better 1601.81s - 1606.53s | program. But more importantly, if you want to get your phones out, I have some resources. So 1607.25s - 1613.49s | I have free secure coding courses, AppSec courses. Next week I'm releasing incident response for devs, 1613.49s - 1618.45s | all of it's free. There is no payment except we add you to our newsletter, but me and my colleague 1618.45s - 1623.33s | Amanda write it and I think it doesn't suck very much. And you can just unsubscribe if you don't 1623.33s - 1630.13s | like it, but I didn't say that. Okay, next books. I love books. These books are not free. I only 1630.13s - 1634.85s | wrote one of them and my mom says that one's the best one, but I love DevOps and I feel like us 1634.85s - 1639.81s | security folks can learn a lot from the amazing DevOps folks, especially the researchers. This is 1639.81s - 1645.81s | really good content. Cyber Mentoring Monday, every single Monday on Twitter and on Mastodon InfoSec 1645.81s - 1651.89s | Exchange, I use this hashtag to match with people. I have so many people write me and they want an 1651.89s - 1657.09s | AppSec mentor and the people in this room, if you would answer one of them, you will make the whole 1657.09s - 1661.57s | year. Seriously, you've changed someone's entire life when you answer their call. 1661.57s - 1666.85s | And if I can just ask one favor from you is to answer someone and have a virtual coffee with them, 1666.85s - 1672.53s


chunk_text:
Amanda write it and I think it doesn't suck very much. And you can just unsubscribe if you don't 1623.33s - 1630.13s | like it, but I didn't say that. Okay, next books. I love books. These books are not free. I only 1630.13s - 1634.85s | wrote one of them and my mom says that one's the best one, but I love DevOps and I feel like us 1634.85s - 1639.81s | security folks can learn a lot from the amazing DevOps folks, especially the researchers. This is 1639.81s - 1645.81s | really good content. Cyber Mentoring Monday, every single Monday on Twitter and on Mastodon InfoSec 1645.81s - 1651.89s | Exchange, I use this hashtag to match with people. I have so many people write me and they want an 1651.89s - 1657.09s | AppSec mentor and the people in this room, if you would answer one of them, you will make the whole 1657.09s - 1661.57s | year. Seriously, you've changed someone's entire life when you answer their call. 1661.57s - 1666.85s | And if I can just ask one favor from you is to answer someone and have a virtual coffee with them, 1666.85s - 1672.53s | recommend a book, recommend a talk, just giving them your time and encouragement can literally 1672.53s - 1679.49s | change their entire career trajectory. And then lastly, me, I am a nerd on the internet. I do this 1679.49s - 1683.73s | all the time. It's basically all I do. I love giving stuff away for free. I'm not as good at 1683.73s - 1690.45s | business, but I'm really good at sharing. I am SheHacksPurple on all the things. And then lastly, 1691.09s - 1695.49s | thank you. Thank you so much for coming. There's so much cool stuff and you came to see this.


chunk_text:
| recommend a book, recommend a talk, just giving them your time and encouragement can literally 1672.53s - 1679.49s | change their entire career trajectory. And then lastly, me, I am a nerd on the internet. I do this 1679.49s - 1683.73s | all the time. It's basically all I do. I love giving stuff away for free. I'm not as good at 1683.73s - 1690.45s | business, but I'm really good at sharing. I am SheHacksPurple on all the things. And then lastly, 1691.09s - 1695.49s | thank you. Thank you so much for coming. There's so much cool stuff and you came to see this.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=PwcIyS9bc_o", "title": "DEF CON 32 - Gridlock The Dual Edged Sword of EV and Solar APIs in Grid Security - Vangelis Stykas", "description": "In this talk, we delve deep into the increasingly interconnected world of electronic vehicles (EVs), photovoltaic (PV) solar systems, and the broader power grid infrastructure\u2014a nexus that is becoming a fertile ground for potential large-scale cyber disruptions. As we navigate through this complex interplay of technology and infrastructure, we will uncover the critical vulnerabilities lurking within the API connections that bind these systems together. Our exploration will not only highlight these weaknesses but will also demonstrate, through real-world scenarios and potential attack vectors, how they can be exploited to launch sophisticated cyber-attacks, emphasizing the urgent need for robust security frameworks and proactive cybersecurity measures to safeguard our collective future. The advent of PV inverters and EV charging systems has been marred by the industry's \"rush to market\" mentality, leading to overlooked security considerations.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1748, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 2.10s - 9.86s | This text was transcribed using whisper model: large-v2 Hello all. Can you hear me first of all? Okay, nice. I'm going to take a picture. If anyone 9.86s - 23.69s | is not okay with that, please hide yourself. That's obligatory for my mom. She never believes 23.69s - 33.81s | that people come and hear me talk. So, yeah. Kind of a thing. So, welcome to my talk. Gridlock, 33.81s - 41.87s | the dual edge sort of EV and solar APIs in grid security. Fair warning, this talk is 41.87s - 49.75s | PG 17, which means I love saying fuck and shit. So, if you're not comfortable with that, 49.75s - 58.11s | can you please raise your hand? Everyone's okay with that? Really? Thank you for that. 58.11s - 63.63s | That's me. I'm Vangelis Thikas. I'm the CTO at the penetration testing firm which specializes 63.79s - 72.74s | in green energy, energy renewable and everything else, EV and PV penetration testing. What? 74.58s - 79.62s | Okay. That's me. I'm Vangelis Thikas. I'm the CTO of a penetration testing firm 80.26s - 87.62s | called Atropos. We're testing mainly EVs and PVs. My research industry is mainly APIs for IoT 87.62s - 92.58s | and for the past couple of years, malware, ransomware and other things that might get 92.58s -


chunk_text:
9.86s - 23.69s | is not okay with that, please hide yourself. That's obligatory for my mom. She never believes 23.69s - 33.81s | that people come and hear me talk. So, yeah. Kind of a thing. So, welcome to my talk. Gridlock, 33.81s - 41.87s | the dual edge sort of EV and solar APIs in grid security. Fair warning, this talk is 41.87s - 49.75s | PG 17, which means I love saying fuck and shit. So, if you're not comfortable with that, 49.75s - 58.11s | can you please raise your hand? Everyone's okay with that? Really? Thank you for that. 58.11s - 63.63s | That's me. I'm Vangelis Thikas. I'm the CTO at the penetration testing firm which specializes 63.79s - 72.74s | in green energy, energy renewable and everything else, EV and PV penetration testing. What? 74.58s - 79.62s | Okay. That's me. I'm Vangelis Thikas. I'm the CTO of a penetration testing firm 80.26s - 87.62s | called Atropos. We're testing mainly EVs and PVs. My research industry is mainly APIs for IoT 87.62s - 92.58s | and for the past couple of years, malware, ransomware and other things that might get 92.58s - 99.30s | me killed. But, yeah. That's just me. So, this talk is about solar panels. I'm going to be 99.30s - 105.94s | honest. I have no idea how they work. I'm not a solar panel specialist. I'm an API specialist. 106.58s - 111.14s | This talk is about APIs. If you thought that you were going to see any kind of 111.14s - 116.66s | solar shit or, I don't know, firmware things, you're on the wrong talk. Sorry about that. 117.22s - 123.06s | Quick intro. There are two kinds of installations of solar panel. The one is home panels which is 123.06s - 128.34s | from 1 kilowatt to 10 kilowatts. And then there are plants which is from 200 kilowatts to 20 128.34s - 135.54s | megawatts. The home are usually on roof and they're integrated there. The plants are maximizing 135.54s - 142.34s | profit and minimizing cost because, yeah, capitalism and shit. So, the solar market, 143.14s - 149.46s | it has several big players. They're mainly Chinese. Lots, and I mean lots of white label 149.46s - 154.10s | providers that provide generic implementation. We're going to see that they're really rushing


chunk_text:
99.30s | me killed. But, yeah. That's just me. So, this talk is about solar panels. I'm going to be 99.30s - 105.94s | honest. I have no idea how they work. I'm not a solar panel specialist. I'm an API specialist. 106.58s - 111.14s | This talk is about APIs. If you thought that you were going to see any kind of 111.14s - 116.66s | solar shit or, I don't know, firmware things, you're on the wrong talk. Sorry about that. 117.22s - 123.06s | Quick intro. There are two kinds of installations of solar panel. The one is home panels which is 123.06s - 128.34s | from 1 kilowatt to 10 kilowatts. And then there are plants which is from 200 kilowatts to 20 128.34s - 135.54s | megawatts. The home are usually on roof and they're integrated there. The plants are maximizing 135.54s - 142.34s | profit and minimizing cost because, yeah, capitalism and shit. So, the solar market, 143.14s - 149.46s | it has several big players. They're mainly Chinese. Lots, and I mean lots of white label 149.46s - 154.10s | providers that provide generic implementation. We're going to see that they're really rushing 154.10s - 161.30s | to market. And they have over 30 million current installations the past week that I checked. 162.90s - 168.18s | Yeah, you can see that we are moving towards solar panels. So, more and more solar panel 168.98s - 177.94s | energy is being used. Yeah, that's what the solar panel is. It consists of many cells, 177.94s - 183.22s | blah, blah, blah, things I don't understand. Things that if you understand, I'm really happy 183.22s - 193.49s | with you because you're really smart. But do you know what that is? So, that's Fortnite. 194.13s - 201.41s | My older son is playing Fortnite and he loves it. And apparently everyone who wins him either 201.41s - 210.53s | is a cheater or, I don't know, a hacker. And once upon a time there was a guy Tesla 2004 that 210.53s - 219.81s | kind of kicked his ass. So, we went after him for no apparent reason other than me being petty. 220.61s - 225.41s | So, what's the solar market? So, the solar market generates more than a terawatt globally. 225.41s - 231.57s | A terawatt is a little bit less than


chunk_text:
154.10s - 161.30s | to market. And they have over 30 million current installations the past week that I checked. 162.90s - 168.18s | Yeah, you can see that we are moving towards solar panels. So, more and more solar panel 168.98s - 177.94s | energy is being used. Yeah, that's what the solar panel is. It consists of many cells, 177.94s - 183.22s | blah, blah, blah, things I don't understand. Things that if you understand, I'm really happy 183.22s - 193.49s | with you because you're really smart. But do you know what that is? So, that's Fortnite. 194.13s - 201.41s | My older son is playing Fortnite and he loves it. And apparently everyone who wins him either 201.41s - 210.53s | is a cheater or, I don't know, a hacker. And once upon a time there was a guy Tesla 2004 that 210.53s - 219.81s | kind of kicked his ass. So, we went after him for no apparent reason other than me being petty. 220.61s - 225.41s | So, what's the solar market? So, the solar market generates more than a terawatt globally. 225.41s - 231.57s | A terawatt is a little bit less than what the states, the USA, is consuming every day. 232.37s - 236.69s | It's cheaper to produce. It has low maintenance and it can run unsupervised. 237.33s - 242.85s | But as it is expensive to store, it is easier to throw it to the grid, which, 244.53s - 248.37s | yeah, I don't know if you understand what they are doing. They are just throwing 249.01s - 258.13s | and depending stuff that is not there every day. I'm introducing you horror scenario. The horror 258.13s - 265.01s | scenario was a scenario that was built by a really smart guy that I cannot really pronounce his name 265.01s - 270.37s | because it has too many syllables. Sorry about that, Marcus. I'm gonna read it. It's the only 270.37s - 274.61s | wall of text that I'm going to read. The power grid needs to maintain a constant balance between 274.61s - 280.53s | supply or power. Its supply exceeds demands. There is, however, a limit to these countermeasures. 280.53s - 286.53s | So, they're doing some countermeasures. We need to maintain balance. But especially in Europe, 287.73s - 293.09s | power grids are in their wind, which


chunk_text:
what the states, the USA, is consuming every day. 232.37s - 236.69s | It's cheaper to produce. It has low maintenance and it can run unsupervised. 237.33s - 242.85s | But as it is expensive to store, it is easier to throw it to the grid, which, 244.53s - 248.37s | yeah, I don't know if you understand what they are doing. They are just throwing 249.01s - 258.13s | and depending stuff that is not there every day. I'm introducing you horror scenario. The horror 258.13s - 265.01s | scenario was a scenario that was built by a really smart guy that I cannot really pronounce his name 265.01s - 270.37s | because it has too many syllables. Sorry about that, Marcus. I'm gonna read it. It's the only 270.37s - 274.61s | wall of text that I'm going to read. The power grid needs to maintain a constant balance between 274.61s - 280.53s | supply or power. Its supply exceeds demands. There is, however, a limit to these countermeasures. 280.53s - 286.53s | So, they're doing some countermeasures. We need to maintain balance. But especially in Europe, 287.73s - 293.09s | power grids are in their wind, which means that nations are constantly exporting and importing 293.09s - 298.21s | power to each other. And power grid regulators have made agreements, blah, blah, blah. What 298.21s - 303.81s | that means is that if you take down Germany, you're probably going to take down France. You're 303.81s - 309.49s | probably going to take down Spain, probably the whole continent. So, yeah, that doesn't sound good 309.49s - 318.13s | to pretty much anyone. This is a practical solar power supply during the eclipse in Germany and how 318.13s - 324.77s | it was theoretically proven with some math I don't really understand that if you take down 324.77s - 331.57s | enough solar panels, you are going to take down the power grid for enough time. Again, mathematical 331.57s - 338.29s | models. I'm a simpleton. I don't understand what they're doing. But it says that at least Germany 338.29s - 345.97s | and France, as far as I know, cover 35 to 50% of its power using only PV installations, which means 345.97s - 352.77s | if you take them down, they would have huge problems. Horuscenario had several CVs on one 353.65s - 359.89s |


chunk_text:
means that nations are constantly exporting and importing 293.09s - 298.21s | power to each other. And power grid regulators have made agreements, blah, blah, blah. What 298.21s - 303.81s | that means is that if you take down Germany, you're probably going to take down France. You're 303.81s - 309.49s | probably going to take down Spain, probably the whole continent. So, yeah, that doesn't sound good 309.49s - 318.13s | to pretty much anyone. This is a practical solar power supply during the eclipse in Germany and how 318.13s - 324.77s | it was theoretically proven with some math I don't really understand that if you take down 324.77s - 331.57s | enough solar panels, you are going to take down the power grid for enough time. Again, mathematical 331.57s - 338.29s | models. I'm a simpleton. I don't understand what they're doing. But it says that at least Germany 338.29s - 345.97s | and France, as far as I know, cover 35 to 50% of its power using only PV installations, which means 345.97s - 352.77s | if you take them down, they would have huge problems. Horuscenario had several CVs on one 353.65s - 359.89s | inverter, SMA. They changed them for RCE. They RCE on those devices, and they interfere with 359.89s - 367.55s | the devices to destabilize the grid. What we are going to see today, we are going to see 368.43s - 374.35s | Horuscenario on steroids. We, unfortunately, we're not going to get any CVs because everything is 374.35s - 381.39s | going to be done with APIs. Cloud doesn't give you any CVs. You know that. We don't need any 381.39s - 387.31s | physical access. We don't need to be nearby. We can be in our beach house in Greece while hacking 387.31s - 394.99s | PVs. We could brick and munch. We're inverter agnostic because we are just using the cloud, 394.99s - 402.30s | and we're looking at more or less a little bit over 500 gigabit hours. Quick intro on my tool 402.30s - 408.62s | set. Deer Search, Burpsuit, ZXD compiler, APK Lab I.O., which unfortunately is no longer working, 409.42s - 413.98s | one small droplet on DigitalOcean, Sudan I.O. so that I could find more people, 414.54s - 422.99s | and basic web application penetration testing. Steps that I was doing, I followed,


chunk_text:
inverter, SMA. They changed them for RCE. They RCE on those devices, and they interfere with 359.89s - 367.55s | the devices to destabilize the grid. What we are going to see today, we are going to see 368.43s - 374.35s | Horuscenario on steroids. We, unfortunately, we're not going to get any CVs because everything is 374.35s - 381.39s | going to be done with APIs. Cloud doesn't give you any CVs. You know that. We don't need any 381.39s - 387.31s | physical access. We don't need to be nearby. We can be in our beach house in Greece while hacking 387.31s - 394.99s | PVs. We could brick and munch. We're inverter agnostic because we are just using the cloud, 394.99s - 402.30s | and we're looking at more or less a little bit over 500 gigabit hours. Quick intro on my tool 402.30s - 408.62s | set. Deer Search, Burpsuit, ZXD compiler, APK Lab I.O., which unfortunately is no longer working, 409.42s - 413.98s | one small droplet on DigitalOcean, Sudan I.O. so that I could find more people, 414.54s - 422.99s | and basic web application penetration testing. Steps that I was doing, I followed, 423.79s - 429.31s | I tried to find a demo account. If I couldn't find a demo account, I'd register a new account. 429.31s - 435.31s | I would find obvious, and I mean really obvious, web issues. I try to control devices by exploiting 435.31s - 441.87s | those obvious issues, and I would really want to hack Tesla 2004 because he kicked my son's 442.59s - 450.99s | fortnight. My results, SolrMan, Sunsync, Solax, Growad, Ingecom, Foxes, everyone, 450.99s - 457.79s | Platform Admin, SolrMan, I couldn't upgrade the firmware. The other thing is, I don't know who 457.79s - 463.79s | of you are a researcher in here, but you're going to get a lot of those ads. So if you are researching 463.79s - 468.99s | for PVs, you're going to get a lot of PV ads. If you are researching for, I don't know, sex toys, 468.99s - 474.27s | you're going to get a lot of ads for sex toys, and this goes to all your house, so yeah, 474.27s - 482.82s | not a great thing. The disclosure was a train wreck. I have been trying for the past three and 482.82s -


chunk_text:
423.79s - 429.31s | I tried to find a demo account. If I couldn't find a demo account, I'd register a new account. 429.31s - 435.31s | I would find obvious, and I mean really obvious, web issues. I try to control devices by exploiting 435.31s - 441.87s | those obvious issues, and I would really want to hack Tesla 2004 because he kicked my son's 442.59s - 450.99s | fortnight. My results, SolrMan, Sunsync, Solax, Growad, Ingecom, Foxes, everyone, 450.99s - 457.79s | Platform Admin, SolrMan, I couldn't upgrade the firmware. The other thing is, I don't know who 457.79s - 463.79s | of you are a researcher in here, but you're going to get a lot of those ads. So if you are researching 463.79s - 468.99s | for PVs, you're going to get a lot of PV ads. If you are researching for, I don't know, sex toys, 468.99s - 474.27s | you're going to get a lot of ads for sex toys, and this goes to all your house, so yeah, 474.27s - 482.82s | not a great thing. The disclosure was a train wreck. I have been trying for the past three and 482.82s - 490.18s | a half years to disclose. Only one and a half vendors responded and acted on the disclosure. 490.18s - 496.02s | The disclosure had everything that they needed to do. I tried really, really hard to get any 496.02s - 501.30s | reaction. I emailed, I tweeted, I called them on their phone. I couldn't do anything else other 501.30s - 509.94s | than drive there and talk to them, but that's not feasible, I guess. Okay. The responses. 509.94s - 515.46s | SolrMan fixed in five days. Sunsync responded after three years. It's no longer no response. 515.46s - 521.78s | After my OWASP talk, they did respond and try to fix it. Solax autoresponded. They responded 521.86s - 528.50s | to their DMs, and then they went, well, Growad asked me where I'm from, because that makes sense, 529.30s - 537.46s | and Injecon didn't do anything. So I know you're here for the zero days. I'm not legally allowed 537.46s - 542.66s | to release the zero days, but I can talk about them, and if you have common sense, you can find 542.66s - 549.38s | pretty much everything. What's the plan? I really


chunk_text:
490.18s | a half years to disclose. Only one and a half vendors responded and acted on the disclosure. 490.18s - 496.02s | The disclosure had everything that they needed to do. I tried really, really hard to get any 496.02s - 501.30s | reaction. I emailed, I tweeted, I called them on their phone. I couldn't do anything else other 501.30s - 509.94s | than drive there and talk to them, but that's not feasible, I guess. Okay. The responses. 509.94s - 515.46s | SolrMan fixed in five days. Sunsync responded after three years. It's no longer no response. 515.46s - 521.78s | After my OWASP talk, they did respond and try to fix it. Solax autoresponded. They responded 521.86s - 528.50s | to their DMs, and then they went, well, Growad asked me where I'm from, because that makes sense, 529.30s - 537.46s | and Injecon didn't do anything. So I know you're here for the zero days. I'm not legally allowed 537.46s - 542.66s | to release the zero days, but I can talk about them, and if you have common sense, you can find 542.66s - 549.38s | pretty much everything. What's the plan? I really want them to fix it, really. I just want to act 549.38s - 555.30s | on it and fix it. I want to prove that you can control gigawatts of power effectively, 555.30s - 563.30s | destabilizing country power grids, help avoiding global outages, and I don't know, make the whole 563.30s - 571.54s | world a safer place, I guess. What did I find? EIDR, RCE, broken authentication, broken 571.54s - 582.16s | authorization, EIDR, EIDR, EIDR. What did I get? Lots, and I mean lots, I mean couple of million, 582.16s - 588.56s | couple of tens of million of personal data, access to administrative accounts and panel, 588.56s - 596.61s | ways to manipulate and break panels, access to internal networks. You can see how many gigawatts 596.61s - 604.69s | you could control from their panels. I'm not going to list them, and yeah, I know there are more 605.57s - 613.73s | clouds, but yeah, I couldn't hack some of them, and also my wife didn't allow me to buy any more 613.73s - 624.98s | inverters because, I don't know, reasons. Solarman, pretty huge player, EIDR on the user add 624.98s - 629.94s |


chunk_text:
want them to fix it, really. I just want to act 549.38s - 555.30s | on it and fix it. I want to prove that you can control gigawatts of power effectively, 555.30s - 563.30s | destabilizing country power grids, help avoiding global outages, and I don't know, make the whole 563.30s - 571.54s | world a safer place, I guess. What did I find? EIDR, RCE, broken authentication, broken 571.54s - 582.16s | authorization, EIDR, EIDR, EIDR. What did I get? Lots, and I mean lots, I mean couple of million, 582.16s - 588.56s | couple of tens of million of personal data, access to administrative accounts and panel, 588.56s - 596.61s | ways to manipulate and break panels, access to internal networks. You can see how many gigawatts 596.61s - 604.69s | you could control from their panels. I'm not going to list them, and yeah, I know there are more 605.57s - 613.73s | clouds, but yeah, I couldn't hack some of them, and also my wife didn't allow me to buy any more 613.73s - 624.98s | inverters because, I don't know, reasons. Solarman, pretty huge player, EIDR on the user add 624.98s - 629.94s | functionality, I could add a user with any privilege on any group, groups and organizations 629.94s - 635.62s | were consecutive integers, which means I could pretty much add the user to every group with 635.62s - 643.78s | admin privileges. What did I get? Full functionality, potential GDPR violation, I love that I should say 643.78s - 649.54s | potential because I didn't get it, but this was GDPR violation with lacking user and company data, 649.54s - 656.34s | information on plants and power generated. Really good response, they fixed it in five days, 656.34s - 664.74s | they chased for verification, so all in all, good for them. Sunsync is probably one of the biggest 664.74s - 671.46s | players, you don't know them because they're white label, so yeah, you might, if you have FPV, 671.46s - 676.42s | you might have this back end, but with another label in front, and their issues were, 680.42s - 684.66s | there was missing the whole point of authorization altogether. 686.82s - 691.70s | If you're taking pictures, take that picture because you're gonna see that slide a lot for a 691.70s - 698.02s | lot of platforms.


chunk_text:
functionality, I could add a user with any privilege on any group, groups and organizations 629.94s - 635.62s | were consecutive integers, which means I could pretty much add the user to every group with 635.62s - 643.78s | admin privileges. What did I get? Full functionality, potential GDPR violation, I love that I should say 643.78s - 649.54s | potential because I didn't get it, but this was GDPR violation with lacking user and company data, 649.54s - 656.34s | information on plants and power generated. Really good response, they fixed it in five days, 656.34s - 664.74s | they chased for verification, so all in all, good for them. Sunsync is probably one of the biggest 664.74s - 671.46s | players, you don't know them because they're white label, so yeah, you might, if you have FPV, 671.46s - 676.42s | you might have this back end, but with another label in front, and their issues were, 680.42s - 684.66s | there was missing the whole point of authorization altogether. 686.82s - 691.70s | If you're taking pictures, take that picture because you're gonna see that slide a lot for a 691.70s - 698.02s | lot of platforms. Full functionality of the application, again, potential GDPR violation 698.02s - 703.46s | because we are not violating the GDPR, information on plants, interact with the plants, 703.46s - 707.38s | firmware update, because who doesn't want a firmware update on everyone, 707.38s - 715.06s | backdoor to the network, platform admin. That's all the gateways, you can see we're looking at 715.06s - 723.30s | half a million gateways, and that's all the firmwares, so you could just upload the firmware 723.30s - 732.06s | and do whatever you want with that. The disclosure, but I want to say that 732.06s - 739.26s | after my OWASP talk, their CISO reached out and he was pretty furious that my emails, 739.26s - 744.86s | phones and everything else didn't reach to him, he was pretty cool, they said they fixed it. 746.94s - 753.42s | They did not. I reached out last week and told them that I'm gonna say that, and he said no, 753.42s - 757.98s | we fixed them, so yeah, you do what you want with that information. 758.86s - 768.58s | Grobat is probably the biggest, and I mean the biggest player in there.


chunk_text:
Full functionality of the application, again, potential GDPR violation 698.02s - 703.46s | because we are not violating the GDPR, information on plants, interact with the plants, 703.46s - 707.38s | firmware update, because who doesn't want a firmware update on everyone, 707.38s - 715.06s | backdoor to the network, platform admin. That's all the gateways, you can see we're looking at 715.06s - 723.30s | half a million gateways, and that's all the firmwares, so you could just upload the firmware 723.30s - 732.06s | and do whatever you want with that. The disclosure, but I want to say that 732.06s - 739.26s | after my OWASP talk, their CISO reached out and he was pretty furious that my emails, 739.26s - 744.86s | phones and everything else didn't reach to him, he was pretty cool, they said they fixed it. 746.94s - 753.42s | They did not. I reached out last week and told them that I'm gonna say that, and he said no, 753.42s - 757.98s | we fixed them, so yeah, you do what you want with that information. 758.86s - 768.58s | Grobat is probably the biggest, and I mean the biggest player in there. I wasn't allowed to buy 768.58s - 778.26s | a Grobat device because it was like 5k and my wife told me that you're not allowed to spend 5k for 778.74s - 786.02s | research, so I had to Google some serials and then me being me, I'm doing that, I don't need it, 786.66s - 795.22s | I find some broken one for 200 euros, so I bought it and then I had full functionality on everything. 795.22s - 800.50s | What was the vulnerability? I don't know, pretty much everything, they didn't check anything, 800.50s - 805.46s | so full functionality of the application, potential GDPR violation, interact with the 805.46s - 811.06s | plants, firmware update on gateway, back to the network, platform admin, all in all, you know, 811.70s - 819.70s | terrible shit. How did the disclosure go? Dear customer, due to the spring festive holidays, 819.70s - 826.18s | we can reply in time, thanks for your understanding. That was January 26th of 826.98s - 835.70s | 2022. They do have a lot of spring festive holidays in China, I guess. 837.30s - 842.90s | Would you please advise which country you're from? Because


chunk_text:
I wasn't allowed to buy 768.58s - 778.26s | a Grobat device because it was like 5k and my wife told me that you're not allowed to spend 5k for 778.74s - 786.02s | research, so I had to Google some serials and then me being me, I'm doing that, I don't need it, 786.66s - 795.22s | I find some broken one for 200 euros, so I bought it and then I had full functionality on everything. 795.22s - 800.50s | What was the vulnerability? I don't know, pretty much everything, they didn't check anything, 800.50s - 805.46s | so full functionality of the application, potential GDPR violation, interact with the 805.46s - 811.06s | plants, firmware update on gateway, back to the network, platform admin, all in all, you know, 811.70s - 819.70s | terrible shit. How did the disclosure go? Dear customer, due to the spring festive holidays, 819.70s - 826.18s | we can reply in time, thanks for your understanding. That was January 26th of 826.98s - 835.70s | 2022. They do have a lot of spring festive holidays in China, I guess. 837.30s - 842.90s | Would you please advise which country you're from? Because it makes sense, if I'm from Greece, 842.90s - 847.70s | they shouldn't fix it, but if I'm from, I don't know, the States, it should. And then while I 847.70s - 854.74s | was researching, I also found out. Three years later, Grobat vulnerability disclosure policy, 854.74s - 861.46s | Grobat takes product security very seriously and is committed to protecting our users and their data. 862.58s - 869.46s | You know what? Fuck off Grobat. Grow a pair, respond to the disclosure emails and do something. 869.46s - 876.42s | They're the same thing, they didn't respond, they can go do a thing, I don't know. Solax 876.98s - 883.62s | is the fifth bigger or fourth there in the fifth, one of the five biggest 884.18s - 888.18s | providers in there. They were pretty good. And I mean, pretty good. 890.58s - 898.90s | They had only one either, but that either was really, really good. So when you were editing 898.90s - 909.06s | your user, you were also passing your user level. So when you see user level user, you usually end 909.06s - 915.70s | up writing, I don't know, user level administrator,


chunk_text:
it makes sense, if I'm from Greece, 842.90s - 847.70s | they shouldn't fix it, but if I'm from, I don't know, the States, it should. And then while I 847.70s - 854.74s | was researching, I also found out. Three years later, Grobat vulnerability disclosure policy, 854.74s - 861.46s | Grobat takes product security very seriously and is committed to protecting our users and their data. 862.58s - 869.46s | You know what? Fuck off Grobat. Grow a pair, respond to the disclosure emails and do something. 869.46s - 876.42s | They're the same thing, they didn't respond, they can go do a thing, I don't know. Solax 876.98s - 883.62s | is the fifth bigger or fourth there in the fifth, one of the five biggest 884.18s - 888.18s | providers in there. They were pretty good. And I mean, pretty good. 890.58s - 898.90s | They had only one either, but that either was really, really good. So when you were editing 898.90s - 909.06s | your user, you were also passing your user level. So when you see user level user, you usually end 909.06s - 915.70s | up writing, I don't know, user level administrator, user level super administrator or user level root. 915.70s - 923.54s | So remember that slide? Full functionality, potential GDPR violation, information, 923.54s - 928.50s | interact with the plans, firmware update, backdoor to the network, platform admin. 928.50s - 932.82s | You're going to see it a little bit more. Sorry about that. Sorry for repeating, but they're all shit. 935.06s - 942.66s | Yeah, that's 21,000 pages of installations. You can do the multiplication. That's a lot, 942.66s - 952.05s | and I mean a lot of devices. That's some EV chargers that they're still not there, but 952.05s - 958.93s | you can see the demo in there because I'm admin, as I said. Thank you for conducting Solax cloud 958.93s - 965.41s | support. We are extremely busy at the moment, and that moment has taken them three years. 966.93s - 972.37s | They're going to respond to me. Then I was starting calling. They didn't answer my calls. 972.37s - 980.05s | Finally, I just tweeted because it's Twitter, not X, fuck Elon Musk. And I just tweeted, 980.05s - 985.49s | can someone tell me what I should do with Solax? Then they said


chunk_text:
user level super administrator or user level root. 915.70s - 923.54s | So remember that slide? Full functionality, potential GDPR violation, information, 923.54s - 928.50s | interact with the plans, firmware update, backdoor to the network, platform admin. 928.50s - 932.82s | You're going to see it a little bit more. Sorry about that. Sorry for repeating, but they're all shit. 935.06s - 942.66s | Yeah, that's 21,000 pages of installations. You can do the multiplication. That's a lot, 942.66s - 952.05s | and I mean a lot of devices. That's some EV chargers that they're still not there, but 952.05s - 958.93s | you can see the demo in there because I'm admin, as I said. Thank you for conducting Solax cloud 958.93s - 965.41s | support. We are extremely busy at the moment, and that moment has taken them three years. 966.93s - 972.37s | They're going to respond to me. Then I was starting calling. They didn't answer my calls. 972.37s - 980.05s | Finally, I just tweeted because it's Twitter, not X, fuck Elon Musk. And I just tweeted, 980.05s - 985.49s | can someone tell me what I should do with Solax? Then they said that. So is there a problem with 985.49s - 990.77s | that? Can you tell us what the issue is? I told them, yeah, I sent an email to that, that, that, 990.77s - 996.37s | that, and that. Let me check. That was their answer. If you can see, I don't know if it's 996.37s - 1002.77s | possible, that's 2023. So they're either checking really hard or they're just ignoring me. 1003.73s - 1012.77s | Again, Solax, not cool. In GECON, there's MOLIS, so just 30,000 or 40,000 installation. 1014.93s - 1020.45s | They're based in Spain or Italy. I don't remember. Sorry about that. They were missing the basic 1020.45s - 1027.49s | concept of authorization. All IDs were consecutive integers. And again, full functionality, 1027.49s - 1032.77s | potential GDPR, interact with the plants, firmware update, backdoor, platform admin. 1032.77s - 1040.45s | Sorry for repeating myself, but they're shit. So you can see that we can also see the RAM, 1040.45s - 1046.69s | the storage, and there is a really, really small button at the top. Can you see it? It says 1046.69s - 1057.14s | sell. So you can just click on there


chunk_text:
that. So is there a problem with 985.49s - 990.77s | that? Can you tell us what the issue is? I told them, yeah, I sent an email to that, that, that, 990.77s - 996.37s | that, and that. Let me check. That was their answer. If you can see, I don't know if it's 996.37s - 1002.77s | possible, that's 2023. So they're either checking really hard or they're just ignoring me. 1003.73s - 1012.77s | Again, Solax, not cool. In GECON, there's MOLIS, so just 30,000 or 40,000 installation. 1014.93s - 1020.45s | They're based in Spain or Italy. I don't remember. Sorry about that. They were missing the basic 1020.45s - 1027.49s | concept of authorization. All IDs were consecutive integers. And again, full functionality, 1027.49s - 1032.77s | potential GDPR, interact with the plants, firmware update, backdoor, platform admin. 1032.77s - 1040.45s | Sorry for repeating myself, but they're shit. So you can see that we can also see the RAM, 1040.45s - 1046.69s | the storage, and there is a really, really small button at the top. Can you see it? It says 1046.69s - 1057.14s | sell. So you can just click on there and get a sale on each device. Again, you can also do, 1057.14s - 1065.30s | I don't know, reports, stop it. And you could also disable all their protections, which means 1065.30s - 1073.78s | that if you were someone who wants to do harm, you could make that thing be on fire. You could 1073.78s - 1091.42s | literally burn shit up remotely. Does anyone want to guess how the disclosure went? I called them 1092.14s - 1098.38s | and they just dropped the phone on me. When I said I want to do a vulnerability disclosure, 1098.38s - 1103.34s | I just heard the toot, toot, toot. They could also say fuck you, but okay. 1104.62s - 1112.54s | Foxes is the last one. These have only been around my disclosure for six months. So yeah, 1112.54s - 1121.18s | it's way above my 90 days, but yeah, still not good. They were pretty good too. They had 1121.18s - 1130.61s | only one issue. Their password reset was not that good. So they had, I don't know, 1130.61s - 1136.85s | most of the Chinese companies nowadays have a password reset that says, we send you


chunk_text:
and get a sale on each device. Again, you can also do, 1057.14s - 1065.30s | I don't know, reports, stop it. And you could also disable all their protections, which means 1065.30s - 1073.78s | that if you were someone who wants to do harm, you could make that thing be on fire. You could 1073.78s - 1091.42s | literally burn shit up remotely. Does anyone want to guess how the disclosure went? I called them 1092.14s - 1098.38s | and they just dropped the phone on me. When I said I want to do a vulnerability disclosure, 1098.38s - 1103.34s | I just heard the toot, toot, toot. They could also say fuck you, but okay. 1104.62s - 1112.54s | Foxes is the last one. These have only been around my disclosure for six months. So yeah, 1112.54s - 1121.18s | it's way above my 90 days, but yeah, still not good. They were pretty good too. They had 1121.18s - 1130.61s | only one issue. Their password reset was not that good. So they had, I don't know, 1130.61s - 1136.85s | most of the Chinese companies nowadays have a password reset that says, we send you a four 1136.85s - 1143.81s | digit pin. That pin was brute forcible and the user ID was consecutive integers, which means 1143.81s - 1149.09s | you could pretty much reset everyone's password with a Python script with for loop. 1150.93s - 1156.45s | Same thing. Sorry about that. Full functionality, Yada, Indirect, firmware update, 1156.45s - 1163.65s | backdoor to the network, platform admin, you name it, they have it. Again, anyone want to 1163.65s - 1175.66s | guess the disclosure? So enough with the photovoltaic. Let's go to EV chargers. 1176.62s - 1187.90s | Uh, just a reminder. We are not after the power grid. We're after a guy who is named Tesla 2004. 1187.90s - 1195.50s | He does probably doesn't own a panel, but he or his mom has a Tesla. So let's go up after some 1195.50s - 1205.01s | EV charges, right? Project TV, 2000 installation in the UK. Growat based again, department of 1205.01s - 1212.61s | transport approved. That's in the UK. Growat and Shenzhen are China based companies. Can you see 1213.81s - 1223.36s | the issue in this request? Anyone? No, it's not an either. You would wish it was


chunk_text:
a four 1136.85s - 1143.81s | digit pin. That pin was brute forcible and the user ID was consecutive integers, which means 1143.81s - 1149.09s | you could pretty much reset everyone's password with a Python script with for loop. 1150.93s - 1156.45s | Same thing. Sorry about that. Full functionality, Yada, Indirect, firmware update, 1156.45s - 1163.65s | backdoor to the network, platform admin, you name it, they have it. Again, anyone want to 1163.65s - 1175.66s | guess the disclosure? So enough with the photovoltaic. Let's go to EV chargers. 1176.62s - 1187.90s | Uh, just a reminder. We are not after the power grid. We're after a guy who is named Tesla 2004. 1187.90s - 1195.50s | He does probably doesn't own a panel, but he or his mom has a Tesla. So let's go up after some 1195.50s - 1205.01s | EV charges, right? Project TV, 2000 installation in the UK. Growat based again, department of 1205.01s - 1212.61s | transport approved. That's in the UK. Growat and Shenzhen are China based companies. Can you see 1213.81s - 1223.36s | the issue in this request? Anyone? No, it's not an either. You would wish it was an either. 1224.96s - 1230.16s | There is no authentication at all. So you were authenticating on the application. You were 1230.16s - 1235.76s | saying, yeah, I'm demo with a demo password. And then all the other requests didn't have 1235.76s - 1241.04s | any kind of authentication, any kind of JWT or cookies. They were just doing, yeah, he said he 1241.04s - 1246.64s | was that. Let's go with our lives. Fully lacking authentication. Check for a valid combination. 1246.64s - 1252.32s | Only once on login. Charger IDs were consecutive numbers, so it could be easily, and I mean really 1252.32s - 1260.66s | easily brute forced. Yeah. Full functionality, lock and lock, remote, backdoor, brick all the 1260.66s - 1268.98s | devices, platform admin. Disclosure. Oh, my lovely disclosure. Did not respond for weeks. 1268.98s - 1274.34s | Only responded when I had to reach out to BBC. Eventually fixed after a failed first attempt. 1274.34s - 1279.78s | You really don't want to have to resend the message and say, yeah, you know that fixed. 1279.78s - 1285.54s | That's not actually fixed, so you have to try harder. They have a stateless login


chunk_text:
an either. 1224.96s - 1230.16s | There is no authentication at all. So you were authenticating on the application. You were 1230.16s - 1235.76s | saying, yeah, I'm demo with a demo password. And then all the other requests didn't have 1235.76s - 1241.04s | any kind of authentication, any kind of JWT or cookies. They were just doing, yeah, he said he 1241.04s - 1246.64s | was that. Let's go with our lives. Fully lacking authentication. Check for a valid combination. 1246.64s - 1252.32s | Only once on login. Charger IDs were consecutive numbers, so it could be easily, and I mean really 1252.32s - 1260.66s | easily brute forced. Yeah. Full functionality, lock and lock, remote, backdoor, brick all the 1260.66s - 1268.98s | devices, platform admin. Disclosure. Oh, my lovely disclosure. Did not respond for weeks. 1268.98s - 1274.34s | Only responded when I had to reach out to BBC. Eventually fixed after a failed first attempt. 1274.34s - 1279.78s | You really don't want to have to resend the message and say, yeah, you know that fixed. 1279.78s - 1285.54s | That's not actually fixed, so you have to try harder. They have a stateless login or whatever 1285.54s - 1294.74s | the fuck that means. I'm not going to test it anymore. Also, do you remember the Grobat PV? 1294.74s - 1301.86s | They have the same thing. They just fixed it for the EV. I don't know why. I don't know. 1301.86s - 1312.42s | EV box, pretty big on the market. They have around 400,000 charging points. They're based in Amsterdam. 1312.42s - 1318.50s | They were acquired by ENCE. They were really, really, really good. They had a pretty solid API. 1321.47s - 1334.64s | Want to guess? Let's play a guess game. What's the issue in here? No one? Come on. It says when you 1334.64s - 1342.32s | update your user, you are also passing your role. Why would I pass my role? So let's try admin, 1342.40s - 1349.52s | account owner, and then admin, because I also want the fucking server. I just don't want only 1350.16s - 1357.68s | the EV chargers, which means I had access to pretty much everything. Total compromises, 1357.68s - 1362.80s | everything, potential GDPR violation, full admin functionality, which means I could give money, 1362.80s - 1369.04s | I could charge


chunk_text:
or whatever 1285.54s - 1294.74s | the fuck that means. I'm not going to test it anymore. Also, do you remember the Grobat PV? 1294.74s - 1301.86s | They have the same thing. They just fixed it for the EV. I don't know why. I don't know. 1301.86s - 1312.42s | EV box, pretty big on the market. They have around 400,000 charging points. They're based in Amsterdam. 1312.42s - 1318.50s | They were acquired by ENCE. They were really, really, really good. They had a pretty solid API. 1321.47s - 1334.64s | Want to guess? Let's play a guess game. What's the issue in here? No one? Come on. It says when you 1334.64s - 1342.32s | update your user, you are also passing your role. Why would I pass my role? So let's try admin, 1342.40s - 1349.52s | account owner, and then admin, because I also want the fucking server. I just don't want only 1350.16s - 1357.68s | the EV chargers, which means I had access to pretty much everything. Total compromises, 1357.68s - 1362.80s | everything, potential GDPR violation, full admin functionality, which means I could give money, 1362.80s - 1369.04s | I could charge back, I could do financial shit. It was really, really bad. But 1369.44s - 1375.28s | they responded in just two hours. They fixed it in 24 hours, double checked that everything was 1375.28s - 1384.30s | fixed. Excellent response. I'm happy when I see this kind of responses. Oh, my lovely wallbox. 1384.30s - 1391.50s | I don't know how many of you are familiar with EVs. I personally got that banned in the UK, 1392.06s - 1397.74s | so they probably hate me. So 200,000 users, they're based in Barcelona, 1398.70s - 1404.78s | merged with Kensington, and their aim to raise 300 million USD. Probably not because they're 1404.78s - 1413.26s | banned now. I had a second level IDOR, anything in the request body was not validated. I had found 1413.26s - 1419.42s | four different instances on this in the API, which means I found something, they fixed it, 1419.42s - 1424.94s | then I went to something else and said, fix that too. And then I said, I'm not doing a free 1424.94s - 1432.46s | penetration test for you. Fix your shit. Check your proper authentication. Total control over 1432.46s - 1439.82s |


chunk_text:
back, I could do financial shit. It was really, really bad. But 1369.44s - 1375.28s | they responded in just two hours. They fixed it in 24 hours, double checked that everything was 1375.28s - 1384.30s | fixed. Excellent response. I'm happy when I see this kind of responses. Oh, my lovely wallbox. 1384.30s - 1391.50s | I don't know how many of you are familiar with EVs. I personally got that banned in the UK, 1392.06s - 1397.74s | so they probably hate me. So 200,000 users, they're based in Barcelona, 1398.70s - 1404.78s | merged with Kensington, and their aim to raise 300 million USD. Probably not because they're 1404.78s - 1413.26s | banned now. I had a second level IDOR, anything in the request body was not validated. I had found 1413.26s - 1419.42s | four different instances on this in the API, which means I found something, they fixed it, 1419.42s - 1424.94s | then I went to something else and said, fix that too. And then I said, I'm not doing a free 1424.94s - 1432.46s | penetration test for you. Fix your shit. Check your proper authentication. Total control over 1432.46s - 1439.82s | all chargers. Lock and lock. No way to update firmware. Potential GDPR violation. Unfortunately, 1439.82s - 1447.15s | no platform admin. So they responded the next day. They fixed it in a couple of days. 1447.15s - 1454.27s | They re-engaged after a month. I found a second issue. They fixed it in a couple of days again. 1454.27s - 1458.99s | Then they wanted to engage to provide the site of their new hardware platform, 1458.99s - 1466.83s | which meant I had to sign an NDA and not talk about it, which, no thanks. I don't do NDAs. 1467.71s - 1475.79s | And then, as I said, charger pool amid warnings, hackers could attack national grid. So yeah, 1475.79s - 1485.12s | we're getting there. Kudos to the UK government. I think that's the last of the private ones. 1485.36s - 1490.56s | EoCharger, EoHub, it was the first charger in the UK. It had a lot, and I mean a lot, 1490.56s - 1497.12s | of teething problems. It had around 15,000 users estimated, and it's a fucking Raspberry Pi, 1499.41s - 1506.13s | which can be easily rooted. It had no bootloader security, and I was


chunk_text:
all chargers. Lock and lock. No way to update firmware. Potential GDPR violation. Unfortunately, 1439.82s - 1447.15s | no platform admin. So they responded the next day. They fixed it in a couple of days. 1447.15s - 1454.27s | They re-engaged after a month. I found a second issue. They fixed it in a couple of days again. 1454.27s - 1458.99s | Then they wanted to engage to provide the site of their new hardware platform, 1458.99s - 1466.83s | which meant I had to sign an NDA and not talk about it, which, no thanks. I don't do NDAs. 1467.71s - 1475.79s | And then, as I said, charger pool amid warnings, hackers could attack national grid. So yeah, 1475.79s - 1485.12s | we're getting there. Kudos to the UK government. I think that's the last of the private ones. 1485.36s - 1490.56s | EoCharger, EoHub, it was the first charger in the UK. It had a lot, and I mean a lot, 1490.56s - 1497.12s | of teething problems. It had around 15,000 users estimated, and it's a fucking Raspberry Pi, 1499.41s - 1506.13s | which can be easily rooted. It had no bootloader security, and I was able to recover, 1506.13s - 1513.25s | not only me, my good friend who is now not with us, Mike Polidoro, the full source code, 1514.21s - 1517.33s | and I mean two Python scripts because that was their source code, 1519.09s - 1524.37s | with hard-coded credentials and full documentation. Okay, let me show you something in there. 1524.93s - 1547.84s | It means you could potentially full decryption, total control, you could mimic the server 1547.84s - 1554.24s | communication, you can make the devices be part of a botnet, potential GDPR violation, 1554.96s - 1562.05s | credentials leakage, and platform admin. They tried. I'm not going to be 1563.49s - 1568.61s | bad with them. They responded in a timely function. They worked hard into reworking pretty 1568.61s - 1575.49s | much everything, and then they introduced their new and improved Eo Mini, which was still a 1575.49s - 1585.94s | Raspberry Pi. So all in all, they tried at least. My personal opinion, take it with a pinch of salt 1585.94s - 1593.38s | because I'm not a hardware expert. Raspberry Pi are a valid prototyping device, but not good 1593.38s - 1598.66s | to put


chunk_text:
able to recover, 1506.13s - 1513.25s | not only me, my good friend who is now not with us, Mike Polidoro, the full source code, 1514.21s - 1517.33s | and I mean two Python scripts because that was their source code, 1519.09s - 1524.37s | with hard-coded credentials and full documentation. Okay, let me show you something in there. 1524.93s - 1547.84s | It means you could potentially full decryption, total control, you could mimic the server 1547.84s - 1554.24s | communication, you can make the devices be part of a botnet, potential GDPR violation, 1554.96s - 1562.05s | credentials leakage, and platform admin. They tried. I'm not going to be 1563.49s - 1568.61s | bad with them. They responded in a timely function. They worked hard into reworking pretty 1568.61s - 1575.49s | much everything, and then they introduced their new and improved Eo Mini, which was still a 1575.49s - 1585.94s | Raspberry Pi. So all in all, they tried at least. My personal opinion, take it with a pinch of salt 1585.94s - 1593.38s | because I'm not a hardware expert. Raspberry Pi are a valid prototyping device, but not good 1593.38s - 1598.66s | to put into production. They're easily extracted all their data. They're easily routable, and 1598.66s - 1606.42s | there's no secure bootloader. Last one, and we should be off. Public chargers. I have looked 1606.42s - 1611.22s | after ChargePoint, which is an American electric vehicle. It's one of the top three public 1611.22s - 1616.74s | chargers providers in the world. A good friend told me that when someone says he's one of the 1616.74s - 1627.74s | top three, he's the third. They went public in 2021, and they had a publicly exposed unauthenticated 1627.74s - 1634.46s | GraphQL endpoint with introspection enabled. It was potentially leaking their full schema, 1634.46s - 1639.50s | and no authentication parameters were to be seen. So you could pretty much do whatever you want, 1639.50s - 1650.19s | but CMA and crime alert. API research is really, really, really tricky on that. Never, ever 1650.19s - 1657.23s | interact with a device that you don't own. If you mistakenly do it, notify the vendor immediately 1657.23s - 1662.27s | and stop doing whatever you are doing because you don't want to end up in jail. At least I don't 1662.27s - 1669.23s |


chunk_text:
into production. They're easily extracted all their data. They're easily routable, and 1598.66s - 1606.42s | there's no secure bootloader. Last one, and we should be off. Public chargers. I have looked 1606.42s - 1611.22s | after ChargePoint, which is an American electric vehicle. It's one of the top three public 1611.22s - 1616.74s | chargers providers in the world. A good friend told me that when someone says he's one of the 1616.74s - 1627.74s | top three, he's the third. They went public in 2021, and they had a publicly exposed unauthenticated 1627.74s - 1634.46s | GraphQL endpoint with introspection enabled. It was potentially leaking their full schema, 1634.46s - 1639.50s | and no authentication parameters were to be seen. So you could pretty much do whatever you want, 1639.50s - 1650.19s | but CMA and crime alert. API research is really, really, really tricky on that. Never, ever 1650.19s - 1657.23s | interact with a device that you don't own. If you mistakenly do it, notify the vendor immediately 1657.23s - 1662.27s | and stop doing whatever you are doing because you don't want to end up in jail. At least I don't 1662.27s - 1669.23s | want to end up in jail. They responded in an hour. They fixed it in the same day. Excellent response. 1670.11s - 1676.91s | They acknowledged the issue. I could have checked further, but as I said, my goal is to stay outside 1676.91s - 1688.26s | of prison. So yeah, that was probably a wise choice. For your takeaways, go with a provider 1688.26s - 1695.46s | that will act on problems. So no random white labels. Try to isolate IoT devices on their own 1696.26s - 1702.58s | villains. Vulnerabilities will happen and expect them to happen. Also, just a heads up. If your 1703.14s - 1710.82s | device will be on fire, your private villain will not really help. So take that under consideration. 1710.82s - 1717.62s | And for those being vendors, know that authorization is not equal to authentication. 1718.34s - 1721.86s | Push to market cannot always be the excuse. I understand that you have to 1722.58s - 1727.94s | rush to market because you are a startup, but after you are in the market for five years, 1727.94s - 1735.30s | you have to secure your seat or you will end up in


chunk_text:
want to end up in jail. They responded in an hour. They fixed it in the same day. Excellent response. 1670.11s - 1676.91s | They acknowledged the issue. I could have checked further, but as I said, my goal is to stay outside 1676.91s - 1688.26s | of prison. So yeah, that was probably a wise choice. For your takeaways, go with a provider 1688.26s - 1695.46s | that will act on problems. So no random white labels. Try to isolate IoT devices on their own 1696.26s - 1702.58s | villains. Vulnerabilities will happen and expect them to happen. Also, just a heads up. If your 1703.14s - 1710.82s | device will be on fire, your private villain will not really help. So take that under consideration. 1710.82s - 1717.62s | And for those being vendors, know that authorization is not equal to authentication. 1718.34s - 1721.86s | Push to market cannot always be the excuse. I understand that you have to 1722.58s - 1727.94s | rush to market because you are a startup, but after you are in the market for five years, 1727.94s - 1735.30s | you have to secure your seat or you will end up in one of your really bad lists. And pen test 1735.30s - 1744.69s | your things. Not by me. By anyone. Do try to secure yourself. That was me. Thank you.


chunk_text:
one of your really bad lists. And pen test 1735.30s - 1744.69s | your things. Not by me. By anyone. Do try to secure yourself. That was me. Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=H8Y-j0sYqvo", "title": "DEF CON 32 - Fine Grained Authorisation with Relationship Based Access Control - Ben Dechrai", "description": "Who can tag me in a post? If I move this file to another folder, who now has access? If my owner breaks up with his friend, will I still get a bone?\n\nWhether you're a human, or a dog, let's face it, authorisation is hard. Role-based access control is a great starting point but hard to scale. Attribute-based access control scales better, but neither are much good at answering more complex conditions, like whether friends-of-friends can read your posts. For such situations, we generally have to wrap this up into business logic.\n\nThis is where relationship-based access control (ReBAC) comes in, offering a nuanced approach to accessing resources without codifying that into the applications.\n\nIn this session, we'll look at how to define these relationships, experience live demos, and discover how we can deploy our own fine-grained authorisation service. Expect some tail-wagging insights and a few laughs as we explore access control from a canine's point of view.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1721, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.94s | This text was transcribed using whisper model: large-v2 All right. So with that in mind, welcome to the stage, Ben. 4.94s - 11.51s | Thank you. Hello everyone. Um, I'm going to be that annoying guy for the uh, person behind 14.11s - 19.01s | the camera. I like moving a lot, hence I've got the, the handheld. I don't like to be stuck 19.01s - 24.09s | behind a podium. But the main reason I'm here today is uh, cause I'd like to talk to you 24.09s - 29.13s | about some security matters that interest me. Uh, who here is familiar with access control 29.13s - 32.83s | within web applications in some way or form? About half of you. That's cool. Who knows 32.83s - 39.83s | what RBAC is? ABAC? Rebac? Cool. Increasingly dropping numbers of hands. That's kind of what I 40.51s - 44.31s | expected. I think we've got about 10% people here who know Rebac. So we're going to dive 44.31s - 48.15s | in and we're going to go a little bit deep dive into how Rebac works. Now normally this 48.15s - 53.85s | is a 45 minute to one hour conversation. So excuse me if I skip over some


chunk_text:
right. So with that in mind, welcome to the stage, Ben. 4.94s - 11.51s | Thank you. Hello everyone. Um, I'm going to be that annoying guy for the uh, person behind 14.11s - 19.01s | the camera. I like moving a lot, hence I've got the, the handheld. I don't like to be stuck 19.01s - 24.09s | behind a podium. But the main reason I'm here today is uh, cause I'd like to talk to you 24.09s - 29.13s | about some security matters that interest me. Uh, who here is familiar with access control 29.13s - 32.83s | within web applications in some way or form? About half of you. That's cool. Who knows 32.83s - 39.83s | what RBAC is? ABAC? Rebac? Cool. Increasingly dropping numbers of hands. That's kind of what I 40.51s - 44.31s | expected. I think we've got about 10% people here who know Rebac. So we're going to dive 44.31s - 48.15s | in and we're going to go a little bit deep dive into how Rebac works. Now normally this 48.15s - 53.85s | is a 45 minute to one hour conversation. So excuse me if I skip over some bits, but please 53.85s - 56.75s | come and ask me questions afterwards. But we're going to go a little bit deep on how 56.77s - 60.91s | the data actually gets stored so that we as developers understand how Rebac was going to 60.91s - 65.71s | help us and how the relationship based access control actually works or may not work for you. 65.71s - 70.29s | It's not always the right solution. But who am I? Um, I'm a guy who develops slides that 70.29s - 75.49s | have really bad contrast on LED screens. Uh, also I've been a software engineer for too 75.49s - 78.89s | many years. I don't, I used to put the number up there. Uh, it made me feel old so now I 78.89s - 83.03s | just do a sense. You can do the maths in your head. Uh, I love working with developer and 83.05s - 87.15s | open source communities. I've been doing that for about 20 years. I'm really passionate 87.15s - 90.59s | about security and privacy. If you want to talk to me about any of those things, those are 90.59s - 95.63s | my


chunk_text:
bits, but please 53.85s - 56.75s | come and ask me questions afterwards. But we're going to go a little bit deep on how 56.77s - 60.91s | the data actually gets stored so that we as developers understand how Rebac was going to 60.91s - 65.71s | help us and how the relationship based access control actually works or may not work for you. 65.71s - 70.29s | It's not always the right solution. But who am I? Um, I'm a guy who develops slides that 70.29s - 75.49s | have really bad contrast on LED screens. Uh, also I've been a software engineer for too 75.49s - 78.89s | many years. I don't, I used to put the number up there. Uh, it made me feel old so now I 78.89s - 83.03s | just do a sense. You can do the maths in your head. Uh, I love working with developer and 83.05s - 87.15s | open source communities. I've been doing that for about 20 years. I'm really passionate 87.15s - 90.59s | about security and privacy. If you want to talk to me about any of those things, those are 90.59s - 95.63s | my jam. Come talk to me afterwards. Uh, I'm currently working as a developer advocate for a 95.63s - 100.27s | company called ArcJet, hence the branding across my chest here. We're a, uh, a middle 100.27s - 104.41s | west security solution for your web applications. If you are writing any kind of web 104.41s - 108.17s | application at all, check out arcjet.com and just plug it in. It's free. Give it a try. 108.17s - 112.55s | We'd love to hear what you think about it. Uh, if you want to contact me, I've got the X 112.57s - 117.23s | logo on there, although I still like to call them Twitter. Um, I, I feel some ways about an 117.23s - 123.07s | organization, uh, whose community does not accept certain people's desire to change their 123.07s - 126.95s | identity. So I will not allow Twitter to change their identity either. So my Twitter handle 126.95s - 132.75s | is at Ben Dechry. My DMs are open. Uh, contact me if you like. It's, it's not an 132.75s - 137.69s | instruction. It's a, it's an offer. So let's get into it. Access control 101. Basics


chunk_text:
jam. Come talk to me afterwards. Uh, I'm currently working as a developer advocate for a 95.63s - 100.27s | company called ArcJet, hence the branding across my chest here. We're a, uh, a middle 100.27s - 104.41s | west security solution for your web applications. If you are writing any kind of web 104.41s - 108.17s | application at all, check out arcjet.com and just plug it in. It's free. Give it a try. 108.17s - 112.55s | We'd love to hear what you think about it. Uh, if you want to contact me, I've got the X 112.57s - 117.23s | logo on there, although I still like to call them Twitter. Um, I, I feel some ways about an 117.23s - 123.07s | organization, uh, whose community does not accept certain people's desire to change their 123.07s - 126.95s | identity. So I will not allow Twitter to change their identity either. So my Twitter handle 126.95s - 132.75s | is at Ben Dechry. My DMs are open. Uh, contact me if you like. It's, it's not an 132.75s - 137.69s | instruction. It's a, it's an offer. So let's get into it. Access control 101. Basics and 137.69s - 141.83s | understandings thereof. First thing we're going to have a look at, um, is the, the 141.87s - 145.01s | caricatures we're going to be looking at. So whenever it comes to access control, the dog 145.01s - 148.65s | wants the bone, right? So we're going to look at ways that we can stop or allow the dog 148.65s - 152.75s | from accessing the bone. First one's going to be using RBAC, role based access control. 152.75s - 156.05s | It's probably one of the simplest access control mechanisms. So we'll skip through this 156.05s - 159.55s | very quickly. Basically we have a number of roles. You've got an admin, you've got a 159.55s - 164.49s | manager, employee, and a guest. And in our case, our dog, this is Shadow. Shadow has a blue 164.49s - 169.73s | hat on. Blue hats are employees. Uh, and the door is locked to all, but the admins, 169.73s - 174.11s | managers, and employees, we don't want guest dogs getting to the bones. Only employee 174.11s - 178.91s | manager and admin dogs, my analogies fall apart a little bit sometimes, are going to


chunk_text:
and 137.69s - 141.83s | understandings thereof. First thing we're going to have a look at, um, is the, the 141.87s - 145.01s | caricatures we're going to be looking at. So whenever it comes to access control, the dog 145.01s - 148.65s | wants the bone, right? So we're going to look at ways that we can stop or allow the dog 148.65s - 152.75s | from accessing the bone. First one's going to be using RBAC, role based access control. 152.75s - 156.05s | It's probably one of the simplest access control mechanisms. So we'll skip through this 156.05s - 159.55s | very quickly. Basically we have a number of roles. You've got an admin, you've got a 159.55s - 164.49s | manager, employee, and a guest. And in our case, our dog, this is Shadow. Shadow has a blue 164.49s - 169.73s | hat on. Blue hats are employees. Uh, and the door is locked to all, but the admins, 169.73s - 174.11s | managers, and employees, we don't want guest dogs getting to the bones. Only employee 174.11s - 178.91s | manager and admin dogs, my analogies fall apart a little bit sometimes, are going to get 178.91s - 183.29s | access to the bone. So because, because Shadow has access, the door opens. Role based 183.29s - 189.05s | access control. Nice and simple. Next one. Attribute based access control. This is kind of 189.05s - 192.09s | like role based because you could say, well, the role is an attribute of a person, but 192.09s - 196.73s | attribute puts so many more layers on top of this. So we've got, uh, four attributes here 196.73s - 201.47s | of the dog. This is Min. Uh, this is a, a, a white Siberian husky. These are actual real 201.47s - 205.61s | dogs in my life. I like to relay them into my talks. Uh, there are four characteristics. 205.61s - 210.45s | Service dog, good boy, loyal, and fierce. I can tell you while Shadow is a service dog, Min 210.45s - 214.15s | will never be a service dog. If you've ever seen one of those dogs that just cannot control 214.15s - 217.99s | itself because it's always so bloody happy, that's Min. So she will never ever be a, a, a 217.99s - 223.75s | service dog. But she is


chunk_text:
get 178.91s - 183.29s | access to the bone. So because, because Shadow has access, the door opens. Role based 183.29s - 189.05s | access control. Nice and simple. Next one. Attribute based access control. This is kind of 189.05s - 192.09s | like role based because you could say, well, the role is an attribute of a person, but 192.09s - 196.73s | attribute puts so many more layers on top of this. So we've got, uh, four attributes here 196.73s - 201.47s | of the dog. This is Min. Uh, this is a, a, a white Siberian husky. These are actual real 201.47s - 205.61s | dogs in my life. I like to relay them into my talks. Uh, there are four characteristics. 205.61s - 210.45s | Service dog, good boy, loyal, and fierce. I can tell you while Shadow is a service dog, Min 210.45s - 214.15s | will never be a service dog. If you've ever seen one of those dogs that just cannot control 214.15s - 217.99s | itself because it's always so bloody happy, that's Min. So she will never ever be a, a, a 217.99s - 223.75s | service dog. But she is usually, uh, a good boy or, or loyal. She is not fierce. We've 223.77s - 227.65s | decided in this case that we're going to make her a loyal dog and the door will open if you 227.65s - 233.05s | are a good boy or a loyal dog. Now, as an aside, I go on tangents occasionally. You might be 233.05s - 237.35s | asking yourself, but why doesn't a service dog get a bone? Because a service dog is good, 237.35s - 242.49s | right? Service dogs deserve bones. Anybody agree with that? Nobody agrees with that? You 242.49s - 247.33s | all hate service dogs. That's what I'm learning about you lot. Jesus. Rough crowd. Um, no, 247.33s - 251.77s | service dogs are working. They don't get to eat. But we're going to layer an attribute on 251.79s - 255.49s | top of this. Because you could say, well, that's just a role, right? The attribute here we're 255.49s - 262.29s | going to put in is time. Who does have a dog? Wrong audience. Who has cats? Okay, let's 262.29s - 268.67s | pretend your cat likes eating bones. Or for those of you who


chunk_text:
usually, uh, a good boy or, or loyal. She is not fierce. We've 223.77s - 227.65s | decided in this case that we're going to make her a loyal dog and the door will open if you 227.65s - 233.05s | are a good boy or a loyal dog. Now, as an aside, I go on tangents occasionally. You might be 233.05s - 237.35s | asking yourself, but why doesn't a service dog get a bone? Because a service dog is good, 237.35s - 242.49s | right? Service dogs deserve bones. Anybody agree with that? Nobody agrees with that? You 242.49s - 247.33s | all hate service dogs. That's what I'm learning about you lot. Jesus. Rough crowd. Um, no, 247.33s - 251.77s | service dogs are working. They don't get to eat. But we're going to layer an attribute on 251.79s - 255.49s | top of this. Because you could say, well, that's just a role, right? The attribute here we're 255.49s - 262.29s | going to put in is time. Who does have a dog? Wrong audience. Who has cats? Okay, let's 262.29s - 268.67s | pretend your cat likes eating bones. Or for those of you who have dogs. Who, who, uh, lets 268.67s - 273.47s | their dog sleep in their bedroom with them at night? Who would like the sound of a crunching 273.47s - 278.43s | bone at 3 a.m.? No, I certainly don't like the sound of a crunching bone at 3 a.m., so if 278.43s - 286.43s | it's outside of 9 p.m. to 9 a.m., no bone for you. So, sadly, men get no bone. Uh, but there 286.43s - 289.67s | are plenty of other things we can do attributes on. We've got actual identity, physical 289.67s - 293.97s | location, network location, the time, the weather, whether or not you're authenticated to a 293.97s - 297.59s | system. There are lots of things you can layer on top of this as an attribute of whether or 297.59s - 302.13s | not somebody should get access to a resource. So, a bit more complexity, a bit more 302.13s - 306.47s | flexibility about how we can control our resources, which brings us on to relationship based 306.47s - 312.25s | access control. And this changes the paradigm quite significantly as I lose my balance. So, 312.25s - 317.79s | um,


chunk_text:
have dogs. Who, who, uh, lets 268.67s - 273.47s | their dog sleep in their bedroom with them at night? Who would like the sound of a crunching 273.47s - 278.43s | bone at 3 a.m.? No, I certainly don't like the sound of a crunching bone at 3 a.m., so if 278.43s - 286.43s | it's outside of 9 p.m. to 9 a.m., no bone for you. So, sadly, men get no bone. Uh, but there 286.43s - 289.67s | are plenty of other things we can do attributes on. We've got actual identity, physical 289.67s - 293.97s | location, network location, the time, the weather, whether or not you're authenticated to a 293.97s - 297.59s | system. There are lots of things you can layer on top of this as an attribute of whether or 297.59s - 302.13s | not somebody should get access to a resource. So, a bit more complexity, a bit more 302.13s - 306.47s | flexibility about how we can control our resources, which brings us on to relationship based 306.47s - 312.25s | access control. And this changes the paradigm quite significantly as I lose my balance. So, 312.25s - 317.79s | um, this dog doesn't actually have a name. Uh, who, who here had a dog? What was your dog's 317.79s - 324.29s | name? Liam. This is Liam. Thank you. Liam, um, is actually a dog. Dali designed Liam. I 324.29s - 329.09s | thought it came out a little bit like a cat, but, uh, that's what we're going with. So, um, Liam 329.09s - 333.93s | has an owner. Uh, you are the mad scientist, congratulations. Uh, so Liam's owner is a mad 333.93s - 338.05s | scientist. The mad scientist is friends with a farmer. The farmer has a whole load of 338.05s - 344.22s | sheep, and for the vegetarians in the audience, I apologize, but sheep have bones. Ten 344.22s - 348.94s | minutes? Oh, I need to stay back. This is, this is not good for me, because A, I'm going to fall 348.94s - 353.68s | off the back of the stage. Not too far, okay. Just right, right here, okay. The guy who 353.68s - 359.60s | likes to roam may no longer roam. That's okay. Uh, so, we, we have this, this chain of 359.60s - 364.94s | relationships, as you can


chunk_text:
this dog doesn't actually have a name. Uh, who, who here had a dog? What was your dog's 317.79s - 324.29s | name? Liam. This is Liam. Thank you. Liam, um, is actually a dog. Dali designed Liam. I 324.29s - 329.09s | thought it came out a little bit like a cat, but, uh, that's what we're going with. So, um, Liam 329.09s - 333.93s | has an owner. Uh, you are the mad scientist, congratulations. Uh, so Liam's owner is a mad 333.93s - 338.05s | scientist. The mad scientist is friends with a farmer. The farmer has a whole load of 338.05s - 344.22s | sheep, and for the vegetarians in the audience, I apologize, but sheep have bones. Ten 344.22s - 348.94s | minutes? Oh, I need to stay back. This is, this is not good for me, because A, I'm going to fall 348.94s - 353.68s | off the back of the stage. Not too far, okay. Just right, right here, okay. The guy who 353.68s - 359.60s | likes to roam may no longer roam. That's okay. Uh, so, we, we have this, this chain of 359.60s - 364.94s | relationships, as you can see. So, we can see here that, uh, Liam may or may not have access to 364.94s - 370.26s | the bone based on the rules that you can see. Now I'm getting feedback. Based on the rules 370.26s - 374.90s | you can see on the door there. Yep. Oh, sorry, let's just zoom in a little bit. The rules you 374.90s - 379.26s | can see on the, on the door there. So, with relationship based access control, we don't 379.26s - 387.47s | actually have a concept of users anymore. We just have a concept of entities and 387.47s - 395.69s | relationships. Entities and relationships. I'll keep going unless they actually stop me, or 395.69s - 400.61s | unless too many people in the audience cringe. So, here we've got an action. Can the action 400.65s - 405.23s | eat be completed on the bone? Uh, so, note that we're looking here at what can be done to the 405.23s - 410.27s | bone. We're not looking at what Shadow or, or Liam can do. We're looking at what can be done 410.27s - 414.69s | to the bone, what actions can be taking place. If


chunk_text:
see. So, we can see here that, uh, Liam may or may not have access to 364.94s - 370.26s | the bone based on the rules that you can see. Now I'm getting feedback. Based on the rules 370.26s - 374.90s | you can see on the door there. Yep. Oh, sorry, let's just zoom in a little bit. The rules you 374.90s - 379.26s | can see on the, on the door there. So, with relationship based access control, we don't 379.26s - 387.47s | actually have a concept of users anymore. We just have a concept of entities and 387.47s - 395.69s | relationships. Entities and relationships. I'll keep going unless they actually stop me, or 395.69s - 400.61s | unless too many people in the audience cringe. So, here we've got an action. Can the action 400.65s - 405.23s | eat be completed on the bone? Uh, so, note that we're looking here at what can be done to the 405.23s - 410.27s | bone. We're not looking at what Shadow or, or Liam can do. We're looking at what can be done 410.27s - 414.69s | to the bone, what actions can be taking place. If it's the animal owner, or the friend of the 414.69s - 420.11s | owner of an animal, or the pet of a friend of the owner of the animal, they can eat the bone. 420.11s - 424.47s | Technically, I suppose you could argue, no, I probably wouldn't want the owner of the bone, 424.47s - 428.23s | the sheep, to be eating the bone. That would be a little bit weird. But you can see we just 428.23s - 432.19s | find here a set of relationships that allow us to decide whether or not the bone can be 432.19s - 436.81s | accessed by the dog. And because through those green lines there, which are really terrible 436.81s - 441.23s | in this background, you can see that the flow does actually go all the way through. Liam 441.23s - 446.23s | gets a bone. Good for Liam. So, the door opens. Now, say one day the farmer and the mad 448.89s - 452.47s | scientist break friends. They're no longer friends with each other. Suddenly that 452.47s - 455.85s | relationship is broken. Now, nothing has changed about the bone, and nothing has changed 455.85s - 460.01s


chunk_text:
it's the animal owner, or the friend of the 414.69s - 420.11s | owner of an animal, or the pet of a friend of the owner of the animal, they can eat the bone. 420.11s - 424.47s | Technically, I suppose you could argue, no, I probably wouldn't want the owner of the bone, 424.47s - 428.23s | the sheep, to be eating the bone. That would be a little bit weird. But you can see we just 428.23s - 432.19s | find here a set of relationships that allow us to decide whether or not the bone can be 432.19s - 436.81s | accessed by the dog. And because through those green lines there, which are really terrible 436.81s - 441.23s | in this background, you can see that the flow does actually go all the way through. Liam 441.23s - 446.23s | gets a bone. Good for Liam. So, the door opens. Now, say one day the farmer and the mad 448.89s - 452.47s | scientist break friends. They're no longer friends with each other. Suddenly that 452.47s - 455.85s | relationship is broken. Now, nothing has changed about the bone, and nothing has changed 455.85s - 460.01s | about Liam. But the relationship is broken, therefore the friend component of that rule 460.01s - 465.17s | there breaks. So, the only rule that allowed Liam to get access to that bone is now broken, 465.17s - 469.59s | and the door shuts. So, that's what a relationship-based access control is about. It's not 469.59s - 474.71s | so much about defining what somebody or some user can do. It's about what actions can be 474.71s - 480.75s | performed on a resource based on a set of rules that relates lots of resources together. Does 480.79s - 486.79s | that make sense? Cool. So, under the hood, who here is familiar with the entity attribute 486.79s - 491.75s | value model of designing? So, if you've ever done any kind of content management systems or 491.75s - 495.21s | anything like that where you've got an undefined at the beginning of your project, you have 495.21s - 498.75s | an undefined number of entities, you want a way to be able to create new entities in your 498.75s - 502.95s | system without having to do a database deployment, because they are nasty, especially when 502.95s -


chunk_text:
| about Liam. But the relationship is broken, therefore the friend component of that rule 460.01s - 465.17s | there breaks. So, the only rule that allowed Liam to get access to that bone is now broken, 465.17s - 469.59s | and the door shuts. So, that's what a relationship-based access control is about. It's not 469.59s - 474.71s | so much about defining what somebody or some user can do. It's about what actions can be 474.71s - 480.75s | performed on a resource based on a set of rules that relates lots of resources together. Does 480.79s - 486.79s | that make sense? Cool. So, under the hood, who here is familiar with the entity attribute 486.79s - 491.75s | value model of designing? So, if you've ever done any kind of content management systems or 491.75s - 495.21s | anything like that where you've got an undefined at the beginning of your project, you have 495.21s - 498.75s | an undefined number of entities, you want a way to be able to create new entities in your 498.75s - 502.95s | system without having to do a database deployment, because they are nasty, especially when 502.95s - 508.53s | you have a lot of data. So, the entity attribute value model of data storage basically says 508.53s - 512.31s | you have a table that defines entities, and you have another table that defines the 512.31s - 515.93s | attributes and values for that entity. So, if you want to add another entity, it's just 515.93s - 520.69s | another row in a table. Nice and simple. Let's have a quick look at how that works. So, 520.69s - 525.15s | we've got a user and an article. So, we're going to be looking at a blog post system, for 525.15s - 528.53s | example. So, we've got a user and an article, and on this right hand side here we've got a 528.53s - 531.81s | whole jumbled load of mess. But you can see that we've got the entity ID, the second 531.81s - 537.43s | column. So, the first, second, and the last two rows in the attribute table belong to a 537.43s - 542.43s | user. And because the second column has number twos in it, the third and fourth rows belong 545.05s - 549.35s | to an article. So, you can see


chunk_text:
508.53s | you have a lot of data. So, the entity attribute value model of data storage basically says 508.53s - 512.31s | you have a table that defines entities, and you have another table that defines the 512.31s - 515.93s | attributes and values for that entity. So, if you want to add another entity, it's just 515.93s - 520.69s | another row in a table. Nice and simple. Let's have a quick look at how that works. So, 520.69s - 525.15s | we've got a user and an article. So, we're going to be looking at a blog post system, for 525.15s - 528.53s | example. So, we've got a user and an article, and on this right hand side here we've got a 528.53s - 531.81s | whole jumbled load of mess. But you can see that we've got the entity ID, the second 531.81s - 537.43s | column. So, the first, second, and the last two rows in the attribute table belong to a 537.43s - 542.43s | user. And because the second column has number twos in it, the third and fourth rows belong 545.05s - 549.35s | to an article. So, you can see the user's username is Robin, and the user's password is 549.35s - 554.93s | password. Down there we have username Morgan and password. For some reason they like using 554.93s - 559.81s | JSON Web Tokens for their passwords, but that's their password. And then in the middle 559.81s - 563.05s | through there you can see that we've got an article, one article, instance ID of the 563.05s - 568.31s | article is one. We've got a title of Rebec for the win, and content is can has FGA, fine 568.31s - 574.81s | grained access control. So, now if we want to pull stuff out, we can use a fairly simple 574.81s - 581.05s | ish join within an SQL table to say, well, pull all these things out, and I can pull out, for 581.05s - 587.51s | example, get me all of the articles that you have. Give me the title and the content. Or 587.55s - 590.63s | maybe rather than getting information about one entity, you could say give me a list of 590.63s - 596.29s | all the users and just give me their usernames. So, this table setup basically allows you 596.29s


chunk_text:
the user's username is Robin, and the user's password is 549.35s - 554.93s | password. Down there we have username Morgan and password. For some reason they like using 554.93s - 559.81s | JSON Web Tokens for their passwords, but that's their password. And then in the middle 559.81s - 563.05s | through there you can see that we've got an article, one article, instance ID of the 563.05s - 568.31s | article is one. We've got a title of Rebec for the win, and content is can has FGA, fine 568.31s - 574.81s | grained access control. So, now if we want to pull stuff out, we can use a fairly simple 574.81s - 581.05s | ish join within an SQL table to say, well, pull all these things out, and I can pull out, for 581.05s - 587.51s | example, get me all of the articles that you have. Give me the title and the content. Or 587.55s - 590.63s | maybe rather than getting information about one entity, you could say give me a list of 590.63s - 596.29s | all the users and just give me their usernames. So, this table setup basically allows you 596.29s - 600.87s | to get really varied views across the data you have without having to change your database 600.87s - 604.59s | schema, without having to know what that schema looks like to start with, and you can 604.59s - 609.25s | store arbitrary data in there and pull it out in whichever way you want. It's complicated 609.25s - 615.83s | and expensive to pull out, and it's somewhat complicated to set up and use within more so 615.83s - 619.65s | than if you had like an article table and a user table and a comment table. So, if we 619.65s - 623.69s | wanted to add a comment, for example, we just add an extra row over there, and then we can 623.69s - 628.15s | add some extra columns here saying, okay, so we've now got this entity ID three, instance ID 628.15s - 633.19s | one, so this is comment number one, the article ID is number one, author is Sam, comment 633.19s - 638.69s | was first, and here's the date Sam. So, without making any database schema change, I've 638.69s - 643.65s | added a whole new entity to the system. The


chunk_text:
- 600.87s | to get really varied views across the data you have without having to change your database 600.87s - 604.59s | schema, without having to know what that schema looks like to start with, and you can 604.59s - 609.25s | store arbitrary data in there and pull it out in whichever way you want. It's complicated 609.25s - 615.83s | and expensive to pull out, and it's somewhat complicated to set up and use within more so 615.83s - 619.65s | than if you had like an article table and a user table and a comment table. So, if we 619.65s - 623.69s | wanted to add a comment, for example, we just add an extra row over there, and then we can 623.69s - 628.15s | add some extra columns here saying, okay, so we've now got this entity ID three, instance ID 628.15s - 633.19s | one, so this is comment number one, the article ID is number one, author is Sam, comment 633.19s - 638.69s | was first, and here's the date Sam. So, without making any database schema change, I've 638.69s - 643.65s | added a whole new entity to the system. The only reason I tell you about EAV is because this 643.69s - 648.61s | is very similar to the way that Reback is managed under the hood. So, let's have a look at 648.61s - 653.39s | how that works. We've got entities on the left-hand side, Robin is a user, Acme Co is an 653.39s - 658.19s | organization, and Reback for the win is an article. And down here we have some 658.19s - 662.47s | relationships. So, we're now looking at just subject ID, and I apologize for the color 662.47s - 666.51s | scheme, we've got a relationship ID, which is just arbitrary for this table, we've got a 666.51s - 671.77s | subject entity ID and an object entity ID. So, how does a subject relate to an entity? A 671.77s - 676.23s | subject is an entity, it's just the primary entity within a relationship. So, we're saying 676.23s - 683.23s | subject one, the user, entity ID three, the article, relationship type is owner. Therefore 683.23s - 689.66s | we know that Robin is the owner of the Reback for the win article. We can then add in that 689.66s - 694.66s |


chunk_text:
only reason I tell you about EAV is because this 643.69s - 648.61s | is very similar to the way that Reback is managed under the hood. So, let's have a look at 648.61s - 653.39s | how that works. We've got entities on the left-hand side, Robin is a user, Acme Co is an 653.39s - 658.19s | organization, and Reback for the win is an article. And down here we have some 658.19s - 662.47s | relationships. So, we're now looking at just subject ID, and I apologize for the color 662.47s - 666.51s | scheme, we've got a relationship ID, which is just arbitrary for this table, we've got a 666.51s - 671.77s | subject entity ID and an object entity ID. So, how does a subject relate to an entity? A 671.77s - 676.23s | subject is an entity, it's just the primary entity within a relationship. So, we're saying 676.23s - 683.23s | subject one, the user, entity ID three, the article, relationship type is owner. Therefore 683.23s - 689.66s | we know that Robin is the owner of the Reback for the win article. We can then add in that 689.66s - 694.66s | Robin, user one, is a member of organization Acme Co. And we can add in that Morgan, user 695.08s - 700.08s | four, is a member of the organization Acme Co as well. So, we now know that both Robin 703.58s - 708.32s | and Morgan are members of Acme Co. Now we have another one here where we say the organization 708.32s - 714.28s | is a viewer of the Reback article. But organizations can't view things. So, we're able 714.28s - 718.28s | to extend that slightly and put an extra entity relation on there. How do the entities 718.28s - 723.74s | relate to each other? Through this member relation. So, if we dial that back, if we see 723.74s - 729.74s | here we've got member, in the middle two rows here we've got a relationship of members. So, 729.74s - 737.02s | what we now know is that members of organization two can view the Reback for the win article. 739.64s - 744.64s | So, now if I add another member into that organization they automatically inherit that because 744.64s - 749.52s | the relationship exists already. Does that make sense? This is where it


chunk_text:
Robin, user one, is a member of organization Acme Co. And we can add in that Morgan, user 695.08s - 700.08s | four, is a member of the organization Acme Co as well. So, we now know that both Robin 703.58s - 708.32s | and Morgan are members of Acme Co. Now we have another one here where we say the organization 708.32s - 714.28s | is a viewer of the Reback article. But organizations can't view things. So, we're able 714.28s - 718.28s | to extend that slightly and put an extra entity relation on there. How do the entities 718.28s - 723.74s | relate to each other? Through this member relation. So, if we dial that back, if we see 723.74s - 729.74s | here we've got member, in the middle two rows here we've got a relationship of members. So, 729.74s - 737.02s | what we now know is that members of organization two can view the Reback for the win article. 739.64s - 744.64s | So, now if I add another member into that organization they automatically inherit that because 744.64s - 749.52s | the relationship exists already. Does that make sense? This is where it gets a little bit 749.52s - 753.64s | murky. You don't need to know all of this. I just want you to understand how the data sits 753.68s - 758.88s | in there so that when we start pulling it out you can see what's going on. So, the other 758.88s - 762.76s | thing we can do is define permissions on all of these. So, we've got the relationships 762.76s - 766.80s | but what does that actually mean they can do? So, permission ID one, again arbitrarily 766.80s - 772.84s | for the permissions table, relates to relationship ID one. So, relationship ID one was Robin 772.84s - 777.60s | is the owner of the Reback article. So, we're saying here, well, one of the permissions 777.60s - 784.88s | is read. Relationship ID one is also that Robin is the owner of the article. Robin also has 786.50s - 793.50s | write access. And then we have relationship ID four which is this, this inferred down 793.50s - 800.38s | here, members of organization two, members of organization two have read permissions. So, 800.38s - 804.96s | even over here we've got relationship types and entities like


chunk_text:
gets a little bit 749.52s - 753.64s | murky. You don't need to know all of this. I just want you to understand how the data sits 753.68s - 758.88s | in there so that when we start pulling it out you can see what's going on. So, the other 758.88s - 762.76s | thing we can do is define permissions on all of these. So, we've got the relationships 762.76s - 766.80s | but what does that actually mean they can do? So, permission ID one, again arbitrarily 766.80s - 772.84s | for the permissions table, relates to relationship ID one. So, relationship ID one was Robin 772.84s - 777.60s | is the owner of the Reback article. So, we're saying here, well, one of the permissions 777.60s - 784.88s | is read. Relationship ID one is also that Robin is the owner of the article. Robin also has 786.50s - 793.50s | write access. And then we have relationship ID four which is this, this inferred down 793.50s - 800.38s | here, members of organization two, members of organization two have read permissions. So, 800.38s - 804.96s | even over here we've got relationship types and entities like viewer is just a label. It 804.96s - 808.84s | doesn't mean anything to the system. But when you look at that you see what that means is 808.84s - 815.96s | the permission for viewer for any member of organization two has read access on article 815.96s - 823.96s | one. So, there's one extra table here compared to EAV but this allows us to define a multitude 823.96s - 829.34s | of relationships and permissions and how they relate to each other and to other entities. 829.34s - 833.54s | And more importantly they allow you to chain those identities. Remember how we went from 833.54s - 838.12s | Liam to the mad scientist to the farmer to the sheep to the bone? It's not just one to one. 838.12s - 841.72s | You can define these huge big chains and if any part of that chain gets broken then the 841.72s - 848.26s | relationship breaks. So, querying the Reback model, how does this work? Let's say we come in 848.26s - 854.96s | here and we want to find out who can read. We can see here that the read, sorry, who can 854.96s - 860.96s


chunk_text:
viewer is just a label. It 804.96s - 808.84s | doesn't mean anything to the system. But when you look at that you see what that means is 808.84s - 815.96s | the permission for viewer for any member of organization two has read access on article 815.96s - 823.96s | one. So, there's one extra table here compared to EAV but this allows us to define a multitude 823.96s - 829.34s | of relationships and permissions and how they relate to each other and to other entities. 829.34s - 833.54s | And more importantly they allow you to chain those identities. Remember how we went from 833.54s - 838.12s | Liam to the mad scientist to the farmer to the sheep to the bone? It's not just one to one. 838.12s - 841.72s | You can define these huge big chains and if any part of that chain gets broken then the 841.72s - 848.26s | relationship breaks. So, querying the Reback model, how does this work? Let's say we come in 848.26s - 854.96s | here and we want to find out who can read. We can see here that the read, sorry, who can 854.96s - 860.96s | write. The permission ID there is two. So, if we, let's just go back one. I think I've got the 867.39s - 873.09s | wrong one highlighted there. I want to find out who can write a Reback article two. So, first 873.09s - 877.09s | thing we do is we look at the, and the highlighting isn't working so great here, the object 877.09s - 881.43s | entity ID three there is the Reback article. So, we say okay, within the relationships let's 881.43s - 885.97s | find out everything we know about the article. And we can see here that the fourth one there 886.01s - 890.85s | can be excluded straight away because the relationship ID number four is not in the 890.85s - 898.13s | permissions table. However, relationship ID one is in that table that is related to the 898.13s - 905.39s | object identity two. So, we can pull out the user Robin has write access to the article. So, 905.39s - 909.35s | you can look at things in other directions as well. And then further to that you can even 909.35s - 913.05s | say okay, well tell me everything about


chunk_text:
| write. The permission ID there is two. So, if we, let's just go back one. I think I've got the 867.39s - 873.09s | wrong one highlighted there. I want to find out who can write a Reback article two. So, first 873.09s - 877.09s | thing we do is we look at the, and the highlighting isn't working so great here, the object 877.09s - 881.43s | entity ID three there is the Reback article. So, we say okay, within the relationships let's 881.43s - 885.97s | find out everything we know about the article. And we can see here that the fourth one there 886.01s - 890.85s | can be excluded straight away because the relationship ID number four is not in the 890.85s - 898.13s | permissions table. However, relationship ID one is in that table that is related to the 898.13s - 905.39s | object identity two. So, we can pull out the user Robin has write access to the article. So, 905.39s - 909.35s | you can look at things in other directions as well. And then further to that you can even 909.35s - 913.05s | say okay, well tell me everything about the article rather than starting from the permissions. 913.09s - 918.31s | So, we look at article number three. We know that Robin is the owner of that article 918.31s - 923.97s | already. And if we look at the viewer here we can then, and this is what I was talking about 923.97s - 929.59s | before how member gets extrapolated to infer relationship status. So, we can see that the 929.59s - 937.59s | member here of organization two has access to the article. And if we then fold those in you see 937.59s - 941.39s | how before this one here was highlighted. What we're now doing is saying the subject is now 941.39s - 946.93s | the object. So, where the object is now entity ID two where also the relationship type is 946.93s - 951.05s | member. That's where this one basically gets folded out. So, that's probably one of the 951.05s - 957.85s | most complicated lookups. It's really deep diving straight into the depths of the Reback 957.85s - 961.59s | schema. But essentially what we're doing there at that point is we're saying this 961.59s - 964.77s | permission or this relationship


chunk_text:
the article rather than starting from the permissions. 913.09s - 918.31s | So, we look at article number three. We know that Robin is the owner of that article 918.31s - 923.97s | already. And if we look at the viewer here we can then, and this is what I was talking about 923.97s - 929.59s | before how member gets extrapolated to infer relationship status. So, we can see that the 929.59s - 937.59s | member here of organization two has access to the article. And if we then fold those in you see 937.59s - 941.39s | how before this one here was highlighted. What we're now doing is saying the subject is now 941.39s - 946.93s | the object. So, where the object is now entity ID two where also the relationship type is 946.93s - 951.05s | member. That's where this one basically gets folded out. So, that's probably one of the 951.05s - 957.85s | most complicated lookups. It's really deep diving straight into the depths of the Reback 957.85s - 961.59s | schema. But essentially what we're doing there at that point is we're saying this 961.59s - 964.77s | permission or this relationship here doesn't make sense from a permission sense because 964.77s - 969.35s | you don't give permissions to inanimate objects like organizations. Necessarily, I mean 969.35s - 974.65s | you do. But that doesn't really help an end user. How do we then unfold that and then 974.65s - 979.77s | extrapolate that to refer to the actual user entities? And this is where it gets 979.77s - 983.51s | complicated because Reback as I said doesn't have a concept of a user necessarily. You 983.51s - 987.97s | can, you could actually ask Reback what is the relationship between this organization 987.97s - 991.89s | and that network? Neither of them really do anything. They're system entities. They're 991.89s - 997.47s | not user entities. But they still have relationships. So, it's powerful but also complex. 997.47s - 1002.47s | So, implementation details. Let's have a think about how we might do something in code. 1005.71s - 1010.13s | Which is probably the way most of us do the more complicated business logic like this. So, 1010.13s - 1015.25s | if we want to allow editing an article, if a user is an admin or an editor, if an


chunk_text:
here doesn't make sense from a permission sense because 964.77s - 969.35s | you don't give permissions to inanimate objects like organizations. Necessarily, I mean 969.35s - 974.65s | you do. But that doesn't really help an end user. How do we then unfold that and then 974.65s - 979.77s | extrapolate that to refer to the actual user entities? And this is where it gets 979.77s - 983.51s | complicated because Reback as I said doesn't have a concept of a user necessarily. You 983.51s - 987.97s | can, you could actually ask Reback what is the relationship between this organization 987.97s - 991.89s | and that network? Neither of them really do anything. They're system entities. They're 991.89s - 997.47s | not user entities. But they still have relationships. So, it's powerful but also complex. 997.47s - 1002.47s | So, implementation details. Let's have a think about how we might do something in code. 1005.71s - 1010.13s | Which is probably the way most of us do the more complicated business logic like this. So, 1010.13s - 1015.25s | if we want to allow editing an article, if a user is an admin or an editor, if an editor is 1015.25s - 1020.97s | allowed to edit this particular article, if the article is sensitive then we also want to 1020.97s - 1024.47s | make sure that the person is on site and we want to make sure that they're doing it during 1024.47s - 1030.29s | office hours. Seems like a fairly robust kind of setup that you might have in a large 1030.29s - 1037.17s | organization. So, if. If the user is admin or if the user is editor. Cool. So, we've got, we 1037.17s - 1043.67s | know what role the user has. Also, if the user is an editor and the list of document 1043.67s - 1048.21s | editors contains the current user. So, we don't want any editor to be able to edit this. 1048.21s - 1052.83s | Only if the list of editors for this particular article includes the current user. So, we 1052.83s - 1056.83s | can compound those two together. Then also we want to say, well, if the document isn't 1056.83s - 1061.53s | sensitive, then we can carry on. Otherwise, we're going to check to see if the user's 1061.53s - 1067.57s | location is on premises


chunk_text:
editor is 1015.25s - 1020.97s | allowed to edit this particular article, if the article is sensitive then we also want to 1020.97s - 1024.47s | make sure that the person is on site and we want to make sure that they're doing it during 1024.47s - 1030.29s | office hours. Seems like a fairly robust kind of setup that you might have in a large 1030.29s - 1037.17s | organization. So, if. If the user is admin or if the user is editor. Cool. So, we've got, we 1037.17s - 1043.67s | know what role the user has. Also, if the user is an editor and the list of document 1043.67s - 1048.21s | editors contains the current user. So, we don't want any editor to be able to edit this. 1048.21s - 1052.83s | Only if the list of editors for this particular article includes the current user. So, we 1052.83s - 1056.83s | can compound those two together. Then also we want to say, well, if the document isn't 1056.83s - 1061.53s | sensitive, then we can carry on. Otherwise, we're going to check to see if the user's 1061.53s - 1067.57s | location is on premises or if the user's location is currently in office hours. And I say 1067.57s - 1071.69s | the user's location because in a world like today, who knows when it's 9 to 5 for 1071.69s - 1076.03s | somebody. So, as long as it's within the location they're in, it's working hours and 1076.03s - 1081.19s | they're on premises or the document is not sensitive and they meet the user requirements, 1081.19s - 1085.15s | they're going to get access to this document. Imagine if you had to come back and change 1085.15s - 1090.78s | those rules three months later. So, instead what we're going to do is we're going to 1090.78s - 1096.28s | define entities within our relationship-based access management tool of choice. We're 1096.28s - 1100.24s | going to define a document. The document has an owner and an editor. The owner is a 1100.24s - 1106.50s | user and the editor is a member of an organization with the member type editor. So, you 1106.50s - 1110.74s | can have different types of people within groups. And then we're going to have a 1110.74s - 1114.28s | sensitive document. That's the definition of a


chunk_text:
or if the user's location is currently in office hours. And I say 1067.57s - 1071.69s | the user's location because in a world like today, who knows when it's 9 to 5 for 1071.69s - 1076.03s | somebody. So, as long as it's within the location they're in, it's working hours and 1076.03s - 1081.19s | they're on premises or the document is not sensitive and they meet the user requirements, 1081.19s - 1085.15s | they're going to get access to this document. Imagine if you had to come back and change 1085.15s - 1090.78s | those rules three months later. So, instead what we're going to do is we're going to 1090.78s - 1096.28s | define entities within our relationship-based access management tool of choice. We're 1096.28s - 1100.24s | going to define a document. The document has an owner and an editor. The owner is a 1100.24s - 1106.50s | user and the editor is a member of an organization with the member type editor. So, you 1106.50s - 1110.74s | can have different types of people within groups. And then we're going to have a 1110.74s - 1114.28s | sensitive document. That's the definition of a normal document. A sensitive document is 1114.28s - 1119.60s | going to extend document. It's also going to have an edit action on it that says if it's 1119.60s - 1124.56s | within working hours and the document, it's the document owner who's trying to do this 1124.56s - 1128.06s | action. Because remember, we're defining actions on an entity and who's allowed to 1128.06s - 1133.24s | perform it. So, can edit be done on a sensitive document? Yes, you can if you are the 1133.24s - 1138.82s | document owner and you are the document owner and you're on premises. Or if you're an 1138.82s - 1143.64s | editor and you're on premises. So, this gets tied into your relationship-based access 1143.64s - 1149.64s | model schema and permission systems. So, now your code can change from this to that. 1151.48s - 1157.48s | And now your business logic isn't restricted or it doesn't include the permissions 1157.48s - 1161.06s | check because there's no real reason for that to be there. The permission for who 1161.06s - 1165.40s | should access an entity within your system should not be dependent on what's in the 1165.40s - 1170.14s


chunk_text:
normal document. A sensitive document is 1114.28s - 1119.60s | going to extend document. It's also going to have an edit action on it that says if it's 1119.60s - 1124.56s | within working hours and the document, it's the document owner who's trying to do this 1124.56s - 1128.06s | action. Because remember, we're defining actions on an entity and who's allowed to 1128.06s - 1133.24s | perform it. So, can edit be done on a sensitive document? Yes, you can if you are the 1133.24s - 1138.82s | document owner and you are the document owner and you're on premises. Or if you're an 1138.82s - 1143.64s | editor and you're on premises. So, this gets tied into your relationship-based access 1143.64s - 1149.64s | model schema and permission systems. So, now your code can change from this to that. 1151.48s - 1157.48s | And now your business logic isn't restricted or it doesn't include the permissions 1157.48s - 1161.06s | check because there's no real reason for that to be there. The permission for who 1161.06s - 1165.40s | should access an entity within your system should not be dependent on what's in the 1165.40s - 1170.14s | business logic. There's a fast and firm rule for that. This gives you two benefits. One 1170.14s - 1174.64s | from a clean code, easy to read perspective. That is much easier to read. You know 1174.64s - 1178.44s | exactly what's going to happen. You don't have to think about it. Also, from a 1178.44s - 1182.98s | permissions and access control management perspective, your security team can manage the 1182.98s - 1187.90s | rules and the schema separately from your development team and it puts the 1187.90s - 1195.88s | responsibility in the right place. So, demo time. This is the fun part. So, the first 1195.92s - 1200.20s | part was all about dogs. Then we went to document access management, which is 1200.20s - 1205.92s | important but boring. So, we're going to go back to dogs. I have tried a number of 1205.92s - 1209.54s | products. There are all these products up on the screen here. There are many more. These 1209.54s - 1213.58s | are relationship-based access management tools. Some of them are open source and 1213.58s - 1220.12s | free to use. Some of them are paid for. I'm going to


chunk_text:
| business logic. There's a fast and firm rule for that. This gives you two benefits. One 1170.14s - 1174.64s | from a clean code, easy to read perspective. That is much easier to read. You know 1174.64s - 1178.44s | exactly what's going to happen. You don't have to think about it. Also, from a 1178.44s - 1182.98s | permissions and access control management perspective, your security team can manage the 1182.98s - 1187.90s | rules and the schema separately from your development team and it puts the 1187.90s - 1195.88s | responsibility in the right place. So, demo time. This is the fun part. So, the first 1195.92s - 1200.20s | part was all about dogs. Then we went to document access management, which is 1200.20s - 1205.92s | important but boring. So, we're going to go back to dogs. I have tried a number of 1205.92s - 1209.54s | products. There are all these products up on the screen here. There are many more. These 1209.54s - 1213.58s | are relationship-based access management tools. Some of them are open source and 1213.58s - 1220.12s | free to use. Some of them are paid for. I'm going to be using Permify in this demo. Am I 1220.12s - 1223.42s | going to annoy anybody by switching over to this on the AV team? Because they didn't 1223.58s - 1228.42s | check me on this one. So, I apologize in advance. I'm going to need both hands. So, I'm 1228.42s - 1234.84s | just going to stop screen sharing. Let's jump over here and we're going to have a first 1234.84s - 1242.84s | look at Postman. So, let's make this a bit bigger. Can you all read that okay? Excellent. 1242.84s - 1247.70s | So, let's have a look from the beginning. We're going to create a tenant. In fact, the 1247.70s - 1255.40s | first thing I'm going to do, because like all developers, I decided to test this before I 1255.40s - 1258.12s | started the talk. So, I'm just going to restart Permify in the background. So, we're 1258.12s - 1262.24s | starting from a bank slate. So, now over here, what we're going to do is we're going to 1262.24s - 1266.08s | create a new tenant. So, Permify allows you to have multiple tenants in your system. So, 1266.08s - 1271.24s | you


chunk_text:
be using Permify in this demo. Am I 1220.12s - 1223.42s | going to annoy anybody by switching over to this on the AV team? Because they didn't 1223.58s - 1228.42s | check me on this one. So, I apologize in advance. I'm going to need both hands. So, I'm 1228.42s - 1234.84s | just going to stop screen sharing. Let's jump over here and we're going to have a first 1234.84s - 1242.84s | look at Postman. So, let's make this a bit bigger. Can you all read that okay? Excellent. 1242.84s - 1247.70s | So, let's have a look from the beginning. We're going to create a tenant. In fact, the 1247.70s - 1255.40s | first thing I'm going to do, because like all developers, I decided to test this before I 1255.40s - 1258.12s | started the talk. So, I'm just going to restart Permify in the background. So, we're 1258.12s - 1262.24s | starting from a bank slate. So, now over here, what we're going to do is we're going to 1262.24s - 1266.08s | create a new tenant. So, Permify allows you to have multiple tenants in your system. So, 1266.08s - 1271.24s | you can sandbox or isolate certain areas of your organization or even certain 1271.24s - 1279.66s | organizations within a larger system. So, we're going to create a tenant over here called 1279.66s - 1285.82s | Dog and Bone. If I hit send on that, we'll see down here that we get a positive response 1285.82s - 1289.36s | back, a 200, and we've got our tenant. So, the next thing I'm going to do is create the 1289.36s - 1296.00s | schema. Now, this schema, for some reason, Permify wants it in a single string. So, to make 1296.00s - 1303.67s | it easier, I have it over here. This is very similar to what we saw in the slides. Basically, 1303.67s - 1308.41s | we've got a definition of a dog. A dog has an owner, which is a person. We've got a sheep. A 1308.41s - 1312.71s | sheep has an owner that is also a person. A sheep also has a bone, which is of entity type 1312.71s - 1317.91s | bone. We've got a person. A person can have a friend, would be another person. A person can 1317.91s - 1322.75s | also have sheep and


chunk_text:
can sandbox or isolate certain areas of your organization or even certain 1271.24s - 1279.66s | organizations within a larger system. So, we're going to create a tenant over here called 1279.66s - 1285.82s | Dog and Bone. If I hit send on that, we'll see down here that we get a positive response 1285.82s - 1289.36s | back, a 200, and we've got our tenant. So, the next thing I'm going to do is create the 1289.36s - 1296.00s | schema. Now, this schema, for some reason, Permify wants it in a single string. So, to make 1296.00s - 1303.67s | it easier, I have it over here. This is very similar to what we saw in the slides. Basically, 1303.67s - 1308.41s | we've got a definition of a dog. A dog has an owner, which is a person. We've got a sheep. A 1308.41s - 1312.71s | sheep has an owner that is also a person. A sheep also has a bone, which is of entity type 1312.71s - 1317.91s | bone. We've got a person. A person can have a friend, would be another person. A person can 1317.91s - 1322.75s | also have sheep and a person can have dogs. So, we've got bidirectional rules here. And 1322.75s - 1327.45s | then we've got a relationship between the bone. The bone has an owner, and that's a sheep. 1327.45s - 1334.15s | And then we've got a permission. Can the owner's friend's dog eat? And eat is true if that 1334.15s - 1343.26s | comes out as a relationship that exists. So, let's submit that through, and we should find 1343.26s - 1353.07s | that that has now worked. If I now create some relationships, come on, get bigger. Where's 1353.07s - 1362.18s | the handle? It's always hiding. I'll just scroll through little by little. So, actually, if 1362.18s - 1367.00s | I make this slightly smaller, is that still readable at the back? Yep, okay. So, at least we 1367.00s - 1370.04s | can see a bit more at a time. So, we can see here we've got a relationship between a subject 1370.04s - 1374.34s | and an entity. Remember I said a subject is also an entity, but it's just a primary entity in a 1374.34s - 1379.88s | relationship. Is the microphone cutting in? A little? I'll go back to


chunk_text:
a person can have dogs. So, we've got bidirectional rules here. And 1322.75s - 1327.45s | then we've got a relationship between the bone. The bone has an owner, and that's a sheep. 1327.45s - 1334.15s | And then we've got a permission. Can the owner's friend's dog eat? And eat is true if that 1334.15s - 1343.26s | comes out as a relationship that exists. So, let's submit that through, and we should find 1343.26s - 1353.07s | that that has now worked. If I now create some relationships, come on, get bigger. Where's 1353.07s - 1362.18s | the handle? It's always hiding. I'll just scroll through little by little. So, actually, if 1362.18s - 1367.00s | I make this slightly smaller, is that still readable at the back? Yep, okay. So, at least we 1367.00s - 1370.04s | can see a bit more at a time. So, we can see here we've got a relationship between a subject 1370.04s - 1374.34s | and an entity. Remember I said a subject is also an entity, but it's just a primary entity in a 1374.34s - 1379.88s | relationship. Is the microphone cutting in? A little? I'll go back to this one. Because I 1379.88s - 1384.34s | don't need to type as much now. So, we can see the subject, mad scientist, is the owner of 1384.34s - 1390.04s | shadow the dog. We can see here that shadow the dog is also a dog belonging to the scientist. 1390.04s - 1395.08s | And then we've got the farmer has dolly the sheep. The sheep belongs to the farmer. And we've 1395.08s - 1403.74s | got dolly is a sheep to the femur. And the femur is a bone to the sheep. So, we've got these 1403.74s - 1410.08s | relationships built up now. So, if I come through and I ask what friends does the scientist 1410.08s - 1414.78s | have, because we haven't defined those relationships yet, if I execute that, we'll see down 1414.82s - 1422.02s | here that the result is nothing. We have no ‑‑ he has no friends. He's a sad scientist. As it 1422.02s - 1427.52s | happens, the farmer is also a sad farmer. The farmer has sheep. So, a little bit happier 1427.52s - 1432.82s | probably. I know, sheep are better than dogs. I digress yet again. So, can


chunk_text:
this one. Because I 1379.88s - 1384.34s | don't need to type as much now. So, we can see the subject, mad scientist, is the owner of 1384.34s - 1390.04s | shadow the dog. We can see here that shadow the dog is also a dog belonging to the scientist. 1390.04s - 1395.08s | And then we've got the farmer has dolly the sheep. The sheep belongs to the farmer. And we've 1395.08s - 1403.74s | got dolly is a sheep to the femur. And the femur is a bone to the sheep. So, we've got these 1403.74s - 1410.08s | relationships built up now. So, if I come through and I ask what friends does the scientist 1410.08s - 1414.78s | have, because we haven't defined those relationships yet, if I execute that, we'll see down 1414.82s - 1422.02s | here that the result is nothing. We have no ‑‑ he has no friends. He's a sad scientist. As it 1422.02s - 1427.52s | happens, the farmer is also a sad farmer. The farmer has sheep. So, a little bit happier 1427.52s - 1432.82s | probably. I know, sheep are better than dogs. I digress yet again. So, can shadow eat the 1432.82s - 1441.71s | bone? What do we reckon? No? So, if I hit that, it comes through. Result denied. So, it's a 1441.75s - 1449.36s | very low energy kind of reaction that I'm getting. But it's also a very low energy kind of 1449.36s - 1455.90s | output. So, I thought I've got these two requests here that I can make. The first one calls 1455.90s - 1460.36s | data right. What I'm going to do is I'm going to say, okay, the mad scientist is now friends 1460.36s - 1464.90s | with the farmer. And then I've got another one here, break friends. It's data delete. And 1464.90s - 1468.94s | in here I'm defining the mad scientist is no longer a friend with the farmer. So, to make this 1468.94s - 1480.39s | a little more exciting, I decided to show you all my sister's Facebook page. And also, let's 1480.39s - 1485.21s | bring this back in over here. I have a dog and a bone. Let's just refresh this because it 1485.21s - 1490.97s | doesn't like having the lid shut on it. And for some reason I'm getting an image


chunk_text:
shadow eat the 1432.82s - 1441.71s | bone? What do we reckon? No? So, if I hit that, it comes through. Result denied. So, it's a 1441.75s - 1449.36s | very low energy kind of reaction that I'm getting. But it's also a very low energy kind of 1449.36s - 1455.90s | output. So, I thought I've got these two requests here that I can make. The first one calls 1455.90s - 1460.36s | data right. What I'm going to do is I'm going to say, okay, the mad scientist is now friends 1460.36s - 1464.90s | with the farmer. And then I've got another one here, break friends. It's data delete. And 1464.90s - 1468.94s | in here I'm defining the mad scientist is no longer a friend with the farmer. So, to make this 1468.94s - 1480.39s | a little more exciting, I decided to show you all my sister's Facebook page. And also, let's 1480.39s - 1485.21s | bring this back in over here. I have a dog and a bone. Let's just refresh this because it 1485.21s - 1490.97s | doesn't like having the lid shut on it. And for some reason I'm getting an image rendering 1490.97s - 1496.59s | error. There we go. What demos go perfectly. So, door's closed. Dog can't get a bone. So, 1496.75s - 1502.75s | what happens if the farmer makes friends with the scientist? What do you think? No, it 1509.65s - 1516.15s | didn't work. Did I call the right one there? Looks like you're offline. Yeah, but I'm doing 1516.15s - 1527.49s | everything locally. So, did I call the wrong one? Did I call break friends? Let's double 1527.49s - 1536.82s | click on that one. Darn it. Well, I will show you that if we come over here and look at 1539.12s - 1545.20s | friends of mad scientist, we should now have, there we go, the friendship is now in here. So, 1545.20s - 1551.74s | now if I call can shadow eat the bone, it comes back as still denied. Okay. So, this is 1551.74s - 1555.24s | where the demo fails. I'm more than happy to work out why the demo failed. It was 1555.24s - 1559.54s | probably something to do with keeping my Wi-Fi off at DEF CON and closing my laptop lid 1559.54s - 1563.82s | between testing


chunk_text:
rendering 1490.97s - 1496.59s | error. There we go. What demos go perfectly. So, door's closed. Dog can't get a bone. So, 1496.75s - 1502.75s | what happens if the farmer makes friends with the scientist? What do you think? No, it 1509.65s - 1516.15s | didn't work. Did I call the right one there? Looks like you're offline. Yeah, but I'm doing 1516.15s - 1527.49s | everything locally. So, did I call the wrong one? Did I call break friends? Let's double 1527.49s - 1536.82s | click on that one. Darn it. Well, I will show you that if we come over here and look at 1539.12s - 1545.20s | friends of mad scientist, we should now have, there we go, the friendship is now in here. So, 1545.20s - 1551.74s | now if I call can shadow eat the bone, it comes back as still denied. Okay. So, this is 1551.74s - 1555.24s | where the demo fails. I'm more than happy to work out why the demo failed. It was 1555.24s - 1559.54s | probably something to do with keeping my Wi-Fi off at DEF CON and closing my laptop lid 1559.54s - 1563.82s | between testing demos. But the theory is there. The results should have come back 1563.82s - 1567.50s | immediately. I had a little bit of a cheat in my app. It was basically polling every 1567.50s - 1572.58s | second. But there are plenty of ways of connecting to databases and getting a full 1572.58s - 1577.74s | time stream of data back. So, you can get almost like a push notification or an immediate 1577.74s - 1581.70s | notification of permission changes if that's something you need in your environment. Most 1581.70s - 1584.50s | of the time it's probably something you only need every time you make a request to make 1584.50s - 1590.74s | sure that request should be honored. But one of the things that I want to caution is that 1590.74s - 1597.16s | while this is complicated and exciting and perhaps when it comes to permission systems, 1597.16s - 1602.66s | dare I say a little bit sexy, I'm not sure, it's not always the right solution. As I 1602.66s - 1606.32s | said, there's a lot more computation power required for doing things like checking 1606.32s - 1610.20s | whether or not a permission should


chunk_text:
demos. But the theory is there. The results should have come back 1563.82s - 1567.50s | immediately. I had a little bit of a cheat in my app. It was basically polling every 1567.50s - 1572.58s | second. But there are plenty of ways of connecting to databases and getting a full 1572.58s - 1577.74s | time stream of data back. So, you can get almost like a push notification or an immediate 1577.74s - 1581.70s | notification of permission changes if that's something you need in your environment. Most 1581.70s - 1584.50s | of the time it's probably something you only need every time you make a request to make 1584.50s - 1590.74s | sure that request should be honored. But one of the things that I want to caution is that 1590.74s - 1597.16s | while this is complicated and exciting and perhaps when it comes to permission systems, 1597.16s - 1602.66s | dare I say a little bit sexy, I'm not sure, it's not always the right solution. As I 1602.66s - 1606.32s | said, there's a lot more computation power required for doing things like checking 1606.32s - 1610.20s | whether or not a permission should be granted. Role based access control is always going 1610.20s - 1615.70s | to be your easiest. That's always simply like is this person an admin, yes or no. In fact, 1615.70s - 1619.40s | in some situations if you think of your home internet router, you don't even have 1619.40s - 1623.66s | permission systems like are they logged in, yes or no. That's technically the simplest. So, 1623.66s - 1631.16s | work out which level of permissions complexity or the way that your data is modeled and how 1631.16s - 1635.48s | you want to define whether or not access should be allowed. Work out what level of 1635.48s - 1639.44s | complexity you can get to at a minimum while still meeting your requirements. Because if you 1639.44s - 1645.02s | go for the full thing straight out, re-back all the way baby, absolutely it's fun. You will 1645.02s - 1649.40s | probably create a situation where your job is now indispensable. You will not be fired 1649.40s - 1653.40s | because nobody knows what the hell you did. But it's not always the right solution. 1654.02s - 1657.64s | Pick the right one for you. If


chunk_text:
be granted. Role based access control is always going 1610.20s - 1615.70s | to be your easiest. That's always simply like is this person an admin, yes or no. In fact, 1615.70s - 1619.40s | in some situations if you think of your home internet router, you don't even have 1619.40s - 1623.66s | permission systems like are they logged in, yes or no. That's technically the simplest. So, 1623.66s - 1631.16s | work out which level of permissions complexity or the way that your data is modeled and how 1631.16s - 1635.48s | you want to define whether or not access should be allowed. Work out what level of 1635.48s - 1639.44s | complexity you can get to at a minimum while still meeting your requirements. Because if you 1639.44s - 1645.02s | go for the full thing straight out, re-back all the way baby, absolutely it's fun. You will 1645.02s - 1649.40s | probably create a situation where your job is now indispensable. You will not be fired 1649.40s - 1653.40s | because nobody knows what the hell you did. But it's not always the right solution. 1654.02s - 1657.64s | Pick the right one for you. If you're currently going through a situation where you want 1657.64s - 1662.56s | to implement some kind of permission control, more than welcome to come up and talk to me 1662.56s - 1666.68s | afterwards and tell me a story. I'll let you know if I've got any clue at all as to what 1666.68s - 1672.18s | you may or may not consider. I'm certainly not going to tell you I know your system 1672.18s - 1675.56s | inside out and can tell you what the answer is but I'm happy to have a chat and go through 1675.56s - 1682.02s | that with you. But I would like to finish by just saying thank you. If I can even fire 1682.02s - 1690.64s | my slides. Let's just get that back up there. So again, that's my contact details at the 1690.64s - 1695.94s | top there. ArcJet are currently running a contest. If you want to try our product out, 1695.94s - 1699.76s | there's some prizes we're giving away as well. Challenge.arcjet.com. Give it a try. Let us 1699.76s - 1703.94s | know. We would really love to know from you how you find the product,


chunk_text:
you're currently going through a situation where you want 1657.64s - 1662.56s | to implement some kind of permission control, more than welcome to come up and talk to me 1662.56s - 1666.68s | afterwards and tell me a story. I'll let you know if I've got any clue at all as to what 1666.68s - 1672.18s | you may or may not consider. I'm certainly not going to tell you I know your system 1672.18s - 1675.56s | inside out and can tell you what the answer is but I'm happy to have a chat and go through 1675.56s - 1682.02s | that with you. But I would like to finish by just saying thank you. If I can even fire 1682.02s - 1690.64s | my slides. Let's just get that back up there. So again, that's my contact details at the 1690.64s - 1695.94s | top there. ArcJet are currently running a contest. If you want to try our product out, 1695.94s - 1699.76s | there's some prizes we're giving away as well. Challenge.arcjet.com. Give it a try. Let us 1699.76s - 1703.94s | know. We would really love to know from you how you find the product, how easy it is to 1703.94s - 1709.60s | use and what we can do to make it easier for you to make your website sit better. But this 1709.60s - 1712.94s | talk is about permission systems. Come talk to me. Thank you for your time. Have a great 1712.94s - 1714.56s | rest of your DEF CON. Thanks.


chunk_text:
how easy it is to 1703.94s - 1709.60s | use and what we can do to make it easier for you to make your website sit better. But this 1709.60s - 1712.94s | talk is about permission systems. Come talk to me. Thank you for your time. Have a great 1712.94s - 1714.56s | rest of your DEF CON. Thanks.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=0FfTWEP79k4", "title": "DEF CON 32 - Hacking Corporate Banking for Fun and Profit - niks, Charles Waterhouse", "description": "I conducted thorough research on a corporate banking software widely utilized by numerous banks globally. This research was conducted during a bug bounty program for a leading bank in middle east, which employs this software. By examining their marketing brochures, we identified the third party company responsible for its development and after looking at their client we found out, their software is utilized by 60-70% of banks worldwide.\n\nIn this talk i will explain how did i recon corporate banking application from extracting interesting endpoints and methods. Further used them to find attack surface. Furthermore, I will delve into the methods used to uncover critical vulnerabilities within their application, including SQL injections, bypassing access control mechanisms etc.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1272, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.24s | This text was transcribed using whisper model: large-v2 Alright, I would like you all to give me a put your hands together and welcome to the stage our next presenters 7.00s - 9.00s | Nick's and 9.96s - 11.96s | Charlie I am so sorry 17.34s - 24.10s | Hey, yeah, so today we are talking about hacking corporate banking for fun and profit so 26.34s - 30.46s | Introducing myself, I'm a full-time bug bounty hunter for for SNAK 31.18s - 37.38s | I also recognized in 2021 as and as one of their liaison hacker and 38.50s - 40.50s | I will sorry 40.58s - 42.02s | Okay 42.02s - 46.02s | I'm also I'm also founder of besides and about and 47.18s - 50.14s | I am advisor at risk profiler dot IO 51.66s - 53.58s | Hey guys, my name is Charlie waterhouse 53.58s - 59.62s | I am a security analyst and was on the back side of this helping triage these phones as they came in and we kind of 59.62s - 66.06s | Work together to go a little further and figure out some stuff on this. I have spent non-traditional and pin testing background 66.06s - 73.22s | I spent 22 years as an airline flight attendant international manager and speaker and translator in the meantime, though 73.22s - 77.94s | I've also done over 2,400 engagements based on a wasp and reviewed about 78.50s - 83.34s | 25 30,000 reports


chunk_text:
Hey, yeah, so today we are talking about hacking corporate banking for fun and profit so 26.34s - 30.46s | Introducing myself, I'm a full-time bug bounty hunter for for SNAK 31.18s - 37.38s | I also recognized in 2021 as and as one of their liaison hacker and 38.50s - 40.50s | I will sorry 40.58s - 42.02s | Okay 42.02s - 46.02s | I'm also I'm also founder of besides and about and 47.18s - 50.14s | I am advisor at risk profiler dot IO 51.66s - 53.58s | Hey guys, my name is Charlie waterhouse 53.58s - 59.62s | I am a security analyst and was on the back side of this helping triage these phones as they came in and we kind of 59.62s - 66.06s | Work together to go a little further and figure out some stuff on this. I have spent non-traditional and pin testing background 66.06s - 73.22s | I spent 22 years as an airline flight attendant international manager and speaker and translator in the meantime, though 73.22s - 77.94s | I've also done over 2,400 engagements based on a wasp and reviewed about 78.50s - 83.34s | 25 30,000 reports from a lot some of you guys out here that have seen me on the back end of that 83.78s - 87.78s | I work with a lot of our large corporate clients to help them understand the flaws 88.30s - 94.34s | And as I like to say translate the geek side to non-geek so that the guys who would not technical understand what we're looking at 96.30s - 99.54s | So to start we're gonna give you guys a little bit about this 100.66s - 106.22s | During the bounty hunt on this we were kind of looking at this was a private program for a large large bank 107.14s - 112.78s | And the scope was our corporate banking application. This is the back end where they're doing transfers and setting up stuff 113.90s - 115.74s | after exploring a bit 115.74s - 121.02s | We found that there was a third-party application that was running and claim to be used by 60% of the bank 121.02s - 123.46s | So this was like, okay now we can start digging a little more 123.90s - 130.45s | The program has three roles. We have a maker verifier


chunk_text:
from a lot some of you guys out here that have seen me on the back end of that 83.78s - 87.78s | I work with a lot of our large corporate clients to help them understand the flaws 88.30s - 94.34s | And as I like to say translate the geek side to non-geek so that the guys who would not technical understand what we're looking at 96.30s - 99.54s | So to start we're gonna give you guys a little bit about this 100.66s - 106.22s | During the bounty hunt on this we were kind of looking at this was a private program for a large large bank 107.14s - 112.78s | And the scope was our corporate banking application. This is the back end where they're doing transfers and setting up stuff 113.90s - 115.74s | after exploring a bit 115.74s - 121.02s | We found that there was a third-party application that was running and claim to be used by 60% of the bank 121.02s - 123.46s | So this was like, okay now we can start digging a little more 123.90s - 130.45s | The program has three roles. We have a maker verifier and checker the maker initiates a transaction 130.73s - 133.29s | The checker ensures everything's in place and ready to go 133.65s - 137.77s | Verifier is the final checkbox and so the app has corporate groups 137.77s - 143.17s | Each was managed by different branches and they're all separate not linked to each other recognized by GCIF now 143.53s - 146.25s | One of the things we found out from my end when we started looking 146.85s - 154.01s | Louder louder always. Okay. So when we started looking we found that the GCIF is actually kind of a unique thing 154.01s - 159.65s | I we started poking around. This is a Google patent for linking your bank accounts together 159.93s - 162.37s | So let's say that you have a large corporate bank 162.37s - 166.45s | You have a loan that's for your house for your car for your bank for your credit cards 166.53s - 172.61s | They're all linked you through your GCIF. So it's your universal identifier across different divisions within the same bank 173.29s - 176.25s | so let's keep that in mind when we're going through this and 177.17s -


chunk_text:
and checker the maker initiates a transaction 130.73s - 133.29s | The checker ensures everything's in place and ready to go 133.65s - 137.77s | Verifier is the final checkbox and so the app has corporate groups 137.77s - 143.17s | Each was managed by different branches and they're all separate not linked to each other recognized by GCIF now 143.53s - 146.25s | One of the things we found out from my end when we started looking 146.85s - 154.01s | Louder louder always. Okay. So when we started looking we found that the GCIF is actually kind of a unique thing 154.01s - 159.65s | I we started poking around. This is a Google patent for linking your bank accounts together 159.93s - 162.37s | So let's say that you have a large corporate bank 162.37s - 166.45s | You have a loan that's for your house for your car for your bank for your credit cards 166.53s - 172.61s | They're all linked you through your GCIF. So it's your universal identifier across different divisions within the same bank 173.29s - 176.25s | so let's keep that in mind when we're going through this and 177.17s - 180.49s | Next slide so we can see what each role looks like with the maker 180.93s - 185.53s | The verifier and the authorizer these are pretty standard and look pretty similar 186.13s - 187.77s | So at this point 187.77s - 189.77s | Nix you want to take it over where you were at on this? 191.29s - 192.81s | Yeah, so 192.81s - 194.81s | So client has given some 195.25s - 200.65s | SLA's when they are going to fix all these vulnerabilities. So starting from critical 201.25s - 205.45s | Which which is which has been given that they will fix in like 15 days 206.89s - 209.77s | High up to 30 days medium up to 90 days 209.77s - 218.48s | But they they never followed it and they fix all the vulnerabilities after one year. So 221.24s - 227.52s | So getting to know the application it's using servlets kind of a single-page app which we tend to kind of go in how much there 228.56s - 230.76s | The maker role has administration 231.32s - 237.16s | Application module on it and so we're kind of noted that and that each


chunk_text:
180.49s | Next slide so we can see what each role looks like with the maker 180.93s - 185.53s | The verifier and the authorizer these are pretty standard and look pretty similar 186.13s - 187.77s | So at this point 187.77s - 189.77s | Nix you want to take it over where you were at on this? 191.29s - 192.81s | Yeah, so 192.81s - 194.81s | So client has given some 195.25s - 200.65s | SLA's when they are going to fix all these vulnerabilities. So starting from critical 201.25s - 205.45s | Which which is which has been given that they will fix in like 15 days 206.89s - 209.77s | High up to 30 days medium up to 90 days 209.77s - 218.48s | But they they never followed it and they fix all the vulnerabilities after one year. So 221.24s - 227.52s | So getting to know the application it's using servlets kind of a single-page app which we tend to kind of go in how much there 228.56s - 230.76s | The maker role has administration 231.32s - 237.16s | Application module on it and so we're kind of noted that and that each role has custom permissions 237.64s - 239.64s | But the maker role does have that admin 240.16s - 242.64s | But it doesn't have all the admin purposes permissions 243.64s - 245.64s | There's a servlet path for the front office 246.04s - 248.04s | That we see here and the admin path 248.32s - 254.00s | what we kind of want to focus on though is these widget IDs and the event IDs because these are going to come critical as 254.00s - 256.36s | We go through and we're going to use them through those 256.64s - 263.28s | Modifiers several pages with keywords that we saw with that event ID and then we had the modifiers to go in with it 263.28s - 268.36s | And then the front office was in the web portal spot and input validation was required to get in 271.80s - 277.80s | So there was there was two sides of it this application one is a front-end and the other is the back-end 278.16s - 282.24s | Back-end is not really a back-end, but they have given custom permissions on it 283.24s - 290.08s | It is kind of very large


chunk_text:
role has custom permissions 237.64s - 239.64s | But the maker role does have that admin 240.16s - 242.64s | But it doesn't have all the admin purposes permissions 243.64s - 245.64s | There's a servlet path for the front office 246.04s - 248.04s | That we see here and the admin path 248.32s - 254.00s | what we kind of want to focus on though is these widget IDs and the event IDs because these are going to come critical as 254.00s - 256.36s | We go through and we're going to use them through those 256.64s - 263.28s | Modifiers several pages with keywords that we saw with that event ID and then we had the modifiers to go in with it 263.28s - 268.36s | And then the front office was in the web portal spot and input validation was required to get in 271.80s - 277.80s | So there was there was two sides of it this application one is a front-end and the other is the back-end 278.16s - 282.24s | Back-end is not really a back-end, but they have given custom permissions on it 283.24s - 290.08s | It is kind of very large application, so they haven't provided much much of like 290.80s - 292.80s | permissions on it 292.80s - 294.48s | so 294.48s - 300.08s | So when there was a demo, sorry, so so I started recon on the application 300.08s - 306.50s | I found that they are running a third-party application and this third-party application was a 307.20s - 310.56s | demo only so I couldn't find much information available on the 310.80s - 313.00s | And I don't want to call them and 313.84s - 316.24s | Have a demo setup for myself 316.96s - 321.76s | So I go ahead and decided to review their JavaScript files 323.00s - 325.00s | JavaScript so basically 325.00s - 332.12s | This application has two event IDs as to two parameters event IDs and widget widget IDs 332.52s - 339.00s | So what I did I and and there was there was one more parameter GC GC 339.00s - 345.68s | If which Charlie just explains that is used to I need I identify the bank customer all across the world 345.88s - 347.88s | so what I did I 348.04s - 350.04s | used a graphic script to


chunk_text:
application, so they haven't provided much much of like 290.80s - 292.80s | permissions on it 292.80s - 294.48s | so 294.48s - 300.08s | So when there was a demo, sorry, so so I started recon on the application 300.08s - 306.50s | I found that they are running a third-party application and this third-party application was a 307.20s - 310.56s | demo only so I couldn't find much information available on the 310.80s - 313.00s | And I don't want to call them and 313.84s - 316.24s | Have a demo setup for myself 316.96s - 321.76s | So I go ahead and decided to review their JavaScript files 323.00s - 325.00s | JavaScript so basically 325.00s - 332.12s | This application has two event IDs as to two parameters event IDs and widget widget IDs 332.52s - 339.00s | So what I did I and and there was there was one more parameter GC GC 339.00s - 345.68s | If which Charlie just explains that is used to I need I identify the bank customer all across the world 345.88s - 347.88s | so what I did I 348.04s - 350.04s | used a graphic script to 350.56s - 357.00s | Figure out all the event IDs because what happened is if you want to serve any functionality in this application 357.00s - 359.00s | You have to change the event IDs 359.64s - 362.12s | in the in the parameter and you will get 363.00s - 366.34s | If you if you have access to that particular functionality you will 367.34s - 370.18s | Able to load it. So what I did I just 371.18s - 373.38s | grab all the event IDs 373.94s - 375.94s | through through a graphic script and 377.62s - 383.58s | And and each there was like common.js file, but 384.10s - 389.46s | In each page you load the event IDs you will get a new 390.86s - 394.70s | JavaScript file and it has a it will contain a new 395.38s - 400.98s | Event IDs for next for maybe for the next functionalities. So 401.82s - 403.66s | so this is like 403.66s - 409.58s | this is like a few event IDs that I found from just just to start from and 410.02s - 417.22s | After I after I go load these event IDs in


chunk_text:
350.56s - 357.00s | Figure out all the event IDs because what happened is if you want to serve any functionality in this application 357.00s - 359.00s | You have to change the event IDs 359.64s - 362.12s | in the in the parameter and you will get 363.00s - 366.34s | If you if you have access to that particular functionality you will 367.34s - 370.18s | Able to load it. So what I did I just 371.18s - 373.38s | grab all the event IDs 373.94s - 375.94s | through through a graphic script and 377.62s - 383.58s | And and each there was like common.js file, but 384.10s - 389.46s | In each page you load the event IDs you will get a new 390.86s - 394.70s | JavaScript file and it has a it will contain a new 395.38s - 400.98s | Event IDs for next for maybe for the next functionalities. So 401.82s - 403.66s | so this is like 403.66s - 409.58s | this is like a few event IDs that I found from just just to start from and 410.02s - 417.22s | After I after I go load these event IDs in the application. I found like more than 417.90s - 419.26s | 500 419.26s - 421.26s | modules running on this application 422.10s - 424.65s | so 425.09s - 427.33s | Starting from the our first findings 428.01s - 429.17s | so 429.17s - 431.17s | It's an acceleration from 431.29s - 436.69s | Authorizer to admin role. So what they are doing that the maker role has admin button 436.69s - 442.17s | So when when I click the admin button, it will redirect me to the admin admin panel of it 442.21s - 446.45s | But the admin panel also do not have much permissions available 446.81s - 450.37s | Just a couple of couple of modules are loading 450.57s - 455.09s | So what so when I click click the click that 455.73s - 463.33s | admin role what I found that they are generating they are basically checking that if this role has 463.77s - 466.85s | dual dual code dual role available on their 467.41s - 469.25s | on their 469.25s - 471.09s | on their 471.09s - 475.77s | Privilege, I mean on their like like if I go through authorizer 475.77s - 481.93s |


chunk_text:
the application. I found like more than 417.90s - 419.26s | 500 419.26s - 421.26s | modules running on this application 422.10s - 424.65s | so 425.09s - 427.33s | Starting from the our first findings 428.01s - 429.17s | so 429.17s - 431.17s | It's an acceleration from 431.29s - 436.69s | Authorizer to admin role. So what they are doing that the maker role has admin button 436.69s - 442.17s | So when when I click the admin button, it will redirect me to the admin admin panel of it 442.21s - 446.45s | But the admin panel also do not have much permissions available 446.81s - 450.37s | Just a couple of couple of modules are loading 450.57s - 455.09s | So what so when I click click the click that 455.73s - 463.33s | admin role what I found that they are generating they are basically checking that if this role has 463.77s - 466.85s | dual dual code dual role available on their 467.41s - 469.25s | on their 469.25s - 471.09s | on their 471.09s - 475.77s | Privilege, I mean on their like like if I go through authorizer 475.77s - 481.93s | It will check that if if this role has dual permissions available or not 482.25s - 487.69s | if dual permissions are available, it will assign that admin panel to me, so 488.85s - 493.05s | what I did I just load this URL from from the 494.09s - 496.25s | from the authorizer role and 497.05s - 502.93s | It will allow me access to the admin panel, but there was no module was loading 502.93s - 507.65s | There was just they were just maybe just hiding the modules 509.05s - 513.05s | From the admin application. So what I did I just use the event IDs 513.61s - 520.25s | Put the event IDs in in the parameter and try to load try to load different modules 521.21s - 523.21s | from this generated 524.25s - 530.17s | Administration from the authorizer role, so I did it one by one from the 531.17s - 533.37s | Starting from the user list report, so 534.93s - 536.93s | When I when I load the event IDs 537.21s - 540.37s | I found that the page is 541.77s - 547.57s | Template page is loading and while clicking on


chunk_text:
It will check that if if this role has dual permissions available or not 482.25s - 487.69s | if dual permissions are available, it will assign that admin panel to me, so 488.85s - 493.05s | what I did I just load this URL from from the 494.09s - 496.25s | from the authorizer role and 497.05s - 502.93s | It will allow me access to the admin panel, but there was no module was loading 502.93s - 507.65s | There was just they were just maybe just hiding the modules 509.05s - 513.05s | From the admin application. So what I did I just use the event IDs 513.61s - 520.25s | Put the event IDs in in the parameter and try to load try to load different modules 521.21s - 523.21s | from this generated 524.25s - 530.17s | Administration from the authorizer role, so I did it one by one from the 531.17s - 533.37s | Starting from the user list report, so 534.93s - 536.93s | When I when I load the event IDs 537.21s - 540.37s | I found that the page is 541.77s - 547.57s | Template page is loading and while clicking on submit. I was able to access all their 548.25s - 550.89s | user from the from an authorizer role 552.37s - 553.73s | So 553.73s - 559.49s | Using those event IDs and there are some frames URLs as well. So the frame see wires are connecting 560.33s - 562.77s | connecting to the event IDs only so 565.65s - 572.01s | Whatever you load even the even the frames or event IDs you will get the same information and 573.21s - 577.33s | Just by loading one by one event IDs. You will actually able to 577.93s - 587.47s | Access all of their admin panel from an authorizer or verifier role. So it was just hiding hiding the hiding the 588.47s - 594.79s | Modules not actually authorizing the user for that particular role 595.79s - 596.99s | so 596.99s - 599.91s | This is the this is the second finding. I found like 600.79s - 603.87s | This is again. I'm I was using 606.11s - 608.11s | Event IDs to load up 608.55s - 610.47s | to load a particular 610.47s - 613.51s | particular function, so what I did I 614.39s - 618.79s | Using


chunk_text:
submit. I was able to access all their 548.25s - 550.89s | user from the from an authorizer role 552.37s - 553.73s | So 553.73s - 559.49s | Using those event IDs and there are some frames URLs as well. So the frame see wires are connecting 560.33s - 562.77s | connecting to the event IDs only so 565.65s - 572.01s | Whatever you load even the even the frames or event IDs you will get the same information and 573.21s - 577.33s | Just by loading one by one event IDs. You will actually able to 577.93s - 587.47s | Access all of their admin panel from an authorizer or verifier role. So it was just hiding hiding the hiding the 588.47s - 594.79s | Modules not actually authorizing the user for that particular role 595.79s - 596.99s | so 596.99s - 599.91s | This is the this is the second finding. I found like 600.79s - 603.87s | This is again. I'm I was using 606.11s - 608.11s | Event IDs to load up 608.55s - 610.47s | to load a particular 610.47s - 613.51s | particular function, so what I did I 614.39s - 618.79s | Using this GS link finder I caught up with a particular page 619.51s - 625.83s | limit setup main page dot GSP and when I load this page, I was actually able to 626.71s - 628.19s | get a 628.19s - 629.95s | get a 629.95s - 633.67s | Get a page where I was able to set up their 634.83s - 636.47s | customers 636.47s - 642.83s | Whatever whatever withdrawal or whatever daily limit they want to set for each customer. So 643.51s - 645.15s | I can set it for 645.15s - 649.75s | They are all customers as well. So once I click and 650.59s - 652.59s | approve this 653.23s - 655.23s | They just simply 655.31s - 658.45s | Set up their limit to all the all the customers they have 666.36s - 670.92s | Yeah last minute prep, sorry guys, it's to mean it's supposed to be a very surprised cat there 672.48s - 676.30s | So, yeah, so 676.66s - 680.62s | So when when I so there was another under part of this 681.30s - 688.14s | This functionality that I didn't didn't tell you that when you once you submit the


chunk_text:
this GS link finder I caught up with a particular page 619.51s - 625.83s | limit setup main page dot GSP and when I load this page, I was actually able to 626.71s - 628.19s | get a 628.19s - 629.95s | get a 629.95s - 633.67s | Get a page where I was able to set up their 634.83s - 636.47s | customers 636.47s - 642.83s | Whatever whatever withdrawal or whatever daily limit they want to set for each customer. So 643.51s - 645.15s | I can set it for 645.15s - 649.75s | They are all customers as well. So once I click and 650.59s - 652.59s | approve this 653.23s - 655.23s | They just simply 655.31s - 658.45s | Set up their limit to all the all the customers they have 666.36s - 670.92s | Yeah last minute prep, sorry guys, it's to mean it's supposed to be a very surprised cat there 672.48s - 676.30s | So, yeah, so 676.66s - 680.62s | So when when I so there was another under part of this 681.30s - 688.14s | This functionality that I didn't didn't tell you that when you once you submit the submit the 689.66s - 692.18s | Submit any request it will actually go to the 692.78s - 698.78s | Go to as authorizer. So you have to authorize that request in order to get it approved. So 699.54s - 703.10s | So these IDs are these event IDs are quite simple 703.10s - 708.38s | so as you say as you can see if you want to leave any page or modify any page or 709.10s - 714.46s | Authorize any page you just have to modify a simple value like view modify or 714.98s - 721.46s | and just just have to just have to alter those values to set set this up and 722.86s - 724.86s | once once you load this 725.46s - 727.46s | let's say you modify something and 727.98s - 733.42s | You end up in authorization page and you just have to modify the auth ID and 733.70s - 739.18s | Once you are once you go to the auth ID you will you will have to do I mean they display 739.78s - 746.70s | The value you just modified you just have to authorize that value to have it set up


chunk_text:
submit the 689.66s - 692.18s | Submit any request it will actually go to the 692.78s - 698.78s | Go to as authorizer. So you have to authorize that request in order to get it approved. So 699.54s - 703.10s | So these IDs are these event IDs are quite simple 703.10s - 708.38s | so as you say as you can see if you want to leave any page or modify any page or 709.10s - 714.46s | Authorize any page you just have to modify a simple value like view modify or 714.98s - 721.46s | and just just have to just have to alter those values to set set this up and 722.86s - 724.86s | once once you load this 725.46s - 727.46s | let's say you modify something and 727.98s - 733.42s | You end up in authorization page and you just have to modify the auth ID and 733.70s - 739.18s | Once you are once you go to the auth ID you will you will have to do I mean they display 739.78s - 746.70s | The value you just modified you just have to authorize that value to have it set up for all the users 747.26s - 749.26s | so 749.74s - 751.62s | So 751.62s - 754.78s | Since I since I modified a value from here 755.06s - 761.18s | I just modify I just go to the authorization page and there was a request pending that 762.06s - 763.22s | that 763.22s - 768.78s | This this particular thing is modified. You just have to authorize it or unauthorized unauthorized 768.78s - 773.46s | so just for since since it it was client application, and I don't want to 774.46s - 775.94s | impact it much 775.94s - 781.74s | so I just use the unauthorized button to simply reject the request which I just 782.10s - 789.78s | Sent for modification since it was for all the customers. So just just for a safer side. Maybe they are using a 790.42s - 791.78s | broad 791.78s - 793.02s | behind 793.02s - 796.62s | And showing us this is a staging environment only 798.54s - 805.22s | So so from from from authorized page, I just click on the authorizer ID which was 805.78s - 808.26s | which was which I just modified and 809.10s - 810.70s


chunk_text:
for all the users 747.26s - 749.26s | so 749.74s - 751.62s | So 751.62s - 754.78s | Since I since I modified a value from here 755.06s - 761.18s | I just modify I just go to the authorization page and there was a request pending that 762.06s - 763.22s | that 763.22s - 768.78s | This this particular thing is modified. You just have to authorize it or unauthorized unauthorized 768.78s - 773.46s | so just for since since it it was client application, and I don't want to 774.46s - 775.94s | impact it much 775.94s - 781.74s | so I just use the unauthorized button to simply reject the request which I just 782.10s - 789.78s | Sent for modification since it was for all the customers. So just just for a safer side. Maybe they are using a 790.42s - 791.78s | broad 791.78s - 793.02s | behind 793.02s - 796.62s | And showing us this is a staging environment only 798.54s - 805.22s | So so from from from authorized page, I just click on the authorizer ID which was 805.78s - 808.26s | which was which I just modified and 809.10s - 810.70s | On this page 810.70s - 812.70s | There was two two things 812.70s - 819.10s | Authorize reject you if you if you authorize it will set up for all the cost all the all their customers if you reject 819.10s - 823.94s | It will instantly reject and do not modify the those limits to all the customers 824.44s - 828.02s | So I just rejected it and and simply got rejected 829.06s - 830.22s | so 830.22s - 832.22s | in the finding three the 832.34s - 835.14s | It was a customer onboarding ID or 835.90s - 839.06s | Again it was it was through the event IDs only and 839.94s - 843.74s | I found an interesting event IDs from the from the JS that 844.74s - 848.62s | customer set of view page, so I thought I thought I 849.26s - 853.58s | Might I might be able to I might be able to set up the customer 854.34s - 859.50s | customers information from this page, so what I did I just go to the 859.54s - 861.94s | So what I did I just go to the 862.98s - 869.06s | servlet


chunk_text:
| On this page 810.70s - 812.70s | There was two two things 812.70s - 819.10s | Authorize reject you if you if you authorize it will set up for all the cost all the all their customers if you reject 819.10s - 823.94s | It will instantly reject and do not modify the those limits to all the customers 824.44s - 828.02s | So I just rejected it and and simply got rejected 829.06s - 830.22s | so 830.22s - 832.22s | in the finding three the 832.34s - 835.14s | It was a customer onboarding ID or 835.90s - 839.06s | Again it was it was through the event IDs only and 839.94s - 843.74s | I found an interesting event IDs from the from the JS that 844.74s - 848.62s | customer set of view page, so I thought I thought I 849.26s - 853.58s | Might I might be able to I might be able to set up the customer 854.34s - 859.50s | customers information from this page, so what I did I just go to the 859.54s - 861.94s | So what I did I just go to the 862.98s - 869.06s | servlet and I modified the event IDs to customer set it set up view main page and 869.70s - 871.54s | what I and 871.54s - 873.54s | there was and 873.54s - 877.38s | When when I loaded it was actually loading that customers 878.82s - 880.82s | customers in information and 882.42s - 884.82s | There was there was one more button that is 885.18s - 892.26s | Action if you if you want to modify modify or thrice or something you can use action or either you can just mode 892.26s - 894.46s | do you just put the value in the 895.18s - 900.90s | Event IDs itself so once you once you get once you got the event 901.22s - 906.02s | once you got the that customer did you you just have to click on it and 907.86s - 909.58s | And 909.62s - 914.66s | You can you can modify whatever the group name or you can even 915.98s - 917.98s | remove the remove the 918.58s - 922.74s | corporate ID from from that particular customer so once you remove the 923.42s - 928.66s | corporate ID that from that customer actually all


chunk_text:
and I modified the event IDs to customer set it set up view main page and 869.70s - 871.54s | what I and 871.54s - 873.54s | there was and 873.54s - 877.38s | When when I loaded it was actually loading that customers 878.82s - 880.82s | customers in information and 882.42s - 884.82s | There was there was one more button that is 885.18s - 892.26s | Action if you if you want to modify modify or thrice or something you can use action or either you can just mode 892.26s - 894.46s | do you just put the value in the 895.18s - 900.90s | Event IDs itself so once you once you get once you got the event 901.22s - 906.02s | once you got the that customer did you you just have to click on it and 907.86s - 909.58s | And 909.62s - 914.66s | You can you can modify whatever the group name or you can even 915.98s - 917.98s | remove the remove the 918.58s - 922.74s | corporate ID from from that particular customer so once you remove the 923.42s - 928.66s | corporate ID that from that customer actually all their accounts could get unlinked and 929.94s - 936.78s | They they're even their customers do not have do not able to access their account informations 937.34s - 943.20s | so 943.20s - 949.88s | Well, well, so again once I once I submit this request I have to authorize this 950.20s - 952.20s | so I just modified the 953.00s - 956.40s | Event ID to auth page and once I go there 956.40s - 963.00s | I just have to authorize or reject this in order to approve it for that dot that particular customer 963.36s - 966.83s | so while while while 967.51s - 971.79s | While doing this all of all of this. I also found found that 972.79s - 977.55s | The customer setup page was also vulnerable to accesses 977.67s - 982.47s | so what I did I just put the put the access payload in their 983.51s - 985.51s | their 985.79s - 987.43s | Relationship manager 987.43s - 989.07s | name and 989.07s - 993.87s | Whenever they see the relationship manager name on their bank 994.87s - 996.19s | bank 996.19s - 1000.59s | Account the the accesses payload will pop


chunk_text:
their accounts could get unlinked and 929.94s - 936.78s | They they're even their customers do not have do not able to access their account informations 937.34s - 943.20s | so 943.20s - 949.88s | Well, well, so again once I once I submit this request I have to authorize this 950.20s - 952.20s | so I just modified the 953.00s - 956.40s | Event ID to auth page and once I go there 956.40s - 963.00s | I just have to authorize or reject this in order to approve it for that dot that particular customer 963.36s - 966.83s | so while while while 967.51s - 971.79s | While doing this all of all of this. I also found found that 972.79s - 977.55s | The customer setup page was also vulnerable to accesses 977.67s - 982.47s | so what I did I just put the put the access payload in their 983.51s - 985.51s | their 985.79s - 987.43s | Relationship manager 987.43s - 989.07s | name and 989.07s - 993.87s | Whenever they see the relationship manager name on their bank 994.87s - 996.19s | bank 996.19s - 1000.59s | Account the the accesses payload will pop up and I can 1001.11s - 1004.75s | able to grab their cookies just from just straight from their 1005.43s - 1006.59s | their 1006.59s - 1008.59s | bank bank account 1008.75s - 1013.53s | so 1014.53s - 1016.53s | So the as I said 1016.53s - 1023.37s | There was a there was two side of this application one is for the front front office and one is the back office 1023.77s - 1025.77s | the front office 1025.81s - 1032.13s | Contains the widget widget servlet and the back of back office contains 1033.37s - 1035.37s | contains the 1035.81s - 1038.33s | Another another servlet, so 1039.73s - 1045.05s | So what I did I just I just sort all the widget controller and 1045.57s - 1047.81s | try I start fudging for 1048.81s - 1051.97s | SQL SQL injection vulnerabilities, but I found that 1052.97s - 1056.61s | There was one parameter that is called the DIR 1056.81s - 1061.45s | It was giving me 500 internal server error while supplying a single single code 1061.57s - 1063.45s | so I 1063.45s - 1067.45s | So I thought I mean there was a change in response


chunk_text:
up and I can 1001.11s - 1004.75s | able to grab their cookies just from just straight from their 1005.43s - 1006.59s | their 1006.59s - 1008.59s | bank bank account 1008.75s - 1013.53s | so 1014.53s - 1016.53s | So the as I said 1016.53s - 1023.37s | There was a there was two side of this application one is for the front front office and one is the back office 1023.77s - 1025.77s | the front office 1025.81s - 1032.13s | Contains the widget widget servlet and the back of back office contains 1033.37s - 1035.37s | contains the 1035.81s - 1038.33s | Another another servlet, so 1039.73s - 1045.05s | So what I did I just I just sort all the widget controller and 1045.57s - 1047.81s | try I start fudging for 1048.81s - 1051.97s | SQL SQL injection vulnerabilities, but I found that 1052.97s - 1056.61s | There was one parameter that is called the DIR 1056.81s - 1061.45s | It was giving me 500 internal server error while supplying a single single code 1061.57s - 1063.45s | so I 1063.45s - 1067.45s | So I thought I mean there was a change in response 1067.45s - 1071.05s | So I thought let's try some Boolean and blind conditions 1071.21s - 1077.17s | so when I try when I started fuzzing for Boolean and blind based I found that 1078.01s - 1084.77s | There was a Boolean based blind is working and the database is Oracle and I 1085.37s - 1091.89s | I just I just use a SQL map to dump all their all their databases and I 1092.09s - 1095.81s | Was able to fuzz I was able to get all of their 1096.85s - 1099.09s | all of their database systems 1101.52s - 1103.16s | so 1103.16s - 1110.40s | Since since I was able to since I was able to escalate the escalate the authorizer or very very fire rolled in the 1110.80s - 1114.56s | admin panel, so I just used an authorizer role and 1115.52s - 1121.20s | I tried to weave the customer customer we've set a customer set of view page and 1121.68s - 1127.80s | I found that the customer name and content customer and customer underscore name was vulnerable to 1128.40s - 1130.40s | again Boolean based blind and 1131.08s - 1133.52s | What I


chunk_text:
1067.45s - 1071.05s | So I thought let's try some Boolean and blind conditions 1071.21s - 1077.17s | so when I try when I started fuzzing for Boolean and blind based I found that 1078.01s - 1084.77s | There was a Boolean based blind is working and the database is Oracle and I 1085.37s - 1091.89s | I just I just use a SQL map to dump all their all their databases and I 1092.09s - 1095.81s | Was able to fuzz I was able to get all of their 1096.85s - 1099.09s | all of their database systems 1101.52s - 1103.16s | so 1103.16s - 1110.40s | Since since I was able to since I was able to escalate the escalate the authorizer or very very fire rolled in the 1110.80s - 1114.56s | admin panel, so I just used an authorizer role and 1115.52s - 1121.20s | I tried to weave the customer customer we've set a customer set of view page and 1121.68s - 1127.80s | I found that the customer name and content customer and customer underscore name was vulnerable to 1128.40s - 1130.40s | again Boolean based blind and 1131.08s - 1133.52s | What I do I just went ahead and 1134.88s - 1141.32s | Started started the SQL map on it and I was able to dump all their DB again 1142.96s - 1148.40s | So I got like I said like this was fun and profit 1148.40s - 1153.04s | So I got all the fun and I got all of profits as well 1155.16s - 1156.44s | So 1156.44s - 1160.64s | So later after an year they come and they said that 1162.28s - 1164.40s | We have fixed all the issues 1164.52s - 1171.04s | so what they did they just removed the corporate admin power module from the application and they think that it's 1171.48s - 1173.48s | fixed from their side and 1173.76s - 1180.76s | on the on the on the front end they they come after another one year and they put the 1181.24s - 1182.76s | cloud fear 1182.76s - 1189.75s | Across their application and they think that it's fixed again. So that's 1190.95s - 1196.55s | Yeah, so looking at it from my end from the triage in you have to ask what the clients always ask us 1196.55s - 1202.43s | What


chunk_text:
do I just went ahead and 1134.88s - 1141.32s | Started started the SQL map on it and I was able to dump all their DB again 1142.96s - 1148.40s | So I got like I said like this was fun and profit 1148.40s - 1153.04s | So I got all the fun and I got all of profits as well 1155.16s - 1156.44s | So 1156.44s - 1160.64s | So later after an year they come and they said that 1162.28s - 1164.40s | We have fixed all the issues 1164.52s - 1171.04s | so what they did they just removed the corporate admin power module from the application and they think that it's 1171.48s - 1173.48s | fixed from their side and 1173.76s - 1180.76s | on the on the on the front end they they come after another one year and they put the 1181.24s - 1182.76s | cloud fear 1182.76s - 1189.75s | Across their application and they think that it's fixed again. So that's 1190.95s - 1196.55s | Yeah, so looking at it from my end from the triage in you have to ask what the clients always ask us 1196.55s - 1202.43s | What what it's matter if you come in you do a cross-site scripting you pop a alert that just says one 1203.07s - 1208.27s | The CEO is gonna go. Okay, what we had to kind of go in and explain to him is not only do we 1208.99s - 1213.99s | Manage to have almost full admin access from any role across your system 1214.23s - 1218.91s | we managed to also dump your entire SQL database and showed them a row in a column that we pulled and 1219.31s - 1225.15s | So we can also take care of that and then in addition anybody who has a relationship manager listed 1225.15s - 1228.79s | I can now get their creds. That's all his high-value clients 1229.51s - 1233.75s | When we see these relationship managers in our banking app, imagine that just stole your ID 1234.35s - 1236.83s | That's where they start coming in and they go. Oh 1237.83s - 1242.63s | And yeah, that's when you want to be that guy going this is what I found you 1243.15s - 1245.95s | And so getting their attention with this when they see it 1245.95s - 1250.83s


chunk_text:
what it's matter if you come in you do a cross-site scripting you pop a alert that just says one 1203.07s - 1208.27s | The CEO is gonna go. Okay, what we had to kind of go in and explain to him is not only do we 1208.99s - 1213.99s | Manage to have almost full admin access from any role across your system 1214.23s - 1218.91s | we managed to also dump your entire SQL database and showed them a row in a column that we pulled and 1219.31s - 1225.15s | So we can also take care of that and then in addition anybody who has a relationship manager listed 1225.15s - 1228.79s | I can now get their creds. That's all his high-value clients 1229.51s - 1233.75s | When we see these relationship managers in our banking app, imagine that just stole your ID 1234.35s - 1236.83s | That's where they start coming in and they go. Oh 1237.83s - 1242.63s | And yeah, that's when you want to be that guy going this is what I found you 1243.15s - 1245.95s | And so getting their attention with this when they see it 1245.95s - 1250.83s | They were paying a lot of attention once they saw clearly what the impact was that basically 1251.39s - 1253.39s | Nix ran roughshod over him 1253.95s - 1258.39s | So yeah, that's kind of what we're looking at with bad session management 1258.87s - 1260.07s | so 1260.07s - 1262.07s | Anything else add next? 1262.07s - 1267.91s | That's all for a month. All right. Thank you guys. Hopefully this was kind of informative and you guys learned something


chunk_text:
| They were paying a lot of attention once they saw clearly what the impact was that basically 1251.39s - 1253.39s | Nix ran roughshod over him 1253.95s - 1258.39s | So yeah, that's kind of what we're looking at with bad session management 1258.87s - 1260.07s | so 1260.07s - 1262.07s | Anything else add next? 1262.07s - 1267.91s | That's all for a month. All right. Thank you guys. Hopefully this was kind of informative and you guys learned something


chunk_id: 132_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=mFJ-NUnFBac", "title": "DEF CON 32 - Abusing Windows Hello Without a Severed Hand - Ceri Coburn, Dirk jan Mollema", "description": "Windows Hello is touted by Microsoft as the modern de facto authentication scheme on Windows platforms, supporting authentication and encryption backed by biometrics. In a world that is quickly accelerating towards a passwordless existence, what new threats do we face in this complex landscape? We will take a deep dive into the inner working of Windows Hello. Via the release of a new tool, it will be demonstrated how an attacker on a fully compromised Windows host can leverage secrets backed by Windows Hello biometrics without needing the biometric data that protects them. We will also show how the hardware protections of Windows Hello and its accompanying Primary Refresh Tokens can be defeated, making it possible to use Windows Hello for identity persistency and PRT stealing, in some cases even without Administrator access on the host.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2518, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241102" } 0.11s - 12.71s | This text was transcribed using whisper model: large-v2 We're going to start by introducing Kerry and Dirk, abusing Windows Hello without a 12.71s - 22.66s | severed hand. Give a good hand for Kerry and Dirk. 22.66s - 29.98s | Good afternoon everyone. So my name's Kerry. I'm from Wales in the United Kingdom. So my 29.98s - 36.62s | background is in software development. I was in that world for around 18 years within 36.62s - 45.36s | the DRM and security solution space. And back in 2019 to this very DEF CON week, I switched 45.36s - 51.94s | over to cyber security and joined Pentest Partners. So I've been dedicated to red teaming 51.94s - 56.76s | and offensive security for the last three years and have spoken at DEF CON last year 56.76s - 63.88s | and various besides events as well. And I I am authored several tools on GitHub, um 63.88s - 69.34s | mostly on the offensive security side, uh but one or two on the uh defensive side as 69.34s - 77.76s | well. Hi, so I'm Dirk. I'm just gonna put this down here. Yeah. We're gonna leave that 77.76s - 83.72s | one there where it is. Um so I'm Dirk Jan. Um second time DEF CON. Um I've given a talk 83.72s - 89.80s | uh


chunk_id: 132_chunk_1
chunk_text:
hand. Give a good hand for Kerry and Dirk. 22.66s - 29.98s | Good afternoon everyone. So my name's Kerry. I'm from Wales in the United Kingdom. So my 29.98s - 36.62s | background is in software development. I was in that world for around 18 years within 36.62s - 45.36s | the DRM and security solution space. And back in 2019 to this very DEF CON week, I switched 45.36s - 51.94s | over to cyber security and joined Pentest Partners. So I've been dedicated to red teaming 51.94s - 56.76s | and offensive security for the last three years and have spoken at DEF CON last year 56.76s - 63.88s | and various besides events as well. And I I am authored several tools on GitHub, um 63.88s - 69.34s | mostly on the offensive security side, uh but one or two on the uh defensive side as 69.34s - 77.76s | well. Hi, so I'm Dirk. I'm just gonna put this down here. Yeah. We're gonna leave that 77.76s - 83.72s | one there where it is. Um so I'm Dirk Jan. Um second time DEF CON. Um I've given a talk 83.72s - 89.80s | uh at quite a few conferences. I started at making uh Active Directory tools. Slowly 89.80s - 95.26s | switched to the Azure AD space which is now called Entra. Um I have a blog. I have a Twitter 95.26s - 100.50s | account. But mainly excited to to be here. Um and show you our latest research on uh 100.50s - 106.84s | Windows 11. So show you all the first parts and then I'll come in later and we'll uh uh 106.84s - 113.40s | basically talk you through all the nice things things that we did in the past couple months. 113.50s - 119.28s | So uh as Dirk Jan said, the talk is in two halves. So the first half is a focus on abusing 119.28s - 124.02s | Windows Hello from a privileged perspective. Uh so we'll go into sort of Windows Hello 124.02s - 129.38s | containers, protectors, and keys. Uh I'll do a quick tool demonstration of the tool 129.38s - 133.96s | that was released as part of this research. And then we switch to sort of attacks that 133.96s - 142.16s | you can do uh from a an unprivileged perspective which


chunk_id: 132_chunk_2
chunk_text:
at quite a few conferences. I started at making uh Active Directory tools. Slowly 89.80s - 95.26s | switched to the Azure AD space which is now called Entra. Um I have a blog. I have a Twitter 95.26s - 100.50s | account. But mainly excited to to be here. Um and show you our latest research on uh 100.50s - 106.84s | Windows 11. So show you all the first parts and then I'll come in later and we'll uh uh 106.84s - 113.40s | basically talk you through all the nice things things that we did in the past couple months. 113.50s - 119.28s | So uh as Dirk Jan said, the talk is in two halves. So the first half is a focus on abusing 119.28s - 124.02s | Windows Hello from a privileged perspective. Uh so we'll go into sort of Windows Hello 124.02s - 129.38s | containers, protectors, and keys. Uh I'll do a quick tool demonstration of the tool 129.38s - 133.96s | that was released as part of this research. And then we switch to sort of attacks that 133.96s - 142.16s | you can do uh from a an unprivileged perspective which which Dirk Jan will be doing then. So 142.16s - 148.24s | what is Windows Hello? It's Microsoft's passwordless technology. Uh it's it's the ethos 148.24s - 153.88s | behind it is sort of two key pairs that are generated uh when they're enrolled either for 153.88s - 158.88s | the operating system when you log in. Uh it can also be used for pass keys and even third 158.88s - 166.22s | party applications can enroll uh Windows Hello key pairs. So in terms of the differences 166.22s - 170.96s | between Windows Hello and Windows Hello for Business, there aren't any in a in a technical 170.96s - 175.94s | sense. The only difference is that uh Windows Hello for Business is a focus on certificate 175.94s - 181.54s | based authentication to Active Directory whereas um Windows Hello is more sort of consumer 181.54s - 190.77s | market. So we'll start with key storage providers. Uh so Windows has got a common API for dealing 190.77s - 196.29s | with cryptographic operations and they are called key storage providers. So some examples 196.29s - 202.25s | of the ones that have existed for many years uh there's


chunk_id: 132_chunk_3
chunk_text:
which Dirk Jan will be doing then. So 142.16s - 148.24s | what is Windows Hello? It's Microsoft's passwordless technology. Uh it's it's the ethos 148.24s - 153.88s | behind it is sort of two key pairs that are generated uh when they're enrolled either for 153.88s - 158.88s | the operating system when you log in. Uh it can also be used for pass keys and even third 158.88s - 166.22s | party applications can enroll uh Windows Hello key pairs. So in terms of the differences 166.22s - 170.96s | between Windows Hello and Windows Hello for Business, there aren't any in a in a technical 170.96s - 175.94s | sense. The only difference is that uh Windows Hello for Business is a focus on certificate 175.94s - 181.54s | based authentication to Active Directory whereas um Windows Hello is more sort of consumer 181.54s - 190.77s | market. So we'll start with key storage providers. Uh so Windows has got a common API for dealing 190.77s - 196.29s | with cryptographic operations and they are called key storage providers. So some examples 196.29s - 202.25s | of the ones that have existed for many years uh there's the software key storage provider. 202.25s - 207.73s | So as the name suggests, the keys for this particular provider are all generated in software. 207.73s - 212.33s | So if you do have system level access to an operating system, it means that you can you 212.33s - 217.57s | know exfiltrate these keys. Then you've got the newer uh platform key storage provider 217.57s - 223.95s | uh and this is for uh machines that have TPM. And the Microsoft SmartCard key storage provider 223.95s - 230.55s | which obviously is for storing uh private keys on SmartCard. So the KSPs they they design 230.55s - 236.43s | for general uh crypt cryptographic operations or encryption, sign in, key agreement, that 236.43s - 243.07s | sort of thing. And Windows Hello is no different. They've they've implemented a KSP called uh 243.07s - 249.07s | the passport key storage provider. So the passport key storage provider is split into 249.07s - 255.27s | sort of two privileged services. You've got the NGC service which is where the applications 255.27s - 260.95s | communicate with over an RPC interface. And then the NGC service will communicate with 260.95s -


chunk_id: 132_chunk_4
chunk_text:
the software key storage provider. 202.25s - 207.73s | So as the name suggests, the keys for this particular provider are all generated in software. 207.73s - 212.33s | So if you do have system level access to an operating system, it means that you can you 212.33s - 217.57s | know exfiltrate these keys. Then you've got the newer uh platform key storage provider 217.57s - 223.95s | uh and this is for uh machines that have TPM. And the Microsoft SmartCard key storage provider 223.95s - 230.55s | which obviously is for storing uh private keys on SmartCard. So the KSPs they they design 230.55s - 236.43s | for general uh crypt cryptographic operations or encryption, sign in, key agreement, that 236.43s - 243.07s | sort of thing. And Windows Hello is no different. They've they've implemented a KSP called uh 243.07s - 249.07s | the passport key storage provider. So the passport key storage provider is split into 249.07s - 255.27s | sort of two privileged services. You've got the NGC service which is where the applications 255.27s - 260.95s | communicate with over an RPC interface. And then the NGC service will communicate with 260.95s - 266.63s | the NGC controller service. Now this particular service um is tasked with storing all the 266.63s - 272.67s | metadata associated with any enrolled Windows Hello keys. And that metadata is stored within 272.67s - 279.47s | local app data, Microsoft NGC for the local service account. And you do need system level 279.51s - 289.10s | privileges to access that particular folder. So the KSP for sorry the passport key storage 289.10s - 294.24s | provider is essentially a proxy actually for the exit existing key storage providers that I 294.24s - 299.34s | just talked about. So it doesn't actually implement any of the uh public private key 299.34s - 304.22s | operations itself within the passport key storage provider. It essentially proxies it and 304.22s - 309.22s | offloads it to the KSPs. Now each um user is enrolled within a container folder. Uh so 312.92s - 317.70s | it's a GUID there that you see on the right hand side image. So every user has their own unique 317.70s - 323.10s | container folder. And within the containers then you have a collection of protectors and the 323.10s - 329.54s | key metadata and


chunk_id: 132_chunk_5
chunk_text:
266.63s | the NGC controller service. Now this particular service um is tasked with storing all the 266.63s - 272.67s | metadata associated with any enrolled Windows Hello keys. And that metadata is stored within 272.67s - 279.47s | local app data, Microsoft NGC for the local service account. And you do need system level 279.51s - 289.10s | privileges to access that particular folder. So the KSP for sorry the passport key storage 289.10s - 294.24s | provider is essentially a proxy actually for the exit existing key storage providers that I 294.24s - 299.34s | just talked about. So it doesn't actually implement any of the uh public private key 299.34s - 304.22s | operations itself within the passport key storage provider. It essentially proxies it and 304.22s - 309.22s | offloads it to the KSPs. Now each um user is enrolled within a container folder. Uh so 312.92s - 317.70s | it's a GUID there that you see on the right hand side image. So every user has their own unique 317.70s - 323.10s | container folder. And within the containers then you have a collection of protectors and the 323.10s - 329.54s | key metadata and various bits and pieces like that. So breaking down into containers 329.54s - 335.98s | themselves. So they're all all all the metadata is split across these dot files. Um generally 335.98s - 341.08s | most of them are are unicode strings within them. So as an example there you can see one dot 341.08s - 346.08s | dot contains the user security ID. Um seven dot dot contains the backing key storage 348.48s - 353.78s | provider for for this particular container which is either TPM backed or or software 353.78s - 359.96s | depending on if a TPM exists or not. And then you got nine dot dot which stores the Azure 359.96s - 364.96s | recovery key which we'll get into that uh a little later on. So protectors. These are your 365.12s - 370.12s | Windows Hello authentication methods. Um so more commonly the bio protector which would be 373.26s - 379.36s | your face or your fingerprint uh method of authentication. And of course you got the usual 379.36s - 384.84s | pin that you enroll with Windows Hello as well. And those protectors they have a file called 384.84s - 391.42s | fifteen dot


chunk_id: 132_chunk_6
chunk_text:
various bits and pieces like that. So breaking down into containers 329.54s - 335.98s | themselves. So they're all all all the metadata is split across these dot files. Um generally 335.98s - 341.08s | most of them are are unicode strings within them. So as an example there you can see one dot 341.08s - 346.08s | dot contains the user security ID. Um seven dot dot contains the backing key storage 348.48s - 353.78s | provider for for this particular container which is either TPM backed or or software 353.78s - 359.96s | depending on if a TPM exists or not. And then you got nine dot dot which stores the Azure 359.96s - 364.96s | recovery key which we'll get into that uh a little later on. So protectors. These are your 365.12s - 370.12s | Windows Hello authentication methods. Um so more commonly the bio protector which would be 373.26s - 379.36s | your face or your fingerprint uh method of authentication. And of course you got the usual 379.36s - 384.84s | pin that you enroll with Windows Hello as well. And those protectors they have a file called 384.84s - 391.42s | fifteen dot dot. And this is where um a set of intermediate pins are encrypted. Now these 391.98s - 396.78s | intermediate pins are the same across all protectors. But of course they are encrypted 396.78s - 402.16s | differently depending on what protector was being used. And the intermediate pin is split 402.16s - 408.16s | across a signing pin, a decrypt pin, and what I believe to be an external pin which again we'll 408.16s - 414.84s | touch on that in a bit. Now there are five known protectors. Um and each of these gets a a 414.84s - 420.50s | folder within the uh the container folder itself. And the the folder name is actually based 420.52s - 426.42s | on the ID. So number one is the pin protector. Number two is the bio protector which covers 426.42s - 433.14s | both face and fingerprint. And then you got the number three is the Azure recovery protector. 433.14s - 437.40s | I'd never seen references to number four. They don't seem to be in the symbols for Microsoft. 437.40s - 441.94s | So not quite sure what happened there. So they skipped straight to five which was


chunk_id: 132_chunk_7
chunk_text:
dot. And this is where um a set of intermediate pins are encrypted. Now these 391.98s - 396.78s | intermediate pins are the same across all protectors. But of course they are encrypted 396.78s - 402.16s | differently depending on what protector was being used. And the intermediate pin is split 402.16s - 408.16s | across a signing pin, a decrypt pin, and what I believe to be an external pin which again we'll 408.16s - 414.84s | touch on that in a bit. Now there are five known protectors. Um and each of these gets a a 414.84s - 420.50s | folder within the uh the container folder itself. And the the folder name is actually based 420.52s - 426.42s | on the ID. So number one is the pin protector. Number two is the bio protector which covers 426.42s - 433.14s | both face and fingerprint. And then you got the number three is the Azure recovery protector. 433.14s - 437.40s | I'd never seen references to number four. They don't seem to be in the symbols for Microsoft. 437.40s - 441.94s | So not quite sure what happened there. So they skipped straight to five which was the pre-boot 441.94s - 447.68s | protector. And then you've got uh number six which is a companion device protector. But that 447.70s - 452.70s | was deprecated in Windows 10 uh version 2004. So we start off with the pin protector. So the 455.50s - 462.14s | pin protector can be both alphanumeric and numeric. But by default um it's it's numeric only. 462.14s - 467.54s | So you have to actually click a checkbox to say that you want want it to be alphanumeric. Uh but 467.54s - 474.26s | if it is numeric um inside seven dot dot it actually stores the pin length. And this is how 474.30s - 478.24s | or this is why that once you've got the the correct pin when you're logging in with Windows 478.24s - 483.44s | Hello it will automatically uh log you in without pressing enter. And it it knows that based on 483.44s - 489.12s | the pin length that is stored. Uh one dot dot again just contains the back end key storage 489.12s - 494.92s | provider that's used for encrypting the protector. And then in a when it's using the software 494.92s - 501.60s


chunk_id: 132_chunk_8
chunk_text:
the pre-boot 441.94s - 447.68s | protector. And then you've got uh number six which is a companion device protector. But that 447.70s - 452.70s | was deprecated in Windows 10 uh version 2004. So we start off with the pin protector. So the 455.50s - 462.14s | pin protector can be both alphanumeric and numeric. But by default um it's it's numeric only. 462.14s - 467.54s | So you have to actually click a checkbox to say that you want want it to be alphanumeric. Uh but 467.54s - 474.26s | if it is numeric um inside seven dot dot it actually stores the pin length. And this is how 474.30s - 478.24s | or this is why that once you've got the the correct pin when you're logging in with Windows 478.24s - 483.44s | Hello it will automatically uh log you in without pressing enter. And it it knows that based on 483.44s - 489.12s | the pin length that is stored. Uh one dot dot again just contains the back end key storage 489.12s - 494.92s | provider that's used for encrypting the protector. And then in a when it's using the software 494.92s - 501.60s | KSP two dot dot contains the uh the software key storage provider key ID that was used for 501.60s - 506.60s | protecting the biometric data. So Teal from the insecurity dot B website that you've done an 509.18s - 514.82s | excellent blog on this and I do highly recommend you take uh a read of it. So this is the 514.82s - 519.82s | process of how the pin protector is decrypted uh during the a software based approach. So that 521.96s - 526.96s | area in red there you see is is DPAPING encrypted blob. Um there are sort of articles on the 527.22s - 532.22s | web already uh that cover the internals of DPAPING. Uh but what basically happens is the user 535.60s - 540.60s | enters in a pin that goes through a PBKDF2 key derivation function uh along with certain the 543.38s - 548.88s | salt and the rounds that comes from um the CNG key that gets stored as part of the software 548.88s - 553.88s | KSP. And that eventually will return you a a private key and a separate RSA private key that is 554.88s - 559.88s | actually


chunk_id: 132_chunk_9
chunk_text:
| KSP two dot dot contains the uh the software key storage provider key ID that was used for 501.60s - 506.60s | protecting the biometric data. So Teal from the insecurity dot B website that you've done an 509.18s - 514.82s | excellent blog on this and I do highly recommend you take uh a read of it. So this is the 514.82s - 519.82s | process of how the pin protector is decrypted uh during the a software based approach. So that 521.96s - 526.96s | area in red there you see is is DPAPING encrypted blob. Um there are sort of articles on the 527.22s - 532.22s | web already uh that cover the internals of DPAPING. Uh but what basically happens is the user 535.60s - 540.60s | enters in a pin that goes through a PBKDF2 key derivation function uh along with certain the 543.38s - 548.88s | salt and the rounds that comes from um the CNG key that gets stored as part of the software 548.88s - 553.88s | KSP. And that eventually will return you a a private key and a separate RSA private key that is 554.88s - 559.88s | actually used for decrypting the intermediate pins inside 15 dot dot. So moving on to TPM based 563.78s - 569.46s | decryption it as you can see it's a lot simpler. There's no key derivation function going on or 569.46s - 574.70s | anything like that like the software version. Uh all that happens is the the pin is entered it 574.70s - 579.70s | gets converted to hex and that's what's used to unseal um the 15 dot dot uh intermediate pins. 580.70s - 585.70s | So the two dot dot is no longer present in that scenario and that's because there is a fixed key 588.24s - 594.99s | ID that it uses every time so it doesn't generate anyone. So what type of abuses can we do with the 594.99s - 599.99s | pin protector? So when it's TPM backed it's actually fairly robust um the biggest risk I would 601.93s - 606.93s | say is four digit pins can probably be brute forced within around 70 days um based on the 607.75s - 613.99s | anti-hammering technology within the TPM it basically slows down any brute forcing. So a four 613.99s - 619.47s | digit pin would


chunk_id: 132_chunk_10
chunk_text:
used for decrypting the intermediate pins inside 15 dot dot. So moving on to TPM based 563.78s - 569.46s | decryption it as you can see it's a lot simpler. There's no key derivation function going on or 569.46s - 574.70s | anything like that like the software version. Uh all that happens is the the pin is entered it 574.70s - 579.70s | gets converted to hex and that's what's used to unseal um the 15 dot dot uh intermediate pins. 580.70s - 585.70s | So the two dot dot is no longer present in that scenario and that's because there is a fixed key 588.24s - 594.99s | ID that it uses every time so it doesn't generate anyone. So what type of abuses can we do with the 594.99s - 599.99s | pin protector? So when it's TPM backed it's actually fairly robust um the biggest risk I would 601.93s - 606.93s | say is four digit pins can probably be brute forced within around 70 days um based on the 607.75s - 613.99s | anti-hammering technology within the TPM it basically slows down any brute forcing. So a four 613.99s - 619.47s | digit pin would take about 70 days. But if we move over to a software backed pin that's when you 619.47s - 624.47s | start to get in trouble. So there's a hashcat hash that already exists within hashcat that you can 626.21s - 632.41s | generate a windows hello based um hash but because we now know the lengths of the pin as well we 632.43s - 638.01s | can make a targeted mask attack when you're decrypting it and with a de a decent uh or modest 638.01s - 644.27s | rig I should say eight digits can be cracked within seconds uh and up to 11 digits you can still 644.27s - 651.01s | do within uh within days. Uh and thanks to the windows hello to uh hashcat project for that 651.01s - 657.05s | inspiration. So moving on to the bio protector. So one thing you will notice on the bio 657.07s - 662.83s | protector with that red section at the top right there is no input from the user and that uh that 662.83s - 668.05s | includes any of the biometric readers and that's because the biometric protector is not actually 668.05s - 673.05s |


chunk_id: 132_chunk_11
chunk_text:
take about 70 days. But if we move over to a software backed pin that's when you 619.47s - 624.47s | start to get in trouble. So there's a hashcat hash that already exists within hashcat that you can 626.21s - 632.41s | generate a windows hello based um hash but because we now know the lengths of the pin as well we 632.43s - 638.01s | can make a targeted mask attack when you're decrypting it and with a de a decent uh or modest 638.01s - 644.27s | rig I should say eight digits can be cracked within seconds uh and up to 11 digits you can still 644.27s - 651.01s | do within uh within days. Uh and thanks to the windows hello to uh hashcat project for that 651.01s - 657.05s | inspiration. So moving on to the bio protector. So one thing you will notice on the bio 657.07s - 662.83s | protector with that red section at the top right there is no input from the user and that uh that 662.83s - 668.05s | includes any of the biometric readers and that's because the biometric protector is not actually 668.05s - 673.05s | protected by my biometrics at all. It's actually protected by the system DPAPI key um which means 675.65s - 680.89s | that once you've got a system level compromise uh you can basically reverse those three 680.93s - 688.03s | intermediate pins and bypass um the biometrics all together. So that the encryption for this is 688.03s - 693.97s | based on the windows vault credentials. Again I won't go into too much detail of um you know the 693.97s - 699.05s | vault the windows vault and how them credentials are protected. Lots of articles already out 699.05s - 705.53s | there um but what basically happens is you decrypt the uh the secret within the windows vault 705.53s - 712.07s | that gives you an AES key that is then used for decrypting the 15 dot dot which gets you the 712.07s - 717.07s | three intermediate pins once again. So onto the recovery protector. So you'll only see this uh 719.21s - 724.21s | under windows hello for business scenarios. Uh and if the tenant is enabled um the recovery 726.75s - 732.79s | capability it allows users to reset their pin without destroying all the enrolled


chunk_id: 132_chunk_12
chunk_text:
protected by my biometrics at all. It's actually protected by the system DPAPI key um which means 675.65s - 680.89s | that once you've got a system level compromise uh you can basically reverse those three 680.93s - 688.03s | intermediate pins and bypass um the biometrics all together. So that the encryption for this is 688.03s - 693.97s | based on the windows vault credentials. Again I won't go into too much detail of um you know the 693.97s - 699.05s | vault the windows vault and how them credentials are protected. Lots of articles already out 699.05s - 705.53s | there um but what basically happens is you decrypt the uh the secret within the windows vault 705.53s - 712.07s | that gives you an AES key that is then used for decrypting the 15 dot dot which gets you the 712.07s - 717.07s | three intermediate pins once again. So onto the recovery protector. So you'll only see this uh 719.21s - 724.21s | under windows hello for business scenarios. Uh and if the tenant is enabled um the recovery 726.75s - 732.79s | capability it allows users to reset their pin without destroying all the enrolled windows hello 732.79s - 738.53s | keys. If you reset the pin without the recovery protector in place basically any enrolled uh key 738.53s - 743.77s | path through windows hello will then be destroyed and you'd have to start start from you know from 743.77s - 749.73s | the start again. So how does the recovery protector work? So the three intermediate pins are 749.73s - 756.75s | first protected with the system DPAPI key and then a a public key is fetched from cred dot 756.75s - 761.75s | microsoft dot com forward slash get encryption key and that encrypted DPAPI blob is then 763.39s - 769.29s | encrypted once again. Um but for some reason Microsoft decided to store the encrypted blob 769.29s - 774.29s | inside the top level container folders nine dot dot dot and not inside the protector folder. So 776.03s - 783.30s | again I don't know why they've done that. So the reverse process of getting at the intermediate 783.32s - 788.50s | pins with the recovery protector. There's a post call that goes to cred dot microsoft dot com 788.50s - 793.50s | forward slash unprotect secret and the access token


chunk_id: 132_chunk_13
chunk_text:
windows hello 732.79s - 738.53s | keys. If you reset the pin without the recovery protector in place basically any enrolled uh key 738.53s - 743.77s | path through windows hello will then be destroyed and you'd have to start start from you know from 743.77s - 749.73s | the start again. So how does the recovery protector work? So the three intermediate pins are 749.73s - 756.75s | first protected with the system DPAPI key and then a a public key is fetched from cred dot 756.75s - 761.75s | microsoft dot com forward slash get encryption key and that encrypted DPAPI blob is then 763.39s - 769.29s | encrypted once again. Um but for some reason Microsoft decided to store the encrypted blob 769.29s - 774.29s | inside the top level container folders nine dot dot dot and not inside the protector folder. So 776.03s - 783.30s | again I don't know why they've done that. So the reverse process of getting at the intermediate 783.32s - 788.50s | pins with the recovery protector. There's a post call that goes to cred dot microsoft dot com 788.50s - 793.50s | forward slash unprotect secret and the access token for that does require both the NGCMF and the MFA 795.74s - 802.04s | claim. So that what that basically means is when you're going through the uh the reset process you 802.04s - 807.48s | have to authenticate to enter but you also have to go through the the process of doing your MFA 807.50s - 813.68s | otherwise you can't decrypt the blob. Um that's got it's own client ID specific for the 813.68s - 818.68s | Microsoft pin. Uh the again fifteen dot dot contains the uh intermediate pins. Four dot dot 821.34s - 827.06s | contains the AES IB that's used to decrypt it. Now there is a nine dot dot inside the 827.06s - 832.30s | protector folder but I don't really know what the what what's in that folder. Again they 832.32s - 840.60s | shifted the uh the contents of the encrypted data in nine dot dot within the container folder. So 840.60s - 846.12s | here's an example of the the decrypting process for this particular protector. You'll see the 846.12s - 851.92s | protected secret there on the left. Um and then that that's the response you get from the 851.92s


chunk_id: 132_chunk_14
chunk_text:
for that does require both the NGCMF and the MFA 795.74s - 802.04s | claim. So that what that basically means is when you're going through the uh the reset process you 802.04s - 807.48s | have to authenticate to enter but you also have to go through the the process of doing your MFA 807.50s - 813.68s | otherwise you can't decrypt the blob. Um that's got it's own client ID specific for the 813.68s - 818.68s | Microsoft pin. Uh the again fifteen dot dot contains the uh intermediate pins. Four dot dot 821.34s - 827.06s | contains the AES IB that's used to decrypt it. Now there is a nine dot dot inside the 827.06s - 832.30s | protector folder but I don't really know what the what what's in that folder. Again they 832.32s - 840.60s | shifted the uh the contents of the encrypted data in nine dot dot within the container folder. So 840.60s - 846.12s | here's an example of the the decrypting process for this particular protector. You'll see the 846.12s - 851.92s | protected secret there on the left. Um and then that that's the response you get from the 851.92s - 856.52s | Microsoft server on the right. And those with the BDI will notice that that base sixty four 856.52s - 863.30s | encoded data looks like the the DPAPI common header that you get. Um and then the system 863.32s - 868.42s | DPAPI key is used to decrypt that secret you get back. Which gives you the three same 868.42s - 874.96s | intermediate pins. So the preboot protector I haven't done a lot of research in this area yet 874.96s - 880.80s | and I believe it's for scenarios where you're going from BitLocker straight to desktop so that 880.80s - 886.18s | you don't need to enter in your pin. And the most likely scenario is the fifteen dot dot is 886.18s - 891.82s | gonna be protected by BitLocker. Um but there's more research needed in that area. And then 891.84s - 896.84s | companion device protector was originally intended for IOT device scenarios. Uh an opaque blob in 899.40s - 904.88s | the documentation um is sent to the IOT but what I believe is that opaque blob is the 904.88s - 910.52s | intermediate pins and that companion device protector is designed


chunk_id: 132_chunk_15
chunk_text:
- 856.52s | Microsoft server on the right. And those with the BDI will notice that that base sixty four 856.52s - 863.30s | encoded data looks like the the DPAPI common header that you get. Um and then the system 863.32s - 868.42s | DPAPI key is used to decrypt that secret you get back. Which gives you the three same 868.42s - 874.96s | intermediate pins. So the preboot protector I haven't done a lot of research in this area yet 874.96s - 880.80s | and I believe it's for scenarios where you're going from BitLocker straight to desktop so that 880.80s - 886.18s | you don't need to enter in your pin. And the most likely scenario is the fifteen dot dot is 886.18s - 891.82s | gonna be protected by BitLocker. Um but there's more research needed in that area. And then 891.84s - 896.84s | companion device protector was originally intended for IOT device scenarios. Uh an opaque blob in 899.40s - 904.88s | the documentation um is sent to the IOT but what I believe is that opaque blob is the 904.88s - 910.52s | intermediate pins and that companion device protector is designed to encrypt it. But no real 910.52s - 915.52s | research needed in this area because it's been deprecated and I've never seen it in real life. 915.56s - 920.56s | So a quick protector recap. So protectors encrypt three intermediate pins. They're all the 922.34s - 928.70s | same pins across all the protectors. Uh now the inputs to the protectors do differ depending on 928.70s - 934.88s | what the protector type is. Bio protectors don't actually need biometrics to decrypt them. And 934.88s - 940.26s | the pin protector is actually extremely vulnerable when there's no TPM present. So what is 940.26s - 946.04s | the purpose of these intermediate pins? Well they are designed to unlock the actual enrolled 946.04s - 951.34s | keys within Windows Hello. So once you have access to these intermediate pins, you can forget 951.34s - 957.12s | all the protectors. You no longer need them. The pins stay constant for the duration of that 957.12s - 963.12s | container. So there's four types of keys that I've come across so far. So the vault key is 963.12s - 968.12s | used um uh uses the decrypt pin. Um the only


chunk_id: 132_chunk_16
chunk_text:
to encrypt it. But no real 910.52s - 915.52s | research needed in this area because it's been deprecated and I've never seen it in real life. 915.56s - 920.56s | So a quick protector recap. So protectors encrypt three intermediate pins. They're all the 922.34s - 928.70s | same pins across all the protectors. Uh now the inputs to the protectors do differ depending on 928.70s - 934.88s | what the protector type is. Bio protectors don't actually need biometrics to decrypt them. And 934.88s - 940.26s | the pin protector is actually extremely vulnerable when there's no TPM present. So what is 940.26s - 946.04s | the purpose of these intermediate pins? Well they are designed to unlock the actual enrolled 946.04s - 951.34s | keys within Windows Hello. So once you have access to these intermediate pins, you can forget 951.34s - 957.12s | all the protectors. You no longer need them. The pins stay constant for the duration of that 957.12s - 963.12s | container. So there's four types of keys that I've come across so far. So the vault key is 963.12s - 968.12s | used um uh uses the decrypt pin. Um the only scenario I've seen that used is uh the consume 970.30s - 975.64s | a scenario where the local account password is encrypted and then it reverses that then and 975.64s - 980.28s | gets the decrypted password once the pin is entered. But it doesn't get used in Hello for 980.28s - 986.08s | Business scenarios. Now the enter pin uh the enter key is enrolled during Windows Hello for 986.08s - 992.58s | Business and that uses the sign pin. And if you're enrolling for passkey enabled websites or 992.58s - 998.92s | Fido based websites um that also uses the sign pin. And then this is what I call the external 998.96s - 1005.26s | pin. And the external pin only seems to be used with third party applications. So an example of 1005.26s - 1011.70s | this is the key that gets enrolled uh for OctaFastPass. To use that particular key uh you 1011.70s - 1019.93s | use the external pin. So once again the keys do leverage uh or proxy the the encryption and 1019.93s - 1024.71s | decryption or the signing operations to a backing key storage provider. And that will either be 1024.71s -


chunk_id: 132_chunk_17
chunk_text:
scenario I've seen that used is uh the consume 970.30s - 975.64s | a scenario where the local account password is encrypted and then it reverses that then and 975.64s - 980.28s | gets the decrypted password once the pin is entered. But it doesn't get used in Hello for 980.28s - 986.08s | Business scenarios. Now the enter pin uh the enter key is enrolled during Windows Hello for 986.08s - 992.58s | Business and that uses the sign pin. And if you're enrolling for passkey enabled websites or 992.58s - 998.92s | Fido based websites um that also uses the sign pin. And then this is what I call the external 998.96s - 1005.26s | pin. And the external pin only seems to be used with third party applications. So an example of 1005.26s - 1011.70s | this is the key that gets enrolled uh for OctaFastPass. To use that particular key uh you 1011.70s - 1019.93s | use the external pin. So once again the keys do leverage uh or proxy the the encryption and 1019.93s - 1024.71s | decryption or the signing operations to a backing key storage provider. And that will either be 1024.71s - 1030.75s | software or TPM. Which means if it is it is in software you can actually extract the Windows 1030.75s - 1036.49s | Hello key and and take them away and and use them off the device. Uh the the keys also have 1036.49s - 1042.69s | metadata files and there are some common metadata files across all the key types. But then 1042.69s - 1047.69s | some of the keys have specific dat files for that particular key. So as I mentioned the vault key 1048.05s - 1054.89s | is used for recovering the plain text password of a local account. But that's only under the 1054.89s - 1060.63s | Windows Hello scenario. Not not Hello for Business. And again Teal from InSecurity has 1060.63s - 1066.37s | covered that in detail. So I do recommend you take a look at that blog. So moving on to the 1066.37s - 1071.37s | passkey enrolled keys. So 7.dat contains CBOR encoded data. Now I've never come across this 1071.69s - 1076.69s | encoding format before so a good shout out to Ace Bond who managed to spot that on Twitter um or 1080.33s - 1085.63s | X whatever you're


chunk_id: 132_chunk_18
chunk_text:
1030.75s | software or TPM. Which means if it is it is in software you can actually extract the Windows 1030.75s - 1036.49s | Hello key and and take them away and and use them off the device. Uh the the keys also have 1036.49s - 1042.69s | metadata files and there are some common metadata files across all the key types. But then 1042.69s - 1047.69s | some of the keys have specific dat files for that particular key. So as I mentioned the vault key 1048.05s - 1054.89s | is used for recovering the plain text password of a local account. But that's only under the 1054.89s - 1060.63s | Windows Hello scenario. Not not Hello for Business. And again Teal from InSecurity has 1060.63s - 1066.37s | covered that in detail. So I do recommend you take a look at that blog. So moving on to the 1066.37s - 1071.37s | passkey enrolled keys. So 7.dat contains CBOR encoded data. Now I've never come across this 1071.69s - 1076.69s | encoding format before so a good shout out to Ace Bond who managed to spot that on Twitter um or 1080.33s - 1085.63s | X whatever you're calling it these days. Um and then once I checked what CBOR is used for of 1085.63s - 1090.51s | course it was WebAuthn. So that that that's what gave me the hint um that it's used for 1090.51s - 1095.51s | passkeys. And then inside um right so so onto the CBOR encoded data that which is inside 7.dat 1095.99s - 1100.99s | that contains the relay party ID the user ID username or display name. But one other important 1105.77s - 1111.43s | aspect to WebAuthn is the credential ID. But they don't actually store that because it that's 1111.43s - 1116.45s | actually a sha256 hash of the public key itself which is you see that green area there uh in the 1117.71s - 1122.71s | middle picture. And then 11.dat for the ones that do know um a little about WebAuthn. During 1122.71s - 1127.71s | the attestation uh during the login process of WebAuthn it has a sign count that gets 1129.55s - 1134.55s | incremented every time. And the relay party backend generally will check that sign count to 1135.39s - 1140.39s | make sure it's incrementing as expected. So what sort of abuses


chunk_id: 132_chunk_19
chunk_text:
calling it these days. Um and then once I checked what CBOR is used for of 1085.63s - 1090.51s | course it was WebAuthn. So that that that's what gave me the hint um that it's used for 1090.51s - 1095.51s | passkeys. And then inside um right so so onto the CBOR encoded data that which is inside 7.dat 1095.99s - 1100.99s | that contains the relay party ID the user ID username or display name. But one other important 1105.77s - 1111.43s | aspect to WebAuthn is the credential ID. But they don't actually store that because it that's 1111.43s - 1116.45s | actually a sha256 hash of the public key itself which is you see that green area there uh in the 1117.71s - 1122.71s | middle picture. And then 11.dat for the ones that do know um a little about WebAuthn. During 1122.71s - 1127.71s | the attestation uh during the login process of WebAuthn it has a sign count that gets 1129.55s - 1134.55s | incremented every time. And the relay party backend generally will check that sign count to 1135.39s - 1140.39s | make sure it's incrementing as expected. So what sort of abuses can we do with passkey? So 1142.57s - 1147.57s | navigatorcredentials.get is the main function within browsers that um allow you to do an 1148.57s - 1153.57s | assertion with WebAuthn. So we you can actually hijack that particular function and then proxy 1156.07s - 1161.07s | the assertion request back to a a compromised host. So that way then you'll be able to use those 1161.35s - 1166.35s | WebAuthn enrolled certificates and log in to um WebAuthn bit websites. And because we can use 1169.45s - 1174.63s | the key directly without the need of Windows hello we can fake the user presence and return 1174.65s - 1179.65s | that assertion back to the relaying party and log in. So on to the enter key. So this is enrolled 1181.73s - 1186.83s | during Windows hello for business enrollment. Um lots of research already in this area 1186.83s - 1191.83s | including including Dirk Jan's great work. Uh but basically um you allow site you use this key 1193.87s - 1198.87s | to sign the uh the PRTs that are used for requesting a credential to uh enter. Um there are 1199.59s - 1204.59s | uh features where


chunk_id: 132_chunk_20
chunk_text:
can we do with passkey? So 1142.57s - 1147.57s | navigatorcredentials.get is the main function within browsers that um allow you to do an 1148.57s - 1153.57s | assertion with WebAuthn. So we you can actually hijack that particular function and then proxy 1156.07s - 1161.07s | the assertion request back to a a compromised host. So that way then you'll be able to use those 1161.35s - 1166.35s | WebAuthn enrolled certificates and log in to um WebAuthn bit websites. And because we can use 1169.45s - 1174.63s | the key directly without the need of Windows hello we can fake the user presence and return 1174.65s - 1179.65s | that assertion back to the relaying party and log in. So on to the enter key. So this is enrolled 1181.73s - 1186.83s | during Windows hello for business enrollment. Um lots of research already in this area 1186.83s - 1191.83s | including including Dirk Jan's great work. Uh but basically um you allow site you use this key 1193.87s - 1198.87s | to sign the uh the PRTs that are used for requesting a credential to uh enter. Um there are 1199.59s - 1204.59s | uh features where you can then get the TGT or the cloud TGT and authenticate to active directory 1207.57s - 1212.57s | locally. And again this particular um key pair uses the sign in pin from the the intermediate 1213.91s - 1218.91s | pins. And the key name which is inside one dot dot is made up of the uh tenant ID on the on the 1220.45s - 1225.45s | user ID. So on to enter key abuse. Um so we can now with this research you can directly use 1229.13s - 1234.13s | the uh Windows hello enrolled keys along with the um the transport key to request a new PRT on a 1236.03s - 1241.03s | compromised device. So you no longer need to try and extract the PRT from Mimikatz. Uh and one 1242.37s - 1247.37s | other aspect that's come from this research um is the return of of Dirk Jan's CV that um he 1249.25s - 1254.25s | reported to Microsoft for the um key derivation function version one where you can take the 1255.23s - 1260.23s | random context and the derived key and then use it away from uh the device uh to sign uh new


chunk_id: 132_chunk_21
chunk_text:
you can then get the TGT or the cloud TGT and authenticate to active directory 1207.57s - 1212.57s | locally. And again this particular um key pair uses the sign in pin from the the intermediate 1213.91s - 1218.91s | pins. And the key name which is inside one dot dot is made up of the uh tenant ID on the on the 1220.45s - 1225.45s | user ID. So on to enter key abuse. Um so we can now with this research you can directly use 1229.13s - 1234.13s | the uh Windows hello enrolled keys along with the um the transport key to request a new PRT on a 1236.03s - 1241.03s | compromised device. So you no longer need to try and extract the PRT from Mimikatz. Uh and one 1242.37s - 1247.37s | other aspect that's come from this research um is the return of of Dirk Jan's CV that um he 1249.25s - 1254.25s | reported to Microsoft for the um key derivation function version one where you can take the 1255.23s - 1260.23s | random context and the derived key and then use it away from uh the device uh to sign uh new new 1262.81s - 1267.81s | PRTs. So we we did report this to Microsoft which obviously they did say they have fixed it with 1269.49s - 1274.49s | the release of um key derivation version two. Um but as as they did come back and said they've 1277.49s - 1282.49s | also uh deprecated it as well and they said it will be deprecated uh during um August of this 1283.07s - 1288.07s | year. And we that we mean that we tested this half an hour ago and it still worked so. 1292.65s - 1296.71s | Okay so a quick introduction to the tool itself that came out of this. The tool is called 1296.71s - 1301.69s | Shamai and the reason it's called Shamai is that's Welsh for hello which is where I come from. 1301.69s - 1307.69s | Um so the features of the software allow you to enumerate all the Windows hello keys that are 1307.69s - 1312.93s | enrolled on the device and that's across all the users. Any keys that are used in the software 1312.93s - 1318.01s | back key storage provider you can dump and extract and then use them away from


chunk_id: 132_chunk_22
chunk_text:
new 1262.81s - 1267.81s | PRTs. So we we did report this to Microsoft which obviously they did say they have fixed it with 1269.49s - 1274.49s | the release of um key derivation version two. Um but as as they did come back and said they've 1277.49s - 1282.49s | also uh deprecated it as well and they said it will be deprecated uh during um August of this 1283.07s - 1288.07s | year. And we that we mean that we tested this half an hour ago and it still worked so. 1292.65s - 1296.71s | Okay so a quick introduction to the tool itself that came out of this. The tool is called 1296.71s - 1301.69s | Shamai and the reason it's called Shamai is that's Welsh for hello which is where I come from. 1301.69s - 1307.69s | Um so the features of the software allow you to enumerate all the Windows hello keys that are 1307.69s - 1312.93s | enrolled on the device and that's across all the users. Any keys that are used in the software 1312.93s - 1318.01s | back key storage provider you can dump and extract and then use them away from the device. It 1318.01s - 1323.01s | also dumps the um you know the hashcat hash that you can then try to crack offline. It has the 1325.31s - 1330.31s | PRT authentication module so that you can you can do the enter based abuse. A web authen 1332.15s - 1337.15s | proxy module which is the the browser functionality. Um and I will get to uh introduce 1337.69s - 1342.69s | you to the integrating Octa Fastpass eventually. Just haven't quite got there yet. So uh a 1343.97s - 1348.97s | quick demonstration. Let's see if it's gonna work. So what you see here is uh on the machine on 1351.43s - 1355.05s | your right. So there's two virtual machines here. So the machine on your right is your 1355.05s - 1360.15s | compromise machine running the Shamai tool. And the machine on the left is the attacker 1360.15s - 1365.15s | machine um that is looking to sort of abuse that Windows hello base key. So we set up 1369.74s - 1374.74s | the key to be listening. Just get the IP address for the compromise machine. So we go back to 1379.09s - 1384.03s | um


chunk_id: 132_chunk_23
chunk_text:
the device. It 1318.01s - 1323.01s | also dumps the um you know the hashcat hash that you can then try to crack offline. It has the 1325.31s - 1330.31s | PRT authentication module so that you can you can do the enter based abuse. A web authen 1332.15s - 1337.15s | proxy module which is the the browser functionality. Um and I will get to uh introduce 1337.69s - 1342.69s | you to the integrating Octa Fastpass eventually. Just haven't quite got there yet. So uh a 1343.97s - 1348.97s | quick demonstration. Let's see if it's gonna work. So what you see here is uh on the machine on 1351.43s - 1355.05s | your right. So there's two virtual machines here. So the machine on your right is your 1355.05s - 1360.15s | compromise machine running the Shamai tool. And the machine on the left is the attacker 1360.15s - 1365.15s | machine um that is looking to sort of abuse that Windows hello base key. So we set up 1369.74s - 1374.74s | the key to be listening. Just get the IP address for the compromise machine. So we go back to 1379.09s - 1384.03s | um the attack machine. It's just gonna create a new incognito window to show new no cache 1384.03s - 1389.03s | credentials. Stick in the um the compromised host address. And then once you hit save that 1391.47s - 1396.61s | will enumerate all the enrolled web authent keys. So you can see Amazon, GitHub, web 1396.61s - 1402.61s | authent.io. So you click on GitHub. That will take us to GitHub. We go to the sign in option. 1402.61s - 1418.30s | We use the sign in with the pass key support. Proxies it across and you're logged in. 1418.30s - 1422.90s | Alright thank you. Um so this tooling is something you can do when you have like full level 1422.90s - 1427.28s | access to uh to a computer. Uh so if you're a system on a device and you can steal these kind 1427.28s - 1431.98s | of things. We use it remotely at Citra. Um and at this point we're also gonna take a step 1431.98s - 1436.72s | back. Uh because Kerry was mostly talking about system level access. Um there's also a lot 1436.74s - 1441.08s | of things that we can do if


chunk_id: 132_chunk_24
chunk_text:
the attack machine. It's just gonna create a new incognito window to show new no cache 1384.03s - 1389.03s | credentials. Stick in the um the compromised host address. And then once you hit save that 1391.47s - 1396.61s | will enumerate all the enrolled web authent keys. So you can see Amazon, GitHub, web 1396.61s - 1402.61s | authent.io. So you click on GitHub. That will take us to GitHub. We go to the sign in option. 1402.61s - 1418.30s | We use the sign in with the pass key support. Proxies it across and you're logged in. 1418.30s - 1422.90s | Alright thank you. Um so this tooling is something you can do when you have like full level 1422.90s - 1427.28s | access to uh to a computer. Uh so if you're a system on a device and you can steal these kind 1427.28s - 1431.98s | of things. We use it remotely at Citra. Um and at this point we're also gonna take a step 1431.98s - 1436.72s | back. Uh because Kerry was mostly talking about system level access. Um there's also a lot 1436.74s - 1441.08s | of things that we can do if we have regular user access. So all of these scenarios that we're 1441.08s - 1446.96s | gonna cover uh are basically relevant uh if you have like a uh uh some mower beacon running 1446.96s - 1451.56s | on the device in the user session if they left their device unlocked at Citra. Um and we're 1451.56s - 1456.56s | mostly gonna cover uh like how this works with uh Entra or the former uh Azure AD. Um and 1458.20s - 1461.80s | I'm gonna assume a few things here. So I'm gonna assume that you're all familiar with 1461.80s - 1465.70s | primary refresh tokens because if I have to explain all of this then uh we're definitely 1465.70s - 1469.80s | gonna run out of time. Uh so we are gonna talk about primary refresh tokens and especially 1469.80s - 1474.60s | how these are used with Windows Hello for Business. Um so primary refresh tokens they are 1474.60s - 1478.74s | just single sign on tokens. So you can sign into anything that's cloud connected with them. 1478.74s - 1483.64s | Um now Windows requests these basically by sending a specific request to the token 1483.64s -


chunk_id: 132_chunk_25
chunk_text:
we have regular user access. So all of these scenarios that we're 1441.08s - 1446.96s | gonna cover uh are basically relevant uh if you have like a uh uh some mower beacon running 1446.96s - 1451.56s | on the device in the user session if they left their device unlocked at Citra. Um and we're 1451.56s - 1456.56s | mostly gonna cover uh like how this works with uh Entra or the former uh Azure AD. Um and 1458.20s - 1461.80s | I'm gonna assume a few things here. So I'm gonna assume that you're all familiar with 1461.80s - 1465.70s | primary refresh tokens because if I have to explain all of this then uh we're definitely 1465.70s - 1469.80s | gonna run out of time. Uh so we are gonna talk about primary refresh tokens and especially 1469.80s - 1474.60s | how these are used with Windows Hello for Business. Um so primary refresh tokens they are 1474.60s - 1478.74s | just single sign on tokens. So you can sign into anything that's cloud connected with them. 1478.74s - 1483.64s | Um now Windows requests these basically by sending a specific request to the token 1483.64s - 1488.38s | endpoint in Entra. Um and then it's sending a JSON web token and the reason that it's sending 1488.38s - 1493.58s | such a JSON web token is that these JSON web tokens are essentially signed with the uh 1493.60s - 1498.94s | certificate of the device. So Entra uh can see that this request comes from a legit device 1498.94s - 1504.04s | that is already known to Entra um and that we uh that we know that's a trusted device in 1504.04s - 1509.92s | our tenants. Um and this will also result in the primary refresh token keys being tied back 1509.92s - 1514.76s | to our device, being tied to the TPM if we have one so it's all basically end to end uh 1514.76s - 1521.66s | secured. Um if we are using um Windows Hello keys then uh we will see a specific payload. 1521.68s - 1525.72s | So if you use like regular username password authentication it's gonna send username 1525.72s - 1529.98s | password to request a PRT. Uh but if we were to use Windows Hello it's actually signing some 1529.98s - 1535.06s | data with these Windows Hello


chunk_id: 132_chunk_26
chunk_text:
1488.38s | endpoint in Entra. Um and then it's sending a JSON web token and the reason that it's sending 1488.38s - 1493.58s | such a JSON web token is that these JSON web tokens are essentially signed with the uh 1493.60s - 1498.94s | certificate of the device. So Entra uh can see that this request comes from a legit device 1498.94s - 1504.04s | that is already known to Entra um and that we uh that we know that's a trusted device in 1504.04s - 1509.92s | our tenants. Um and this will also result in the primary refresh token keys being tied back 1509.92s - 1514.76s | to our device, being tied to the TPM if we have one so it's all basically end to end uh 1514.76s - 1521.66s | secured. Um if we are using um Windows Hello keys then uh we will see a specific payload. 1521.68s - 1525.72s | So if you use like regular username password authentication it's gonna send username 1525.72s - 1529.98s | password to request a PRT. Uh but if we were to use Windows Hello it's actually signing some 1529.98s - 1535.06s | data with these Windows Hello private keys. Um so if we look at this payload we see a 1535.06s - 1540.76s | couple of interesting fields and the most uh interesting here uh for our attack is this 1540.76s - 1545.24s | nonce value. So this is something that you'll see with a lot of Entra operations that there's 1545.24s - 1549.70s | always a nonce involved. Uh and the whole reason for this is that these nonces are 1549.72s - 1554.52s | essentially time bounds. So the presence of this nonce which will expire after five 1554.52s - 1559.92s | minutes means that um after five minutes I cannot just replay this request and get a token 1559.92s - 1563.70s | again because then I would need to get a new nonce. And especially if it's tied to 1563.70s - 1567.70s | hardware that means that we actually need to have hardware uh access to the hardware of 1567.70s - 1572.40s | that device to create the signature and that we cannot just like copy it offline and send 1572.40s - 1578.14s | it from elsewhere. Um we also see the username that we're authenticating to and uh we 1578.18s - 1582.26s | also


chunk_id: 132_chunk_27
chunk_text:
private keys. Um so if we look at this payload we see a 1535.06s - 1540.76s | couple of interesting fields and the most uh interesting here uh for our attack is this 1540.76s - 1545.24s | nonce value. So this is something that you'll see with a lot of Entra operations that there's 1545.24s - 1549.70s | always a nonce involved. Uh and the whole reason for this is that these nonces are 1549.72s - 1554.52s | essentially time bounds. So the presence of this nonce which will expire after five 1554.52s - 1559.92s | minutes means that um after five minutes I cannot just replay this request and get a token 1559.92s - 1563.70s | again because then I would need to get a new nonce. And especially if it's tied to 1563.70s - 1567.70s | hardware that means that we actually need to have hardware uh access to the hardware of 1567.70s - 1572.40s | that device to create the signature and that we cannot just like copy it offline and send 1572.40s - 1578.14s | it from elsewhere. Um we also see the username that we're authenticating to and uh we 1578.18s - 1582.26s | also see the assertion field. And this is actually another JSON web token. So we have a 1582.26s - 1588.02s | JSON web token inside a JSON web token. And this is the assertion. And this assertion is 1588.02s - 1592.30s | actually signed with the private key from Windows Hello for Business uh that we also saw 1592.30s - 1596.24s | earlier on the operating system. Uh so this is a JSON web token that is signed with a 1596.24s - 1601.44s | specific uh with this this private RSA key. There's a specific key uh derivation algorithm 1601.44s - 1606.54s | going on here. Um and in the payload we see a couple of fields. So we see the uh the 1606.54s - 1611.42s | issuer which is the the username. Uh we see the audience. It's our tenant ID. Uh and we 1611.42s - 1617.26s | also see some uh time stamps where it was issued again against replay attacks. Um so there 1617.26s - 1621.10s | were a few things wrong with this which is also why I said that this is the old version 1621.10s - 1627.50s | essentially. Um but the problem is that uh


chunk_id: 132_chunk_28
chunk_text:
see the assertion field. And this is actually another JSON web token. So we have a 1582.26s - 1588.02s | JSON web token inside a JSON web token. And this is the assertion. And this assertion is 1588.02s - 1592.30s | actually signed with the private key from Windows Hello for Business uh that we also saw 1592.30s - 1596.24s | earlier on the operating system. Uh so this is a JSON web token that is signed with a 1596.24s - 1601.44s | specific uh with this this private RSA key. There's a specific key uh derivation algorithm 1601.44s - 1606.54s | going on here. Um and in the payload we see a couple of fields. So we see the uh the 1606.54s - 1611.42s | issuer which is the the username. Uh we see the audience. It's our tenant ID. Uh and we 1611.42s - 1617.26s | also see some uh time stamps where it was issued again against replay attacks. Um so there 1617.26s - 1621.10s | were a few things wrong with this which is also why I said that this is the old version 1621.10s - 1627.50s | essentially. Um but the problem is that uh this assertion is generated with our Windows 1627.50s - 1632.50s | Hello for Business key. And it turns out that if we want to use this Windows Hello key 1632.50s - 1639.18s | from the user session then we can just politely ask the operating system to sign it for us. 1639.18s - 1644.92s | Um because it turns out that uh basically if we call the uh passwords key storage provider 1644.92s - 1650.42s | then we don't need to enter any pins. We don't need to enter uh or prompt the user to approve 1650.42s - 1654.92s | anything because the keys are essentially cached in your session after you already signed 1654.92s - 1660.10s | in with Windows Hello for Business. So if you sign in on a website and you use Windows 1660.10s - 1663.64s | Hello for Business to sign in, you'll see a pin pop up. Um I'm not sure why that's there 1663.64s - 1667.78s | because the key is already in your session. Uh the intermediate pins already cached in your 1667.78s - 1672.94s | session. So if we just ask the operating system nicely to sign this assertion, it will do


chunk_id: 132_chunk_29
chunk_text:
this assertion is generated with our Windows 1627.50s - 1632.50s | Hello for Business key. And it turns out that if we want to use this Windows Hello key 1632.50s - 1639.18s | from the user session then we can just politely ask the operating system to sign it for us. 1639.18s - 1644.92s | Um because it turns out that uh basically if we call the uh passwords key storage provider 1644.92s - 1650.42s | then we don't need to enter any pins. We don't need to enter uh or prompt the user to approve 1650.42s - 1654.92s | anything because the keys are essentially cached in your session after you already signed 1654.92s - 1660.10s | in with Windows Hello for Business. So if you sign in on a website and you use Windows 1660.10s - 1663.64s | Hello for Business to sign in, you'll see a pin pop up. Um I'm not sure why that's there 1663.64s - 1667.78s | because the key is already in your session. Uh the intermediate pins already cached in your 1667.78s - 1672.94s | session. So if we just ask the operating system nicely to sign this assertion, it will do so 1672.94s - 1678.08s | for us uh without requiring any admin rights whatsoever. Um we do have to use the native 1678.08s - 1683.32s | encrypt methods because uh C-Sharp doesn't expose these um or doesn't expose these methods 1683.32s - 1688.80s | by itself. Uh the software RSA provider only accepts software keys, not TPM based keys. Um 1688.80s - 1694.80s | but we can basically generate this assertion ourselves. So I wrote a very um well slightly 1694.80s - 1699.78s | straightforward PowerShell script um and basically if you just run this it will grab the key 1699.78s - 1703.68s | from the key store, it will open the backing private key and the password uh key storage 1703.68s - 1708.68s | provider and simply generate the uh signature. Um and this signature we can then use for 1711.18s - 1717.36s | authentication purposes. Now if you look at this assertion uh there is essentially a small 1717.36s - 1723.50s | issue. And we saw that in the uh the basically the overlaying uh JSON web token there was a 1723.50s - 1729.04s | nonce. But here there's no nonce. There's just a timestamp. And the timestamp


chunk_id: 132_chunk_30
chunk_text:
so 1672.94s - 1678.08s | for us uh without requiring any admin rights whatsoever. Um we do have to use the native 1678.08s - 1683.32s | encrypt methods because uh C-Sharp doesn't expose these um or doesn't expose these methods 1683.32s - 1688.80s | by itself. Uh the software RSA provider only accepts software keys, not TPM based keys. Um 1688.80s - 1694.80s | but we can basically generate this assertion ourselves. So I wrote a very um well slightly 1694.80s - 1699.78s | straightforward PowerShell script um and basically if you just run this it will grab the key 1699.78s - 1703.68s | from the key store, it will open the backing private key and the password uh key storage 1703.68s - 1708.68s | provider and simply generate the uh signature. Um and this signature we can then use for 1711.18s - 1717.36s | authentication purposes. Now if you look at this assertion uh there is essentially a small 1717.36s - 1723.50s | issue. And we saw that in the uh the basically the overlaying uh JSON web token there was a 1723.50s - 1729.04s | nonce. But here there's no nonce. There's just a timestamp. And the timestamp is a input that 1729.04s - 1734.98s | we control as an attacker. So if I can ask Windows to just sign anything, I can also change 1734.98s - 1739.38s | this timestamp to be anything. So normally of course this timestamp will prevent me from 1739.38s - 1744.18s | using this after it has expired. But if I can change it, I can just put it in a timestamp like 1744.18s - 1750.02s | in the future. Um or whatever. I can put it like 5 minutes from now, 10 minutes from now. Um 1750.02s - 1754.72s | but since it's simply also a time range, so it starts with like when it was issued and when it 1754.72s - 1760.40s | expired. Um and it turned out that there's actually no limits on how big this range can be. 1760.40s - 1766.26s | Um so this I'm essentially calling the golden assertion. Uh so if you would have access to a 1766.26s - 1770.88s | user session, then you could just generate this assertion with some simple PowerShell codes. 1770.88s - 1774.48s | Um and the timestamp you could just make it as wide as you want it.


chunk_id: 132_chunk_31
chunk_text:
is a input that 1729.04s - 1734.98s | we control as an attacker. So if I can ask Windows to just sign anything, I can also change 1734.98s - 1739.38s | this timestamp to be anything. So normally of course this timestamp will prevent me from 1739.38s - 1744.18s | using this after it has expired. But if I can change it, I can just put it in a timestamp like 1744.18s - 1750.02s | in the future. Um or whatever. I can put it like 5 minutes from now, 10 minutes from now. Um 1750.02s - 1754.72s | but since it's simply also a time range, so it starts with like when it was issued and when it 1754.72s - 1760.40s | expired. Um and it turned out that there's actually no limits on how big this range can be. 1760.40s - 1766.26s | Um so this I'm essentially calling the golden assertion. Uh so if you would have access to a 1766.26s - 1770.88s | user session, then you could just generate this assertion with some simple PowerShell codes. 1770.88s - 1774.48s | Um and the timestamp you could just make it as wide as you want it. So I could just say this was 1774.48s - 1779.42s | issued like a few years ago. It's valid for the next 15 years. Um and then that assertion could 1779.42s - 1784.06s | be used at any point in time. Cause there was no nonce in there that uh expired. So we could 1784.06s - 1789.20s | use this assertion to also authenticate in the in the future. Um however there's one little 1789.20s - 1794.20s | problem. That is that the uh PRT that we get after this, it is basically tied to the uh private 1794.70s - 1800.60s | key of the device. It will link be linked with the transport key and it will also be only 1800.60s - 1806.14s | accessible by the TPM. So even if we can use this assertion, if we there would be a requirement 1806.14s - 1810.62s | to use it with the same device, it would still be linked to that device uh on which we maybe no 1810.62s - 1816.02s | longer have a session. So sounds like an issue. Um but it turns out that it's actually not an 1816.02s - 1821.56s | issue because you can


chunk_id: 132_chunk_32
chunk_text:
So I could just say this was 1774.48s - 1779.42s | issued like a few years ago. It's valid for the next 15 years. Um and then that assertion could 1779.42s - 1784.06s | be used at any point in time. Cause there was no nonce in there that uh expired. So we could 1784.06s - 1789.20s | use this assertion to also authenticate in the in the future. Um however there's one little 1789.20s - 1794.20s | problem. That is that the uh PRT that we get after this, it is basically tied to the uh private 1794.70s - 1800.60s | key of the device. It will link be linked with the transport key and it will also be only 1800.60s - 1806.14s | accessible by the TPM. So even if we can use this assertion, if we there would be a requirement 1806.14s - 1810.62s | to use it with the same device, it would still be linked to that device uh on which we maybe no 1810.62s - 1816.02s | longer have a session. So sounds like an issue. Um but it turns out that it's actually not an 1816.02s - 1821.56s | issue because you can also use this assertion on a different device. Um and I was really 1821.58s - 1826.36s | surprised with this. I didn't know exactly why that was necessary. Um but it turns out that 1826.36s - 1831.36s | this is needed because you can also use basically Windows Hello keys remotely over RDP. So if 1833.90s - 1838.84s | you have a device with Windows Hello uh you can use remote desktop to authenticate to some 1838.84s - 1844.28s | other device. Um and it's basically gonna use the user certificates uh plus the Windows Hello 1844.28s - 1850.38s | for Business private key to also get you a primary refresh token on that other device. So 1850.38s - 1853.70s | then you don't have to enter any other credentials anymore and you can just use your 1853.70s - 1858.28s | passwordless Windows Hello for Business keys uh to also authenticate on that uh on that 1858.28s - 1863.28s | other device. Um but it's interesting because our device probably has a TPM. But the other 1864.86s - 1870.02s | device doesn't necessarily need to have a TPM. So if we RDP to a device that doesn't have a 1870.02s


chunk_id: 132_chunk_33
chunk_text:
also use this assertion on a different device. Um and I was really 1821.58s - 1826.36s | surprised with this. I didn't know exactly why that was necessary. Um but it turns out that 1826.36s - 1831.36s | this is needed because you can also use basically Windows Hello keys remotely over RDP. So if 1833.90s - 1838.84s | you have a device with Windows Hello uh you can use remote desktop to authenticate to some 1838.84s - 1844.28s | other device. Um and it's basically gonna use the user certificates uh plus the Windows Hello 1844.28s - 1850.38s | for Business private key to also get you a primary refresh token on that other device. So 1850.38s - 1853.70s | then you don't have to enter any other credentials anymore and you can just use your 1853.70s - 1858.28s | passwordless Windows Hello for Business keys uh to also authenticate on that uh on that 1858.28s - 1863.28s | other device. Um but it's interesting because our device probably has a TPM. But the other 1864.86s - 1870.02s | device doesn't necessarily need to have a TPM. So if we RDP to a device that doesn't have a 1870.02s - 1875.36s | TPM, then it will still use our Windows Hello for Business key which is protected by the TPM 1875.38s - 1881.76s | on our laptop. Um but it's the resulting PRT is actually not gonna be hardware protected. So 1881.76s - 1887.32s | that means that if I have this machine on the left hand side where um we see that they're the 1887.32s - 1892.60s | key is protected by the platform uh crypto provider so it's TPM backed. Uh we cannot just 1892.60s - 1898.20s | extract that uh unless we have like some weird downgrades. Um but if you RDP them to the 1898.20s - 1902.58s | system on the right, then you see that there I can just simply run Mimikatz. I can extract 1902.60s - 1907.24s | the PRT and this PRT is backed by the Windows Hello for Business key on our very much 1907.24s - 1913.44s | lockdown device. So even if your device is very well protected, if you RDP to a device 1913.44s - 1918.38s | that's not, so if you like uh RDP to a virtual machine running somewhere in Azure, uh without 1918.38s - 1922.92s |


chunk_id: 132_chunk_34
chunk_text:
- 1875.36s | TPM, then it will still use our Windows Hello for Business key which is protected by the TPM 1875.38s - 1881.76s | on our laptop. Um but it's the resulting PRT is actually not gonna be hardware protected. So 1881.76s - 1887.32s | that means that if I have this machine on the left hand side where um we see that they're the 1887.32s - 1892.60s | key is protected by the platform uh crypto provider so it's TPM backed. Uh we cannot just 1892.60s - 1898.20s | extract that uh unless we have like some weird downgrades. Um but if you RDP them to the 1898.20s - 1902.58s | system on the right, then you see that there I can just simply run Mimikatz. I can extract 1902.60s - 1907.24s | the PRT and this PRT is backed by the Windows Hello for Business key on our very much 1907.24s - 1913.44s | lockdown device. So even if your device is very well protected, if you RDP to a device 1913.44s - 1918.38s | that's not, so if you like uh RDP to a virtual machine running somewhere in Azure, uh without 1918.38s - 1922.92s | a TPM uh that is Android joined or hybrid joined or some other device that doesn't have a 1922.92s - 1928.52s | TPM for some reason, uh you are essentially exposing your uh credentials because this 1928.54s - 1932.74s | primary first token is a single sign on token for your account and it's also Windows Hello 1932.74s - 1938.34s | for Business based so it meets like MFA policies, uh strong MFA policies even um so it's 1938.34s - 1944.78s | quite a risk basically. And there's no way to limit uh you from RDPing to um non-TPM 1944.78s - 1951.12s | devices. Um so this is an issue by itself as well but we can also use this knowledge to 1951.12s - 1956.56s | basically work around the limitations. So if we take our golden assertion um we just 1956.60s - 1961.04s | generate a uh assertion that's going to be valid for the next 10 years and we can use it 1961.04s - 1965.58s | with any other device in the tenant at any point in time. So you can just register like a 1965.58s - 1970.72s | rogue device, maybe you compromise a different device, you


chunk_id: 132_chunk_35
chunk_text:
a TPM uh that is Android joined or hybrid joined or some other device that doesn't have a 1922.92s - 1928.52s | TPM for some reason, uh you are essentially exposing your uh credentials because this 1928.54s - 1932.74s | primary first token is a single sign on token for your account and it's also Windows Hello 1932.74s - 1938.34s | for Business based so it meets like MFA policies, uh strong MFA policies even um so it's 1938.34s - 1944.78s | quite a risk basically. And there's no way to limit uh you from RDPing to um non-TPM 1944.78s - 1951.12s | devices. Um so this is an issue by itself as well but we can also use this knowledge to 1951.12s - 1956.56s | basically work around the limitations. So if we take our golden assertion um we just 1956.60s - 1961.04s | generate a uh assertion that's going to be valid for the next 10 years and we can use it 1961.04s - 1965.58s | with any other device in the tenant at any point in time. So you can just register like a 1965.58s - 1970.72s | rogue device, maybe you compromise a different device, you can just use those keys to sign 1970.72s - 1976.32s | the outer JSON web token and this inner JSON web token is already signed based on the uh 1976.32s - 1980.66s | Windows Hello for Business keys. Um and as you can see here in the expiry, uh it is going 1980.66s - 1985.66s | to be valid till somewhere 2026 um but I could have put anything there basically. Um so 1987.16s - 1993.10s | this was reported to Microsoft because this sounded like a uh vulnerability. So after this 1993.10s - 1997.90s | they uh changed it a little bit. So if you look at the new uh assertion then you'll see that 1997.90s - 2002.94s | there is actually a nonce in there which means that this inner assertion is now also tied to 2002.94s - 2009.08s | the validity of this nonce uh which is gonna be uh 5 minutes. So basically it's now also 2009.08s - 2013.48s | restricted to 5 minutes and after that we cannot use this assertion anymore because the 2013.48s - 2017.38s | nonce will have expired. We would have to get a new nonce which means that we need


chunk_id: 132_chunk_36
chunk_text:
can just use those keys to sign 1970.72s - 1976.32s | the outer JSON web token and this inner JSON web token is already signed based on the uh 1976.32s - 1980.66s | Windows Hello for Business keys. Um and as you can see here in the expiry, uh it is going 1980.66s - 1985.66s | to be valid till somewhere 2026 um but I could have put anything there basically. Um so 1987.16s - 1993.10s | this was reported to Microsoft because this sounded like a uh vulnerability. So after this 1993.10s - 1997.90s | they uh changed it a little bit. So if you look at the new uh assertion then you'll see that 1997.90s - 2002.94s | there is actually a nonce in there which means that this inner assertion is now also tied to 2002.94s - 2009.08s | the validity of this nonce uh which is gonna be uh 5 minutes. So basically it's now also 2009.08s - 2013.48s | restricted to 5 minutes and after that we cannot use this assertion anymore because the 2013.48s - 2017.38s | nonce will have expired. We would have to get a new nonce which means that we need to 2017.38s - 2022.72s | calculate a new signature which means we once again need to have access to the private key. 2022.72s - 2028.46s | So this was fixed um well actually fixed in July last year. Uh so Windows at that point 2028.46s - 2034.20s | included the nonce. Um however the problem with this is that even if Windows is doing this 2034.20s - 2038.80s | new behavior um as long as you don't enforce this then the whole control is basically 2038.80s - 2045.80s | useless. So it was actually quite um interesting as well I would say. Um because in July 2045.80s - 2051.38s | Microsoft put out these CVEs uh one for Entra, one for ADFS because ADFS has many of the 2051.38s - 2057.58s | same mechanisms. Um and they made a very descriptive this uh very extensive description of 2057.58s - 2062.42s | this attack. Basically calling like the golden assertion, you can make an assertion, use it 2062.42s - 2067.06s | on a different device. So they're kind of spoiling my talk a little bit. Um but the 2067.06s - 2072.60s | interesting part was that they only enforced this server


chunk_id: 132_chunk_37
chunk_text:
to 2017.38s - 2022.72s | calculate a new signature which means we once again need to have access to the private key. 2022.72s - 2028.46s | So this was fixed um well actually fixed in July last year. Uh so Windows at that point 2028.46s - 2034.20s | included the nonce. Um however the problem with this is that even if Windows is doing this 2034.20s - 2038.80s | new behavior um as long as you don't enforce this then the whole control is basically 2038.80s - 2045.80s | useless. So it was actually quite um interesting as well I would say. Um because in July 2045.80s - 2051.38s | Microsoft put out these CVEs uh one for Entra, one for ADFS because ADFS has many of the 2051.38s - 2057.58s | same mechanisms. Um and they made a very descriptive this uh very extensive description of 2057.58s - 2062.42s | this attack. Basically calling like the golden assertion, you can make an assertion, use it 2062.42s - 2067.06s | on a different device. So they're kind of spoiling my talk a little bit. Um but the 2067.06s - 2072.60s | interesting part was that they only enforced this server side in like May this year. Because 2072.60s - 2076.46s | if you enforce this before everyone patched then the old protocol's not going to work and 2076.46s - 2081.74s | all the devices are going to break. So they put the description online um like in July and 2081.74s - 2086.40s | they only enforced it uh in May so in all the time in between anyone could have done this 2086.40s - 2091.48s | based on the description uh maybe based on reversing the protocol. Um but since May is now 2091.48s - 2095.92s | fixed and because it's the cloud it's basically fixed everywhere. So you can no longer make 2095.92s - 2102.18s | this golden assertion so as much as I like the name um it's not really relevant anymore. Um 2102.18s - 2107.12s | however there is some remaining things that we can do with this. Because effectively this 2107.12s - 2111.42s | limits our attack to this five minute window because our knowledge is valid for five 2111.42s - 2117.44s | minutes um so we can do it for the next five minutes but not anymore after that. Um but it 2117.44s - 2123.44s


chunk_id: 132_chunk_38
chunk_text:
side in like May this year. Because 2072.60s - 2076.46s | if you enforce this before everyone patched then the old protocol's not going to work and 2076.46s - 2081.74s | all the devices are going to break. So they put the description online um like in July and 2081.74s - 2086.40s | they only enforced it uh in May so in all the time in between anyone could have done this 2086.40s - 2091.48s | based on the description uh maybe based on reversing the protocol. Um but since May is now 2091.48s - 2095.92s | fixed and because it's the cloud it's basically fixed everywhere. So you can no longer make 2095.92s - 2102.18s | this golden assertion so as much as I like the name um it's not really relevant anymore. Um 2102.18s - 2107.12s | however there is some remaining things that we can do with this. Because effectively this 2107.12s - 2111.42s | limits our attack to this five minute window because our knowledge is valid for five 2111.42s - 2117.44s | minutes um so we can do it for the next five minutes but not anymore after that. Um but it 2117.44s - 2123.44s | doesn't always really matter because uh we can still request a new PRT on a different 2123.44s - 2129.80s | device within those five minutes. So then as if that device is not a does not have a TPM 2129.80s - 2136.18s | then uh we can use it get a PRT that's also not tied to a TPM. Um so you can still do this 2136.18s - 2141.84s | you can just not do it until infinity um but you can still do it within the five minutes. 2141.84s - 2146.92s | And as soon as we request this primary first token it's going to be valid for the next 90 2146.92s - 2153.02s | days. We can use it for single sign on to anything that we want. Um and we can even use this 2153.04s - 2157.08s | to provision new Windows Hello for business keys because it's counts as doing 2157.08s - 2161.74s | multi-factor authentication. We can use this to provision new FIDO keys basically making 2161.74s - 2167.42s | our uh takeover of this account complete. Um and this is not mitigated by any of the uh 2167.42s - 2172.36s | current measures


chunk_id: 132_chunk_39
chunk_text:
| doesn't always really matter because uh we can still request a new PRT on a different 2123.44s - 2129.80s | device within those five minutes. So then as if that device is not a does not have a TPM 2129.80s - 2136.18s | then uh we can use it get a PRT that's also not tied to a TPM. Um so you can still do this 2136.18s - 2141.84s | you can just not do it until infinity um but you can still do it within the five minutes. 2141.84s - 2146.92s | And as soon as we request this primary first token it's going to be valid for the next 90 2146.92s - 2153.02s | days. We can use it for single sign on to anything that we want. Um and we can even use this 2153.04s - 2157.08s | to provision new Windows Hello for business keys because it's counts as doing 2157.08s - 2161.74s | multi-factor authentication. We can use this to provision new FIDO keys basically making 2161.74s - 2167.42s | our uh takeover of this account complete. Um and this is not mitigated by any of the uh 2167.42s - 2172.36s | current measures out there. So even if you have like the all the new uh features like 2172.36s - 2177.82s | virtualization based security, LSA, PPL, uh Windows Hello extended session security, 2177.86s - 2182.86s | TPMs, um secure core PCs, secure AI, whatever. Um this is basically still possible. So just to 2186.60s - 2191.48s | see this in action um here I'm again running my PowerShell script. It's generating the 2191.48s - 2196.84s | assertion. Um it is now including a non so it's not going to be valid forever. Um and we 2196.84s - 2202.42s | can keep be basically copy that assertion to my different hosts. Um here I have RoadTX 2202.42s - 2207.76s | as part of RoadTools that I'm running and I'm requesting a new uh primary first token 2207.76s - 2213.10s | based on the hello assertion um with a rogue device that I registered. Um which in this 2213.10s - 2217.38s | case is a fake device. Could also be like a virtual machine or something. Um and you see 2217.38s - 2222.14s | that I get a primary first token. I also get a plain text session key so there's no TPM 2222.14s


chunk_id: 132_chunk_40
chunk_text:
out there. So even if you have like the all the new uh features like 2172.36s - 2177.82s | virtualization based security, LSA, PPL, uh Windows Hello extended session security, 2177.86s - 2182.86s | TPMs, um secure core PCs, secure AI, whatever. Um this is basically still possible. So just to 2186.60s - 2191.48s | see this in action um here I'm again running my PowerShell script. It's generating the 2191.48s - 2196.84s | assertion. Um it is now including a non so it's not going to be valid forever. Um and we 2196.84s - 2202.42s | can keep be basically copy that assertion to my different hosts. Um here I have RoadTX 2202.42s - 2207.76s | as part of RoadTools that I'm running and I'm requesting a new uh primary first token 2207.76s - 2213.10s | based on the hello assertion um with a rogue device that I registered. Um which in this 2213.10s - 2217.38s | case is a fake device. Could also be like a virtual machine or something. Um and you see 2217.38s - 2222.14s | that I get a primary first token. I also get a plain text session key so there's no TPM 2222.14s - 2227.38s | here. There's no um additional hardware protection and I can also use this to uh sign 2227.38s - 2232.18s | into anything um and it's going to be valid for ninety days or until somebody notices this 2232.18s - 2238.22s | and uh revokes it. And if we look at the tokens that we uh receive then we see that these 2238.22s - 2243.82s | tokens have the RSA plus MFA claim which means that uh this is actually a token that was 2243.82s - 2248.16s | backed by a Windows Hello for Business passwordless authentication. Um which means it 2248.16s - 2253.36s | will also comply with uh policies that require like phishing resistant multi-factor 2253.36s - 2258.48s | authentication. Um this also complies with token protection policies. Basically all the um 2258.48s - 2265.02s | advanced stuff that is uh that's currently out there. Um so basically this all hinges on 2265.02s - 2270.72s | that fake device. There are some things that you can do to mitigate this. Um basically your 2270.72s - 2275.46s | strongest control would be device compliance because if we provision a fake device it's not 2275.46s - 2280.64s |


chunk_id: 132_chunk_41
chunk_text:
- 2227.38s | here. There's no um additional hardware protection and I can also use this to uh sign 2227.38s - 2232.18s | into anything um and it's going to be valid for ninety days or until somebody notices this 2232.18s - 2238.22s | and uh revokes it. And if we look at the tokens that we uh receive then we see that these 2238.22s - 2243.82s | tokens have the RSA plus MFA claim which means that uh this is actually a token that was 2243.82s - 2248.16s | backed by a Windows Hello for Business passwordless authentication. Um which means it 2248.16s - 2253.36s | will also comply with uh policies that require like phishing resistant multi-factor 2253.36s - 2258.48s | authentication. Um this also complies with token protection policies. Basically all the um 2258.48s - 2265.02s | advanced stuff that is uh that's currently out there. Um so basically this all hinges on 2265.02s - 2270.72s | that fake device. There are some things that you can do to mitigate this. Um basically your 2270.72s - 2275.46s | strongest control would be device compliance because if we provision a fake device it's not 2275.46s - 2280.64s | going to be an Intune, it's not going to end up being compliant. Um of course there's also 2280.64s - 2284.74s | things around that so if we do have a device that we can get compliant we can do the same 2284.76s - 2290.64s | thing it's just more hurdles that you can throw up um to prevent people from doing this. Um 2290.64s - 2295.48s | you can also monitor for this so uh you can see like if somebody registers a new device and 2295.48s - 2299.38s | then uses that to authenticate with the existing Windows Hello for Business key from a 2299.38s - 2305.12s | different device. Might be a little bit suspicious. Um you can also restrict who can join or 2305.12s - 2309.80s | register new devices so then you can limit the attacker to using existing devices. Doesn't 2309.80s - 2315.50s | fully mitigate it but it does restrict it a little bit. Um and ideally also uh you 2315.50s - 2320.60s | wouldn't have any uh host in your network that you uh allow people to RDP to that don't 2320.60s - 2325.84s | have a TPM because if you do


chunk_id: 132_chunk_42
chunk_text:
going to be an Intune, it's not going to end up being compliant. Um of course there's also 2280.64s - 2284.74s | things around that so if we do have a device that we can get compliant we can do the same 2284.76s - 2290.64s | thing it's just more hurdles that you can throw up um to prevent people from doing this. Um 2290.64s - 2295.48s | you can also monitor for this so uh you can see like if somebody registers a new device and 2295.48s - 2299.38s | then uses that to authenticate with the existing Windows Hello for Business key from a 2299.38s - 2305.12s | different device. Might be a little bit suspicious. Um you can also restrict who can join or 2305.12s - 2309.80s | register new devices so then you can limit the attacker to using existing devices. Doesn't 2309.80s - 2315.50s | fully mitigate it but it does restrict it a little bit. Um and ideally also uh you 2315.50s - 2320.60s | wouldn't have any uh host in your network that you uh allow people to RDP to that don't 2320.60s - 2325.84s | have a TPM because if you do RDP to a system without a TPM uh you are essentially exposing 2325.84s - 2333.62s | these uh credentials. And there's also some endpoints protections. Yes going back to sort 2333.62s - 2338.40s | of the the container scenario uh the endpoint mitigation is that you can use for the abuse 2338.40s - 2343.40s | that we've demonstrated use Windows Hello ESS which is uh Windows Hello's newer 2343.40s - 2348.94s | technology. Um failing that physical keys are always better than sort of the embedded 2348.94s - 2354.14s | enrollment Windows Hello enrollment methods. If you don't have a TPM don't use Windows 2354.14s - 2360.58s | Hello. Um but you can also create um detections based on access to the metadata files 2360.58s - 2366.88s | within the containers. Uh realistically NGC controller services is the only process that 2366.90s - 2372.88s | should be reading or or writing to those files. So if you find that any other process might be 2372.88s - 2377.88s | reading or writing those files you can create alerts around that um access. So what the 2380.52s - 2387.42s | hell is Windows ESS to start with? Um so it was launched


chunk_id: 132_chunk_43
chunk_text:
RDP to a system without a TPM uh you are essentially exposing 2325.84s - 2333.62s | these uh credentials. And there's also some endpoints protections. Yes going back to sort 2333.62s - 2338.40s | of the the container scenario uh the endpoint mitigation is that you can use for the abuse 2338.40s - 2343.40s | that we've demonstrated use Windows Hello ESS which is uh Windows Hello's newer 2343.40s - 2348.94s | technology. Um failing that physical keys are always better than sort of the embedded 2348.94s - 2354.14s | enrollment Windows Hello enrollment methods. If you don't have a TPM don't use Windows 2354.14s - 2360.58s | Hello. Um but you can also create um detections based on access to the metadata files 2360.58s - 2366.88s | within the containers. Uh realistically NGC controller services is the only process that 2366.90s - 2372.88s | should be reading or or writing to those files. So if you find that any other process might be 2372.88s - 2377.88s | reading or writing those files you can create alerts around that um access. So what the 2380.52s - 2387.42s | hell is Windows ESS to start with? Um so it was launched in circa 2020 and it's a feature 2387.42s - 2392.40s | that's needed in the hardware itself. And it's part of Microsoft's secure core capable 2392.42s - 2398.92s | machines. Now I've tested a lot of endpoint devices and I'm still not seeing a great deal of 2398.92s - 2405.26s | these in the wild. Uh and the main thing that you need is that the SDEV and SDCP tables 2405.26s - 2411.84s | within ACPI. And that's to do with secure devices that can be accessed via um either the 2411.84s - 2418.28s | face camera or the or the fingerprint. So I don't know why there's not a huge deal of uh of 2418.30s - 2423.84s | these devices um out there. Uh I do know a lot of the newer surface devices have this 2423.84s - 2428.84s | capability. Um and what and what actually happens when you have ESS enabled is the first 20 2432.28s - 2437.38s | minutes of this talk you can completely throw out the window because they've rewritten all the 2437.38s - 2442.38s | container um structure. So it's all in in in JSON. Um all the containers are in one single


chunk_id: 132_chunk_44
chunk_text:
in circa 2020 and it's a feature 2387.42s - 2392.40s | that's needed in the hardware itself. And it's part of Microsoft's secure core capable 2392.42s - 2398.92s | machines. Now I've tested a lot of endpoint devices and I'm still not seeing a great deal of 2398.92s - 2405.26s | these in the wild. Uh and the main thing that you need is that the SDEV and SDCP tables 2405.26s - 2411.84s | within ACPI. And that's to do with secure devices that can be accessed via um either the 2411.84s - 2418.28s | face camera or the or the fingerprint. So I don't know why there's not a huge deal of uh of 2418.30s - 2423.84s | these devices um out there. Uh I do know a lot of the newer surface devices have this 2423.84s - 2428.84s | capability. Um and what and what actually happens when you have ESS enabled is the first 20 2432.28s - 2437.38s | minutes of this talk you can completely throw out the window because they've rewritten all the 2437.38s - 2442.38s | container um structure. So it's all in in in JSON. Um all the containers are in one single 2442.60s - 2447.60s | JSON file. Same with the protectors as well. And you'll notice new processes that are running. 2451.04s - 2456.04s | So you'll have a bio ISO dot EXE and an NGC ISO dot EXE. They are running inside um trustlets 2459.74s - 2466.02s | within VTL1 which is the same place where LSAS uh the isolated LSAS runs as well. Now I 2466.02s - 2471.02s | haven't gone beyond that so maybe I'll be back next year to DEF CON or don't know. So uh 2473.06s - 2479.60s | so it's uh the next thing on my list is to look at uh Windows Hello ESS. So I just want to 2479.60s - 2483.90s | give a shout out to all these awesome people that was um you know all these blogs that were 2483.90s - 2489.60s | also referenced uh during this research. I know Dirk Yarn uh is not going to appreciate this 2489.60s - 2494.68s | but uh realistically he should be on it uh uh there as well but he didn't want to be on there 2494.68s - 2502.21s | so there you go. So there's the two tools. You've got the


chunk_id: 132_chunk_45
chunk_text:
2442.60s - 2447.60s | JSON file. Same with the protectors as well. And you'll notice new processes that are running. 2451.04s - 2456.04s | So you'll have a bio ISO dot EXE and an NGC ISO dot EXE. They are running inside um trustlets 2459.74s - 2466.02s | within VTL1 which is the same place where LSAS uh the isolated LSAS runs as well. Now I 2466.02s - 2471.02s | haven't gone beyond that so maybe I'll be back next year to DEF CON or don't know. So uh 2473.06s - 2479.60s | so it's uh the next thing on my list is to look at uh Windows Hello ESS. So I just want to 2479.60s - 2483.90s | give a shout out to all these awesome people that was um you know all these blogs that were 2483.90s - 2489.60s | also referenced uh during this research. I know Dirk Yarn uh is not going to appreciate this 2489.60s - 2494.68s | but uh realistically he should be on it uh uh there as well but he didn't want to be on there 2494.68s - 2502.21s | so there you go. So there's the two tools. You've got the Shimaian road tools and the 2502.61s - 2509.45s | Shimaian will be live soon enough and I'll I'll I'll tweet once it's all live. It's still 2509.45s - 2514.45s | private at the moment but Dirk Yarn's road tools is is already available. Thanks for listening.


chunk_id: 132_chunk_46
chunk_text:
Shimaian road tools and the 2502.61s - 2509.45s | Shimaian will be live soon enough and I'll I'll I'll tweet once it's all live. It's still 2509.45s - 2514.45s | private at the moment but Dirk Yarn's road tools is is already available. Thanks for listening.


chunk_id: 133_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=zZurduFDuPk", "title": "DEF CON 32 - AMDSinkclose - Universal Ring2 Privilege Escalation - Enrique Nissim, Krzysztof Okupski", "description": "", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2668, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241028" } 0.00s - 6.30s | This text was transcribed using whisper model: large-v2 Um, well, thanks everyone for joining into this session. This is the AMD SYNCLOS, a 6.30s - 11.38s | universal way into SMM. My name is Enrique Nissim and here with me is Kristof 11.38s - 18.02s | Okupski. We are principal security consultants at IOactive and we work on the 18.02s - 26.02s | embedded system mostly. Um, so yeah, this is our outline for today. It's very uh, a 26.02s - 30.36s | good summary of it. It's gonna be pretty rough. We're gonna need your undivided 30.36s - 35.00s | attention for this so stay with us. Um, yeah, we're just gonna jump into it. This 35.00s - 41.10s | is uh, gonna be a brief on SMM. So SMM stands for System Management Mode. It's 41.10s - 47.08s | one of the most powerful execution modes in x86. It grants you full access to IO 47.08s - 51.48s | devices and memory. And it's very good for attackers cause it definitely will 51.48s - 55.08s | grant you some potential, some persistence uh, capabilities. Either as a 55.08s - 59.38s | boot kit or in some cases as a firmware implant as we'll see later. What's good 59.38s - 65.98s | also is that code here is hidden from the OS and the hypervisor. So antivirus, 65.98s - 71.70s | EDRs or anti-cheat engines won't, won't, won't see these things, right? Now in terms 71.70s - 75.16s | of privilege level, this is just a simplification but we can think it about like 75.16s - 79.10s | this. We have our applications, like for instance our browser, running at the very 79.10s - 84.64s | top of ring three. Then we have our OS, ring zero. And if we have a hypervisor, it's 84.64s - 90.28s | down the OS of course. And only then we have SMM. Now, how does this work? We can 90.28s - 95.38s | divide the uh, the thing in, in, in two, two phases. We have boot time where the 95.38s - 102.02s | firmware BIOS UFI code will, after initializing the, the hardware, will load


chunk_id: 133_chunk_1
chunk_text:
And it's very good for attackers cause it definitely will 51.48s - 55.08s | grant you some potential, some persistence uh, capabilities. Either as a 55.08s - 59.38s | boot kit or in some cases as a firmware implant as we'll see later. What's good 59.38s - 65.98s | also is that code here is hidden from the OS and the hypervisor. So antivirus, 65.98s - 71.70s | EDRs or anti-cheat engines won't, won't, won't see these things, right? Now in terms 71.70s - 75.16s | of privilege level, this is just a simplification but we can think it about like 75.16s - 79.10s | this. We have our applications, like for instance our browser, running at the very 79.10s - 84.64s | top of ring three. Then we have our OS, ring zero. And if we have a hypervisor, it's 84.64s - 90.28s | down the OS of course. And only then we have SMM. Now, how does this work? We can 90.28s - 95.38s | divide the uh, the thing in, in, in two, two phases. We have boot time where the 95.38s - 102.02s | firmware BIOS UFI code will, after initializing the, the hardware, will load the SMM 102.02s - 108.16s | code into an special area of memory called SM RAM. And then it will hand off the 108.16s - 113.60s | execution to the OS loader, then the OS loads. And as you can see, SMM is just a 113.60s - 118.04s | run time concept. It will provide services for the, for the platform. For instance, power 118.04s - 123.74s | management, security, and the OS can invoke some services from it as well. So how does 123.74s - 128.38s | that happen? Well there's this con, concept of system management interrupt. When an SMI 128.38s - 135.08s | occurs, the processor gets interrupted and then this, the, the current register set of the 135.08s - 140.10s | processor is saved into the SM RAM into a safety area. And then whatever needs to happen 140.84s - 145.84s | happens. Some um, good feature for the system. And it then comes back to the OS. In this 148.84s - 155.08s | case, we are doing a synchronous SMI like a software SMI. The OS is um, invoking a 155.08s - 160.08s | service from SMM. Now, we've been working on this area for


chunk_id: 133_chunk_2
chunk_text:
the SMM 102.02s - 108.16s | code into an special area of memory called SM RAM. And then it will hand off the 108.16s - 113.60s | execution to the OS loader, then the OS loads. And as you can see, SMM is just a 113.60s - 118.04s | run time concept. It will provide services for the, for the platform. For instance, power 118.04s - 123.74s | management, security, and the OS can invoke some services from it as well. So how does 123.74s - 128.38s | that happen? Well there's this con, concept of system management interrupt. When an SMI 128.38s - 135.08s | occurs, the processor gets interrupted and then this, the, the current register set of the 135.08s - 140.10s | processor is saved into the SM RAM into a safety area. And then whatever needs to happen 140.84s - 145.84s | happens. Some um, good feature for the system. And it then comes back to the OS. In this 148.84s - 155.08s | case, we are doing a synchronous SMI like a software SMI. The OS is um, invoking a 155.08s - 160.08s | service from SMM. Now, we've been working on this area for a bit. Um, we published some, 163.48s - 167.82s | some blogs. We've done some, some presentations before. How are you on Hexagon? We have a 167.82s - 174.02s | couple of CVEs in 2023 and we also released some tools for um, checking for 174.02s - 179.92s | misconfigurations and known issues. Um, all of these things that we've done before are 179.92s - 184.46s | mostly related to either misconfigurations from vendors or software vulnerabilities in 184.46s - 190.58s | components. Now, we're gonna present today is an architectural flaw in the AMD processor 190.58s - 196.08s | itself. So that's very different. And so for that we're gonna just see again what is, what 196.10s - 201.64s | makes the security of SMM. So we can think on the CPU when it's an SMM mode. We have the 201.64s - 206.32s | memory controller in the middle and we can just access this area with, where the SMM code 206.32s - 211.18s | and data lives. We can execute instructions from this area. We can write to this area and 211.18s - 215.60s | read. However, when the CPU is in normal mode, meaning non-SMM, the memory


chunk_id: 133_chunk_3
chunk_text:
a bit. Um, we published some, 163.48s - 167.82s | some blogs. We've done some, some presentations before. How are you on Hexagon? We have a 167.82s - 174.02s | couple of CVEs in 2023 and we also released some tools for um, checking for 174.02s - 179.92s | misconfigurations and known issues. Um, all of these things that we've done before are 179.92s - 184.46s | mostly related to either misconfigurations from vendors or software vulnerabilities in 184.46s - 190.58s | components. Now, we're gonna present today is an architectural flaw in the AMD processor 190.58s - 196.08s | itself. So that's very different. And so for that we're gonna just see again what is, what 196.10s - 201.64s | makes the security of SMM. So we can think on the CPU when it's an SMM mode. We have the 201.64s - 206.32s | memory controller in the middle and we can just access this area with, where the SMM code 206.32s - 211.18s | and data lives. We can execute instructions from this area. We can write to this area and 211.18s - 215.60s | read. However, when the CPU is in normal mode, meaning non-SMM, the memory controller just 215.60s - 222.24s | rejects um, if, if, if you read from this uh, from this memory, you're just gonna return, 222.62s - 227.16s | receive Fs. Writes are discarded and of course execution is disallowed. How does this 227.16s - 234.04s | hap- how is this happening? Well we have um, what's called a TSIG region or top of memory 234.04s - 239.04s | segment region. Essentially the firmware after loads, after it loads SMM at boot time, it 241.74s - 246.74s | will hopefully configure these two registers and the idea is to overlap um, have this region 247.22s - 254.22s | to overlap with all the contents of SMRAM to protect it. We have uh, two registers, we have 254.22s - 259.00s | the TSIG base and the TSIG mask which is the length. The TSIG ma- the TSIG mask as you can 259.00s - 264.74s | see have also uh, additional fields and yeah, essentially this is the way. The memory 264.74s - 269.74s | controller will see that uh, the CPU is executing in normal mode and will just reject to read 270.08s - 275.08s | the content or write the content of


chunk_id: 133_chunk_4
chunk_text:
controller just 215.60s - 222.24s | rejects um, if, if, if you read from this uh, from this memory, you're just gonna return, 222.62s - 227.16s | receive Fs. Writes are discarded and of course execution is disallowed. How does this 227.16s - 234.04s | hap- how is this happening? Well we have um, what's called a TSIG region or top of memory 234.04s - 239.04s | segment region. Essentially the firmware after loads, after it loads SMM at boot time, it 241.74s - 246.74s | will hopefully configure these two registers and the idea is to overlap um, have this region 247.22s - 254.22s | to overlap with all the contents of SMRAM to protect it. We have uh, two registers, we have 254.22s - 259.00s | the TSIG base and the TSIG mask which is the length. The TSIG ma- the TSIG mask as you can 259.00s - 264.74s | see have also uh, additional fields and yeah, essentially this is the way. The memory 264.74s - 269.74s | controller will see that uh, the CPU is executing in normal mode and will just reject to read 270.08s - 275.08s | the content or write the content of the SMRAM. Has to be enabled, that's why the T-valid is 278.08s - 283.08s | there. Now the layout of SMRAM uh, basically it's up to the vendor to define, but most 287.10s - 293.10s | systems out there are gonna follow what the EDK2 has, which is TianoCore, this is reference 293.10s - 299.34s | code. And uh, essentially it's gonna consist at the very bottom you can see here um, SMM 299.34s - 304.88s | core area, this is just supporting code for the rest of um, of what's gonna be in there. And 304.88s - 309.88s | then for each core we're gonna have an SMM base and at a specific offset 8000 from the SMM 312.06s - 317.30s | base we're gonna have the entry point, which is where the processor, the core is gonna start 317.30s - 322.90s | executing from when the SMI happens. And then we have a safe state at offset FE00. This is 322.90s - 328.54s | TianoCore, right? It can be laid out differently by the vendor. And then we have the SMI 328.54s - 333.78s | handlers at the very top which is, are gonna be the functions that


chunk_id: 133_chunk_5
chunk_text:
the SMRAM. Has to be enabled, that's why the T-valid is 278.08s - 283.08s | there. Now the layout of SMRAM uh, basically it's up to the vendor to define, but most 287.10s - 293.10s | systems out there are gonna follow what the EDK2 has, which is TianoCore, this is reference 293.10s - 299.34s | code. And uh, essentially it's gonna consist at the very bottom you can see here um, SMM 299.34s - 304.88s | core area, this is just supporting code for the rest of um, of what's gonna be in there. And 304.88s - 309.88s | then for each core we're gonna have an SMM base and at a specific offset 8000 from the SMM 312.06s - 317.30s | base we're gonna have the entry point, which is where the processor, the core is gonna start 317.30s - 322.90s | executing from when the SMI happens. And then we have a safe state at offset FE00. This is 322.90s - 328.54s | TianoCore, right? It can be laid out differently by the vendor. And then we have the SMI 328.54s - 333.78s | handlers at the very top which is, are gonna be the functions that are, are gonna be useful 333.78s - 339.68s | for, for us, for the system. Handling power, security, or whatever. Um, so yeah, just 339.68s - 343.96s | assume of the SMRAM registers, we have the three just, we just mentioned, and we also have 343.96s - 350.26s | an SMM block. That's very important. Hopefully the firmware code is gonna set this bit so 350.26s - 355.20s | that the, whatever runs at run time, the OS cannot tamper with these registers. We don't 355.20s - 360.70s | want, for example, at run time, having the OS disabling the TSEC location because this will 360.70s - 366.78s | just, um, update or change the code at the SMRAM location and execute with these 366.78s - 373.02s | additional privileges, right? Now this needs to be configured for each core. With that we 373.02s - 378.02s | can see a first difference between how Intel and AMD manage the access to MSRs. On Intel 378.68s - 383.68s | systems, these MSRs that are related to SMM are only accessible while the CPU is in SMM. In 388.60s - 395.36s | fact obtaining the SMM base, for example, on Intel, could


chunk_id: 133_chunk_6
chunk_text:
are, are gonna be useful 333.78s - 339.68s | for, for us, for the system. Handling power, security, or whatever. Um, so yeah, just 339.68s - 343.96s | assume of the SMRAM registers, we have the three just, we just mentioned, and we also have 343.96s - 350.26s | an SMM block. That's very important. Hopefully the firmware code is gonna set this bit so 350.26s - 355.20s | that the, whatever runs at run time, the OS cannot tamper with these registers. We don't 355.20s - 360.70s | want, for example, at run time, having the OS disabling the TSEC location because this will 360.70s - 366.78s | just, um, update or change the code at the SMRAM location and execute with these 366.78s - 373.02s | additional privileges, right? Now this needs to be configured for each core. With that we 373.02s - 378.02s | can see a first difference between how Intel and AMD manage the access to MSRs. On Intel 378.68s - 383.68s | systems, these MSRs that are related to SMM are only accessible while the CPU is in SMM. In 388.60s - 395.36s | fact obtaining the SMM base, for example, on Intel, could be considered a leak. On AMD, all 395.36s - 401.80s | these MSRs are accessible from ring zero, no problem. Again, if we have the SMM block bit 401.80s - 406.98s | set, then the configuration cannot be changed. Not even SMM can change the configuration 406.98s - 410.40s | until the next power cycle in which, I mean, the firmware will take over again and 410.40s - 417.52s | configure this in the same way. But we can now spot the bug in the documentation. This is 417.52s - 422.52s | the same TSEC mask register and the fields, just a picture from the documentation. We can 424.96s - 430.90s | see how the SMM block is covering all of the fields except for two over there. These two 430.90s - 436.16s | fields are gonna be what we're gonna be talking about, um, in this session. And we have 436.18s - 442.88s | T-CLOSE and A-CLOSE. Um, we're just gonna focus on T-CLOSE. A-CLOSE stands for um, the same 442.88s - 447.26s | feature but for uh, a previous region called ASEC which overlaps on the video memory. It's 447.26s - 452.36s | not used anymore so it


chunk_id: 133_chunk_7
chunk_text:
be considered a leak. On AMD, all 395.36s - 401.80s | these MSRs are accessible from ring zero, no problem. Again, if we have the SMM block bit 401.80s - 406.98s | set, then the configuration cannot be changed. Not even SMM can change the configuration 406.98s - 410.40s | until the next power cycle in which, I mean, the firmware will take over again and 410.40s - 417.52s | configure this in the same way. But we can now spot the bug in the documentation. This is 417.52s - 422.52s | the same TSEC mask register and the fields, just a picture from the documentation. We can 424.96s - 430.90s | see how the SMM block is covering all of the fields except for two over there. These two 430.90s - 436.16s | fields are gonna be what we're gonna be talking about, um, in this session. And we have 436.18s - 442.88s | T-CLOSE and A-CLOSE. Um, we're just gonna focus on T-CLOSE. A-CLOSE stands for um, the same 442.88s - 447.26s | feature but for uh, a previous region called ASEC which overlaps on the video memory. It's 447.26s - 452.36s | not used anymore so it doesn't matter. But what happens is when this bit is set, the data 452.36s - 458.36s | accesses that the core, that the core performs when it's running in SMM are gonna be 458.36s - 465.24s | directed to MMIO instead of to SMRAM. And that's, that's, that's cool because as we said 465.26s - 472.32s | before, we can set this bit from ring zero because it's not blocked by the SMM block, right? 472.32s - 476.80s | It actually, in the, in the A-CLOSE description it also says hey, I mean, don't forget to 476.80s - 482.24s | unset this when you are returning from SMM because otherwise your safety are gonna be 482.24s - 487.24s | erroneously read from MMIO. That's bad. Um, the documentation says as well hey, if you have a 488.24s - 495.28s | valid T-CLOSE region and you're in SMM and the T-CLOSE is set, then instruction fetches are 495.28s - 500.76s | still gonna be directed to DRAM but data accesses are gonna go to MMIO instead. If you are 500.76s - 506.76s | not in SMM then both accesses, both type of accesses are gonna go to MMIO. So we can


chunk_id: 133_chunk_8
chunk_text:
doesn't matter. But what happens is when this bit is set, the data 452.36s - 458.36s | accesses that the core, that the core performs when it's running in SMM are gonna be 458.36s - 465.24s | directed to MMIO instead of to SMRAM. And that's, that's, that's cool because as we said 465.26s - 472.32s | before, we can set this bit from ring zero because it's not blocked by the SMM block, right? 472.32s - 476.80s | It actually, in the, in the A-CLOSE description it also says hey, I mean, don't forget to 476.80s - 482.24s | unset this when you are returning from SMM because otherwise your safety are gonna be 482.24s - 487.24s | erroneously read from MMIO. That's bad. Um, the documentation says as well hey, if you have a 488.24s - 495.28s | valid T-CLOSE region and you're in SMM and the T-CLOSE is set, then instruction fetches are 495.28s - 500.76s | still gonna be directed to DRAM but data accesses are gonna go to MMIO instead. If you are 500.76s - 506.76s | not in SMM then both accesses, both type of accesses are gonna go to MMIO. So we can 506.76s - 513.40s | say um, X86 behaves in a hardware, like a hardware architecture. Goes to hardware, right? If 513.40s - 518.14s | we have um, our core, core zero for example running in normal mode, both data and 518.14s - 523.54s | instruction fetches just go to MMIO. If we have our core zero now in SMM with the T-CLOSE 523.54s - 529.38s | off, this is what happens. No problem. We read and execute from SMRAM. However when set 529.38s - 534.38s | T-CLOSE on, now data fetches go like this. This is a problem because this portion can be 535.08s - 540.08s | controlled by an attacker. So triggering the condition is super easy. We just need to um, set 544.26s - 549.22s | this, this bit, this T-CLOSE bit and call into an SMI and the system will immediately freeze 549.22s - 554.24s | and um, you're gonna spot the problem right there. This feature exists because um, well AMD 557.94s - 564.24s | wanted to have the ability to reuse the physical address space and have SMM code um, access an 564.26s - 570.68s | MMIO device that were using the same SMRAM uh,


chunk_id: 133_chunk_9
chunk_text:
506.76s - 513.40s | say um, X86 behaves in a hardware, like a hardware architecture. Goes to hardware, right? If 513.40s - 518.14s | we have um, our core, core zero for example running in normal mode, both data and 518.14s - 523.54s | instruction fetches just go to MMIO. If we have our core zero now in SMM with the T-CLOSE 523.54s - 529.38s | off, this is what happens. No problem. We read and execute from SMRAM. However when set 529.38s - 534.38s | T-CLOSE on, now data fetches go like this. This is a problem because this portion can be 535.08s - 540.08s | controlled by an attacker. So triggering the condition is super easy. We just need to um, set 544.26s - 549.22s | this, this bit, this T-CLOSE bit and call into an SMI and the system will immediately freeze 549.22s - 554.24s | and um, you're gonna spot the problem right there. This feature exists because um, well AMD 557.94s - 564.24s | wanted to have the ability to reuse the physical address space and have SMM code um, access an 564.26s - 570.68s | MMIO device that were using the same SMRAM uh, physical memory essentially. Um, we haven't 570.68s - 577.68s | seen any vendor using this feature. Um, but yeah, that's why. And it was on, on what we could 577.68s - 582.46s | track is in 2006 there was this document that first mentioned the feature. So it means it's 582.46s - 587.46s | been around at least for 18 years. Now, for people familiarized with um, biosecurity they're 588.46s - 593.46s | probably gonna remember this vulnerability presented by Christopher Domas in 2015 called the 597.36s - 603.20s | memory sinkhole attack. And what happened was that he was able to remap the APIC which is a 603.20s - 609.34s | specific device um, in the um, available and overlap it with the TSIG area and it caused the 609.34s - 614.28s | same effect. Uh, data fetches will go to MMIO instead of SMRAM. Now the difference here of 614.28s - 620.88s | course is that that was only limited to the APIC and it only affected the 4K region where the 620.88s - 625.88s | APIC was overlapped with. The sinkholes behavior changed uh, how the entire TSIG works. Um, 628.42s - 634.06s | any device in


chunk_id: 133_chunk_10
chunk_text:
physical memory essentially. Um, we haven't 570.68s - 577.68s | seen any vendor using this feature. Um, but yeah, that's why. And it was on, on what we could 577.68s - 582.46s | track is in 2006 there was this document that first mentioned the feature. So it means it's 582.46s - 587.46s | been around at least for 18 years. Now, for people familiarized with um, biosecurity they're 588.46s - 593.46s | probably gonna remember this vulnerability presented by Christopher Domas in 2015 called the 597.36s - 603.20s | memory sinkhole attack. And what happened was that he was able to remap the APIC which is a 603.20s - 609.34s | specific device um, in the um, available and overlap it with the TSIG area and it caused the 609.34s - 614.28s | same effect. Uh, data fetches will go to MMIO instead of SMRAM. Now the difference here of 614.28s - 620.88s | course is that that was only limited to the APIC and it only affected the 4K region where the 620.88s - 625.88s | APIC was overlapped with. The sinkholes behavior changed uh, how the entire TSIG works. Um, 628.42s - 634.06s | any device in theory could be overlapped right? Because we just direct any access to the 634.06s - 639.06s | MMIO space. So we can bring some, some attack ideas in. Our easy thing will be, the easiest 639.06s - 644.06s | thing will be to just grab any PCI device and hopefully we'll have a good register layout on 649.06s - 653.80s | its bar so that we can take control of the execution at the very beginning of the entry point. 653.80s - 657.60s | As there are multiple integrated devices that we could use, we could just try remapping one 657.60s - 663.54s | of those and based on what we read, the register should become visible at the TSIG location 663.56s - 668.56s | from the OS. However this failed. We can see here how uh, we have an ethernet controller uh, 672.24s - 677.24s | with its original uh, bar 2 uh, D0714000. We have some registers right here, they're 679.64s - 683.78s | visible registers and we're gonna try to overlap, when we try to overlap it with the SMM 683.78s - 688.78s | entry uh, BFEB0000, we can see that we're still reading Fs. So the


chunk_id: 133_chunk_11
chunk_text:
theory could be overlapped right? Because we just direct any access to the 634.06s - 639.06s | MMIO space. So we can bring some, some attack ideas in. Our easy thing will be, the easiest 639.06s - 644.06s | thing will be to just grab any PCI device and hopefully we'll have a good register layout on 649.06s - 653.80s | its bar so that we can take control of the execution at the very beginning of the entry point. 653.80s - 657.60s | As there are multiple integrated devices that we could use, we could just try remapping one 657.60s - 663.54s | of those and based on what we read, the register should become visible at the TSIG location 663.56s - 668.56s | from the OS. However this failed. We can see here how uh, we have an ethernet controller uh, 672.24s - 677.24s | with its original uh, bar 2 uh, D0714000. We have some registers right here, they're 679.64s - 683.78s | visible registers and we're gonna try to overlap, when we try to overlap it with the SMM 683.78s - 688.78s | entry uh, BFEB0000, we can see that we're still reading Fs. So the remapping failed. 689.06s - 694.06s | Registers are not available. Um, we can see that the registers were moved from their 697.24s - 702.24s | original location. They're, they're, something happened. When we restore, we can see the 704.58s - 710.38s | registers again. So it's not that we broke anything, so it's just the the priority of the 710.38s - 715.42s | memory probably failed right? So what that that led us to try to understand ok how that 716.14s - 723.14s | how how is that working? Have this register called top of memory or TOM. Um, this thing 723.14s - 729.98s | defines a limit between the usable DRAM before 4 gigabytes on the physical address space and 729.98s - 736.98s | MMIO space on top. Now on Intel, this register has a lock bit. Once it's configured you 736.98s - 741.62s | cannot tamper with it anymore at runtime. But on AMD it doesn't have such a lock so we 741.62s - 747.10s | can just you know, modify this and maybe that's good for us. The idea is simple, we have 747.10s - 752.54s | this is uh, imagine this is layout right? And we'll


chunk_id: 133_chunk_12
chunk_text:
remapping failed. 689.06s - 694.06s | Registers are not available. Um, we can see that the registers were moved from their 697.24s - 702.24s | original location. They're, they're, something happened. When we restore, we can see the 704.58s - 710.38s | registers again. So it's not that we broke anything, so it's just the the priority of the 710.38s - 715.42s | memory probably failed right? So what that that led us to try to understand ok how that 716.14s - 723.14s | how how is that working? Have this register called top of memory or TOM. Um, this thing 723.14s - 729.98s | defines a limit between the usable DRAM before 4 gigabytes on the physical address space and 729.98s - 736.98s | MMIO space on top. Now on Intel, this register has a lock bit. Once it's configured you 736.98s - 741.62s | cannot tamper with it anymore at runtime. But on AMD it doesn't have such a lock so we 741.62s - 747.10s | can just you know, modify this and maybe that's good for us. The idea is simple, we have 747.10s - 752.54s | this is uh, imagine this is layout right? And we'll move the MMIO space of the TOM that 752.54s - 758.04s | defines the MMIO space to match with the TSEC base. So we have something like that. Maybe 758.04s - 763.04s | then trying the same trick that we uh did before could work. Unfortunately we could move 765.22s - 769.86s | the TSEC no problem but it didn't change the behavior that we saw before. In practice it 769.86s - 774.86s | didn't work. So that led us to dig dig dig uh deeper into into the computation and we found 777.70s - 782.50s | there are some actual priorities when the core access um some portion of the physical address 782.50s - 786.74s | space. Essentially determines what where it's going. And we can see that the TSEC and ASIC 786.74s - 792.48s | mechanisms are listed 4. Which means 1, 2 and 3 whatever is listed there has less less 792.48s - 797.72s | priority than this. And at the at the number 1 we can see the TOM is is is listed there. So 797.72s - 803.62s | we have that's why it never worked right? It would have never worked. What's at 5 where


chunk_id: 133_chunk_13
chunk_text:
move the MMIO space of the TOM that 752.54s - 758.04s | defines the MMIO space to match with the TSEC base. So we have something like that. Maybe 758.04s - 763.04s | then trying the same trick that we uh did before could work. Unfortunately we could move 765.22s - 769.86s | the TSEC no problem but it didn't change the behavior that we saw before. In practice it 769.86s - 774.86s | didn't work. So that led us to dig dig dig uh deeper into into the computation and we found 777.70s - 782.50s | there are some actual priorities when the core access um some portion of the physical address 782.50s - 786.74s | space. Essentially determines what where it's going. And we can see that the TSEC and ASIC 786.74s - 792.48s | mechanisms are listed 4. Which means 1, 2 and 3 whatever is listed there has less less 792.48s - 797.72s | priority than this. And at the at the number 1 we can see the TOM is is is listed there. So 797.72s - 803.62s | we have that's why it never worked right? It would have never worked. What's at 5 where we 803.62s - 808.62s | have the MMIO configuration space and the APIC? Uh that makes sense. We the APIC was used 812.66s - 819.44s | before in the Intel attack. The MMIO config space we cannot use really. Um and then at 6 we 819.44s - 824.58s | have this NOR bridge address space uh routing but uh that probably stands for older 824.60s - 829.60s | architectures. This is not seen in modern modern stuff. So we cannot use it. For the APIC we 832.38s - 837.22s | cannot really use it and we're gonna explain why. But for that we need to give an analysis 837.22s - 842.22s | of of um how the SMM entry point code works. When the SMM when the SMI occurs the SMM core 845.82s - 851.26s | uh the the core um executing at SMM starts executing in real mode. In 16 bit mode flat. No 851.28s - 857.06s | protection whatsoever. What it has to do is quickly go to protected mode 32 bit and then goes 857.06s - 861.42s | to long mode and then passes the execution to the handlers. This is a very simplified view. 861.42s -


chunk_id: 133_chunk_14
chunk_text:
we 803.62s - 808.62s | have the MMIO configuration space and the APIC? Uh that makes sense. We the APIC was used 812.66s - 819.44s | before in the Intel attack. The MMIO config space we cannot use really. Um and then at 6 we 819.44s - 824.58s | have this NOR bridge address space uh routing but uh that probably stands for older 824.60s - 829.60s | architectures. This is not seen in modern modern stuff. So we cannot use it. For the APIC we 832.38s - 837.22s | cannot really use it and we're gonna explain why. But for that we need to give an analysis 837.22s - 842.22s | of of um how the SMM entry point code works. When the SMM when the SMI occurs the SMM core 845.82s - 851.26s | uh the the core um executing at SMM starts executing in real mode. In 16 bit mode flat. No 851.28s - 857.06s | protection whatsoever. What it has to do is quickly go to protected mode 32 bit and then goes 857.06s - 861.42s | to long mode and then passes the execution to the handlers. This is a very simplified view. 861.42s - 866.50s | Now that first step going to from real mode to protected mode is is key right? That's the 866.50s - 873.24s | first thing that needs to happen. For this um on x86 we need essentially an are enabled 873.24s - 878.24s | segmentation. Uh segmentation provides um the ability for the for the core to see the 878.40s - 885.00s | memory in a segmented way. That's that's how it's called. Essentially we can have different 885.00s - 890.08s | segments for memory and assigns uh different permissions or like um the ability to execute 890.08s - 894.78s | code or or just read data and stuff like that. We have this key data structure called global 894.78s - 901.62s | descriptor table of G or GDT. And we have a register on the processor that is called GDTR 901.62s - 907.52s | that's gonna point to the base of our GDT structure and it's gonna have a limit in bytes. And 907.54s - 910.98s | so the GDT is just really an array of descriptors. And we're gonna have different type of 910.98s - 914.74s | descriptors. We have we have code descriptors, data descriptors. Each


chunk_id: 133_chunk_15
chunk_text:
866.50s | Now that first step going to from real mode to protected mode is is key right? That's the 866.50s - 873.24s | first thing that needs to happen. For this um on x86 we need essentially an are enabled 873.24s - 878.24s | segmentation. Uh segmentation provides um the ability for the for the core to see the 878.40s - 885.00s | memory in a segmented way. That's that's how it's called. Essentially we can have different 885.00s - 890.08s | segments for memory and assigns uh different permissions or like um the ability to execute 890.08s - 894.78s | code or or just read data and stuff like that. We have this key data structure called global 894.78s - 901.62s | descriptor table of G or GDT. And we have a register on the processor that is called GDTR 901.62s - 907.52s | that's gonna point to the base of our GDT structure and it's gonna have a limit in bytes. And 907.54s - 910.98s | so the GDT is just really an array of descriptors. And we're gonna have different type of 910.98s - 914.74s | descriptors. We have we have code descriptors, data descriptors. Each one is gonna have a 914.74s - 919.08s | base. The first one is never used. That's why it's called it's called null descriptor. But 919.08s - 924.78s | then when we have a jump you can see we'll have um a jump. It's not only having an offset 924.78s - 928.96s | like a target location but it's also gonna have like a segment selector right here. That 928.96s - 932.46s | segment selector picks the descriptor that we're gonna use for the for for our our code 932.48s - 939.48s | segment. And then the top the the offset is added to the base that is indicated by the GDT 939.48s - 944.48s | forming the final linear address. With that we can do uh an analysis of um the EDK2 SMM 946.98s - 951.98s | entry point. Essentially um we can see that at the very beginning we are moving into the 954.50s - 960.96s | register BX. The entry point plus 4D. This is in this is a decom like um extracted from a 961.90s - 967.84s | compiled uh SMM code. So you can see at 4D right there we have a GDT description ready


chunk_id: 133_chunk_16
chunk_text:
one is gonna have a 914.74s - 919.08s | base. The first one is never used. That's why it's called it's called null descriptor. But 919.08s - 924.78s | then when we have a jump you can see we'll have um a jump. It's not only having an offset 924.78s - 928.96s | like a target location but it's also gonna have like a segment selector right here. That 928.96s - 932.46s | segment selector picks the descriptor that we're gonna use for the for for our our code 932.48s - 939.48s | segment. And then the top the the offset is added to the base that is indicated by the GDT 939.48s - 944.48s | forming the final linear address. With that we can do uh an analysis of um the EDK2 SMM 946.98s - 951.98s | entry point. Essentially um we can see that at the very beginning we are moving into the 954.50s - 960.96s | register BX. The entry point plus 4D. This is in this is a decom like um extracted from a 961.90s - 967.84s | compiled uh SMM code. So you can see at 4D right there we have a GDT description ready to to to 967.84s - 972.64s | be loaded into the GDTR. The next instruction that matters for us is the load GDT. This is 972.64s - 978.48s | instruction that is gonna load the GDTR with the content that BX points to. And finally we 978.48s - 985.26s | have a jump over here that's gonna perform the actual um going into protected mode. And it 985.26s - 992.04s | has the selector of co of code as well and the offset. Now with this what what will happen 992.04s - 998.88s | if we over overlap a device that we control on the entry point? And we control offset 4D. 998.88s - 1003.18s | What will happen is that the load GDT will be loading something that we control. So we can 1003.18s - 1008.86s | load our fake GDT right? So that's what we're trying to do here. We're trying to get control 1008.86s - 1015.06s | over the offset 4D with any device that we can find. So that the the fake GDT then provides 1015.06s - 1019.86s | the descriptors we need and we can take control and jump down there. That's the whole idea


chunk_id: 133_chunk_17
chunk_text:
to to to 967.84s - 972.64s | be loaded into the GDTR. The next instruction that matters for us is the load GDT. This is 972.64s - 978.48s | instruction that is gonna load the GDTR with the content that BX points to. And finally we 978.48s - 985.26s | have a jump over here that's gonna perform the actual um going into protected mode. And it 985.26s - 992.04s | has the selector of co of code as well and the offset. Now with this what what will happen 992.04s - 998.88s | if we over overlap a device that we control on the entry point? And we control offset 4D. 998.88s - 1003.18s | What will happen is that the load GDT will be loading something that we control. So we can 1003.18s - 1008.86s | load our fake GDT right? So that's what we're trying to do here. We're trying to get control 1008.86s - 1015.06s | over the offset 4D with any device that we can find. So that the the fake GDT then provides 1015.06s - 1019.86s | the descriptors we need and we can take control and jump down there. That's the whole idea of 1019.86s - 1026.94s | the attack. And that's why the APIC is a problem. Two things. First the system becomes 1026.94s - 1032.48s | unstable when the APIC is moved. Super unstable. Second, the APIC racers are not useful for 1032.48s - 1037.78s | taking control in the way we need. We can see that at 4D we have these reserved regions with 1037.78s - 1043.32s | all zeros. Rights are discarded here. We're not able to control here and if we load a GDTR 1043.32s - 1049.72s | with all zeros we're essentially saying to the processor hey here's an empty GDT. So this 1049.72s - 1054.56s | won't work. And at this point we found another device not documented by the the 1054.56s - 1059.90s | specification that also has priority over uh the TSEC region. That's the spy controller and 1059.90s - 1064.90s | Christophe's gonna describe it for us. Alright. So the spy controller is a very nice device 1067.80s - 1071.24s | for us because it's present in all the systems we've tested. And it's basically used to 1071.24s - 1077.14s | access the spy flash on um AMD uh systems. So for example


chunk_id: 133_chunk_18
chunk_text:
of 1019.86s - 1026.94s | the attack. And that's why the APIC is a problem. Two things. First the system becomes 1026.94s - 1032.48s | unstable when the APIC is moved. Super unstable. Second, the APIC racers are not useful for 1032.48s - 1037.78s | taking control in the way we need. We can see that at 4D we have these reserved regions with 1037.78s - 1043.32s | all zeros. Rights are discarded here. We're not able to control here and if we load a GDTR 1043.32s - 1049.72s | with all zeros we're essentially saying to the processor hey here's an empty GDT. So this 1049.72s - 1054.56s | won't work. And at this point we found another device not documented by the the 1054.56s - 1059.90s | specification that also has priority over uh the TSEC region. That's the spy controller and 1059.90s - 1064.90s | Christophe's gonna describe it for us. Alright. So the spy controller is a very nice device 1067.80s - 1071.24s | for us because it's present in all the systems we've tested. And it's basically used to 1071.24s - 1077.14s | access the spy flash on um AMD uh systems. So for example for reading, writing, erasing the spy 1077.14s - 1081.74s | flash. It always goes for the spy controller. And it has a couple of key features that are 1081.74s - 1087.42s | really uh interesting to us. First of all, we can relocate the bar over the SMM entry point. 1087.42s - 1092.18s | Secondly, the portions which are interesting to us at offset 4D we can control them. And 1092.18s - 1098.00s | three, it actually takes precedence over uh SMRAM when TCLOS is enabled. So with that in 1098.02s - 1103.06s | mind, what we will do for our attack is simply take the spy bar, relocate it over the SMM 1103.06s - 1108.14s | entry point of core zero. And then afterwards manipulate the values at offset 4D within that 1108.14s - 1113.14s | bar. Um the um registers that actually correspond to that portion of memory in the bar uh are 1115.98s - 1121.14s | the memory range and ROM protection zero register. Those were used in the past to uh lock 1121.14s - 1126.28s | down access to the spy flash. But mostly these are not configured and not fixed. So we can 1126.30s -


chunk_id: 133_chunk_19
chunk_text:
for reading, writing, erasing the spy 1077.14s - 1081.74s | flash. It always goes for the spy controller. And it has a couple of key features that are 1081.74s - 1087.42s | really uh interesting to us. First of all, we can relocate the bar over the SMM entry point. 1087.42s - 1092.18s | Secondly, the portions which are interesting to us at offset 4D we can control them. And 1092.18s - 1098.00s | three, it actually takes precedence over uh SMRAM when TCLOS is enabled. So with that in 1098.02s - 1103.06s | mind, what we will do for our attack is simply take the spy bar, relocate it over the SMM 1103.06s - 1108.14s | entry point of core zero. And then afterwards manipulate the values at offset 4D within that 1108.14s - 1113.14s | bar. Um the um registers that actually correspond to that portion of memory in the bar uh are 1115.98s - 1121.14s | the memory range and ROM protection zero register. Those were used in the past to uh lock 1121.14s - 1126.28s | down access to the spy flash. But mostly these are not configured and not fixed. So we can 1126.30s - 1131.40s | fully control them. On some systems they are fixed. But actually they are fixed to values 1131.40s - 1136.40s | which are still useful for us. So before I dive into the exploits, uh I also want to uh show 1138.82s - 1145.22s | you a little bit our debugging stuff because it's a little bit special. Um so we are facing 1145.22s - 1150.62s | actually two challenges uh when we try to develop the exploit. First of all, we didn't have 1150.62s - 1155.66s | really have a way to know whether our payload ran because the system just crashes, reboots 1155.68s - 1160.42s | and memory is just all wiped. Uh and secondly, we didn't really have any debugging framework 1160.42s - 1166.12s | for SMM. Um and like for example, when crashes happen, we want to be able to modify the 1166.12s - 1171.92s | code however we see fit. So to resolve the first issue, we actually took a PCI squirrel which 1171.92s - 1177.70s | is typically used with PCI leach for DMA attacks. But the nice thing about it is actually 1177.70s - 1182.70s | is that it has a bar


chunk_id: 133_chunk_20
chunk_text:
1131.40s | fully control them. On some systems they are fixed. But actually they are fixed to values 1131.40s - 1136.40s | which are still useful for us. So before I dive into the exploits, uh I also want to uh show 1138.82s - 1145.22s | you a little bit our debugging stuff because it's a little bit special. Um so we are facing 1145.22s - 1150.62s | actually two challenges uh when we try to develop the exploit. First of all, we didn't have 1150.62s - 1155.66s | really have a way to know whether our payload ran because the system just crashes, reboots 1155.68s - 1160.42s | and memory is just all wiped. Uh and secondly, we didn't really have any debugging framework 1160.42s - 1166.12s | for SMM. Um and like for example, when crashes happen, we want to be able to modify the 1166.12s - 1171.92s | code however we see fit. So to resolve the first issue, we actually took a PCI squirrel which 1171.92s - 1177.70s | is typically used with PCI leach for DMA attacks. But the nice thing about it is actually 1177.70s - 1182.70s | is that it has a bar buffer as we call it. Where when we write to it, it actually survives 1183.02s - 1188.02s | across reboots. So for instance a payload can write a value to uh the bar buffer kind of like a 1190.52s - 1194.52s | checkpoint so we know it ran. And then when the system reboots it's still going to be there. 1194.52s - 1199.76s | Right. And if we want to modify for example for the second issue, if we want to modify uh code 1199.76s - 1205.74s | in SMM for some extra debugging capabilities, for that we just um injected a firmware implant 1205.74s - 1211.20s | uh that loads a nice SMM module that allows us to do all of that. So the setup looks like 1211.20s - 1216.78s | this. We just have the PCI squirrel connected to our target device via an M2 uh adapter 1216.78s - 1222.18s | and all of this is powered externally by a power supply. So it's time to get our hands dirty. 1222.18s - 1227.32s | So let's take a look at how uh the exploit looks like. In the first attempt uh we remap the 1227.32s - 1232.80s |


chunk_id: 133_chunk_21
chunk_text:
buffer as we call it. Where when we write to it, it actually survives 1183.02s - 1188.02s | across reboots. So for instance a payload can write a value to uh the bar buffer kind of like a 1190.52s - 1194.52s | checkpoint so we know it ran. And then when the system reboots it's still going to be there. 1194.52s - 1199.76s | Right. And if we want to modify for example for the second issue, if we want to modify uh code 1199.76s - 1205.74s | in SMM for some extra debugging capabilities, for that we just um injected a firmware implant 1205.74s - 1211.20s | uh that loads a nice SMM module that allows us to do all of that. So the setup looks like 1211.20s - 1216.78s | this. We just have the PCI squirrel connected to our target device via an M2 uh adapter 1216.78s - 1222.18s | and all of this is powered externally by a power supply. So it's time to get our hands dirty. 1222.18s - 1227.32s | So let's take a look at how uh the exploit looks like. In the first attempt uh we remap the 1227.32s - 1232.80s | spy bar just like mentioned before over the SMM entry point of core zero. Then we tweak uh 1232.80s - 1238.94s | these values at offset 4D. We create a fake GDT in the beginning of the address space uh 1238.94s - 1242.94s | with the with a nice base address that will allow us when the jump happens to redirect 1242.94s - 1248.82s | execution to our own payload. And then when we uh execute the SMM entry point code with T 1248.82s - 1254.16s | cost enabled what's going to happen is uh the all GDT is actually going to load the GDT 1254.16s - 1259.76s | register uh with a value that points to our own fake GDT. So that's great. And afterwards when 1259.76s - 1265.64s | the jump happens a descriptor from the fake GDT is going to be taken that we control um and 1265.64s - 1272.88s | it's going to be used as a base uh for the jump. So and um this is going to redirect 1272.88s - 1279.28s | execution like this at least in theory. So um an interesting detail is actually how we pick 1279.28s - 1286.22s | the


chunk_id: 133_chunk_22
chunk_text:
spy bar just like mentioned before over the SMM entry point of core zero. Then we tweak uh 1232.80s - 1238.94s | these values at offset 4D. We create a fake GDT in the beginning of the address space uh 1238.94s - 1242.94s | with the with a nice base address that will allow us when the jump happens to redirect 1242.94s - 1248.82s | execution to our own payload. And then when we uh execute the SMM entry point code with T 1248.82s - 1254.16s | cost enabled what's going to happen is uh the all GDT is actually going to load the GDT 1254.16s - 1259.76s | register uh with a value that points to our own fake GDT. So that's great. And afterwards when 1259.76s - 1265.64s | the jump happens a descriptor from the fake GDT is going to be taken that we control um and 1265.64s - 1272.88s | it's going to be used as a base uh for the jump. So and um this is going to redirect 1272.88s - 1279.28s | execution like this at least in theory. So um an interesting detail is actually how we pick 1279.28s - 1286.22s | the base address in the GDT descriptor. Um and for that we have to understand how it 1286.22s - 1291.36s | normally executes and how it executes with T cost in this case. So um when the for jump 1291.38s - 1297.76s | happens um and the normal execution what happens is the GDT register is going to point to a 1297.76s - 1302.36s | GDT with an SMRAM where it's nicely protected. Um and the segment selector is going to 1302.36s - 1307.70s | index into that table um and the base is going to be actually fixed to zero. Which means 1307.70s - 1313.54s | with a base of zero when we add it uh to the far jump offset what's going to happen is the 1313.54s - 1318.72s | linear address is going to be the same. Now in our case actually we have a bit of an issue. 1318.72s - 1325.68s | We want to read the execution um outside of TSEG. The only problem is that within the first 1325.68s - 1331.22s | four gigs of memory after TSEG there's not really any spot where we can put a payload. Right? 1331.22s - 1334.96s | So


chunk_id: 133_chunk_23
chunk_text:
base address in the GDT descriptor. Um and for that we have to understand how it 1286.22s - 1291.36s | normally executes and how it executes with T cost in this case. So um when the for jump 1291.38s - 1297.76s | happens um and the normal execution what happens is the GDT register is going to point to a 1297.76s - 1302.36s | GDT with an SMRAM where it's nicely protected. Um and the segment selector is going to 1302.36s - 1307.70s | index into that table um and the base is going to be actually fixed to zero. Which means 1307.70s - 1313.54s | with a base of zero when we add it uh to the far jump offset what's going to happen is the 1313.54s - 1318.72s | linear address is going to be the same. Now in our case actually we have a bit of an issue. 1318.72s - 1325.68s | We want to read the execution um outside of TSEG. The only problem is that within the first 1325.68s - 1331.22s | four gigs of memory after TSEG there's not really any spot where we can put a payload. Right? 1331.22s - 1334.96s | So if we increase the base a little bit sure the instruction pointer is going to go a bit more 1334.96s - 1340.74s | up up up up. And the address space we don't really have DRAM over there that we control. So 1340.74s - 1347.74s | we wondered okay what happens if we actually increase the base such that when we uh the 1347.76s - 1353.54s | base of the GDT descriptor such that when we add it to the far jump offset it actually 1353.54s - 1358.54s | overflows. Um yeah? It just overflows. So we thought okay this isn't going to be possible but 1360.94s - 1366.62s | actually it was. Uh and this is nice because uh if we choose the base efficiently big and we 1366.62s - 1369.72s | add the offset we can actually make it wrap around and make it jump to our own payload in the 1369.72s - 1373.32s | beginning of the physical address space. The beginning of the physical address space we have 1373.44s - 1380.44s | DRAM there. Great. We control all of that. So uh that was one of the key takeaways actually 1380.44s - 1385.98s | that we


chunk_id: 133_chunk_24
chunk_text:
if we increase the base a little bit sure the instruction pointer is going to go a bit more 1334.96s - 1340.74s | up up up up. And the address space we don't really have DRAM over there that we control. So 1340.74s - 1347.74s | we wondered okay what happens if we actually increase the base such that when we uh the 1347.76s - 1353.54s | base of the GDT descriptor such that when we add it to the far jump offset it actually 1353.54s - 1358.54s | overflows. Um yeah? It just overflows. So we thought okay this isn't going to be possible but 1360.94s - 1366.62s | actually it was. Uh and this is nice because uh if we choose the base efficiently big and we 1366.62s - 1369.72s | add the offset we can actually make it wrap around and make it jump to our own payload in the 1369.72s - 1373.32s | beginning of the physical address space. The beginning of the physical address space we have 1373.44s - 1380.44s | DRAM there. Great. We control all of that. So uh that was one of the key takeaways actually 1380.44s - 1385.98s | that we had from the research as well. So this worked. Our payload actually ran and we saw 1385.98s - 1390.88s | this because it would write a value this nice checkpoint to our bar buffer but the system 1390.88s - 1395.46s | would crash and we wondered okay why is this happening? Um the reason was the SMM safe 1395.46s - 1400.36s | state. So like Enrique mentioned when a CPU goes to SMM mode it actually saves the current 1400.40s - 1404.94s | register state into the uh SMM safe state. When it returns it just restores it. What happens 1404.94s - 1411.48s | is when T-Close is enabled actually the writes when the core enters SMM are going to be 1411.48s - 1416.22s | discarded which means when we return with T-Close disabled actually it's just going to use 1416.22s - 1422.02s | stale values that were still there that were stored before. And to resolve this the trick is 1422.02s - 1428.12s | actually pretty straight forward. We trigger the SMM twice. One time um without T-Close and 1428.12s - 1434.86s | the second time with T-Close. So we first put the core zero into a known controlled


chunk_id: 133_chunk_25
chunk_text:
had from the research as well. So this worked. Our payload actually ran and we saw 1385.98s - 1390.88s | this because it would write a value this nice checkpoint to our bar buffer but the system 1390.88s - 1395.46s | would crash and we wondered okay why is this happening? Um the reason was the SMM safe 1395.46s - 1400.36s | state. So like Enrique mentioned when a CPU goes to SMM mode it actually saves the current 1400.40s - 1404.94s | register state into the uh SMM safe state. When it returns it just restores it. What happens 1404.94s - 1411.48s | is when T-Close is enabled actually the writes when the core enters SMM are going to be 1411.48s - 1416.22s | discarded which means when we return with T-Close disabled actually it's just going to use 1416.22s - 1422.02s | stale values that were still there that were stored before. And to resolve this the trick is 1422.02s - 1428.12s | actually pretty straight forward. We trigger the SMM twice. One time um without T-Close and 1428.12s - 1434.86s | the second time with T-Close. So we first put the core zero into a known controlled state 1434.86s - 1439.20s | and then trigger an SMI without T-Close. This is going to prime the SMM safe state and 1439.20s - 1444.24s | afterwards when we trigger the bug with T-Close enabled the code is going to go for the same 1444.24s - 1450.78s | execution path and is just going to reuse the values that we stored before. So that worked 1450.78s - 1455.98s | but unfortunately it crashed again. But this time around we did see actually that the uh 1456.14s - 1460.78s | core zero was returning from SMM so that was great. We had full control of core zero. 1460.78s - 1466.66s | OS code was running. We saw our checkpoints. Great. But no matter what we tried this damn 1466.66s - 1471.12s | thing was still crashing. Um so we spent an eternity debugging this thing until we 1471.12s - 1478.14s | stumbled into this. When we enable T-Close what happens is we enable it on core zero only 1478.14s - 1484.30s | but actually it gets enabled on both cores. Core zero and core one. Um and we found that 1484.30s - 1487.96s | the culprit for this is symmetric multi-threading.


chunk_id: 133_chunk_26
chunk_text:
state 1434.86s - 1439.20s | and then trigger an SMI without T-Close. This is going to prime the SMM safe state and 1439.20s - 1444.24s | afterwards when we trigger the bug with T-Close enabled the code is going to go for the same 1444.24s - 1450.78s | execution path and is just going to reuse the values that we stored before. So that worked 1450.78s - 1455.98s | but unfortunately it crashed again. But this time around we did see actually that the uh 1456.14s - 1460.78s | core zero was returning from SMM so that was great. We had full control of core zero. 1460.78s - 1466.66s | OS code was running. We saw our checkpoints. Great. But no matter what we tried this damn 1466.66s - 1471.12s | thing was still crashing. Um so we spent an eternity debugging this thing until we 1471.12s - 1478.14s | stumbled into this. When we enable T-Close what happens is we enable it on core zero only 1478.14s - 1484.30s | but actually it gets enabled on both cores. Core zero and core one. Um and we found that 1484.30s - 1487.96s | the culprit for this is symmetric multi-threading. So this is AMD's implementation of 1487.96s - 1492.66s | Intel hyper-threading. Um and what it does is it divides a physical core into two logical 1492.66s - 1497.70s | cores. And some of the resources on these logical cores are shared and some of them are not. 1497.70s - 1503.58s | So for instance the SMM base MSR is separate so every logical core has a different base MSR. 1503.58s - 1510.62s | But the T-Sec mask is actually shared which is what we just saw. Right? And we wondered is 1510.70s - 1516.04s | this the actual issue because we assume when an SMI gets triggered that only one core goes 1516.04s - 1521.52s | into SMM at a time. And we put this to the test and what we saw is the following. When we 1521.52s - 1527.36s | have multiple cores running in normal mode so outside of SMM um when we when one of them 1527.36s - 1532.86s | triggers an SMI an interrupt gets asserted on all of the cores and all of the cores are 1532.86s - 1539.30s | gonna go into SMM mode and gonna start executing the SMM entry point codes


chunk_id: 133_chunk_27
chunk_text:
So this is AMD's implementation of 1487.96s - 1492.66s | Intel hyper-threading. Um and what it does is it divides a physical core into two logical 1492.66s - 1497.70s | cores. And some of the resources on these logical cores are shared and some of them are not. 1497.70s - 1503.58s | So for instance the SMM base MSR is separate so every logical core has a different base MSR. 1503.58s - 1510.62s | But the T-Sec mask is actually shared which is what we just saw. Right? And we wondered is 1510.70s - 1516.04s | this the actual issue because we assume when an SMI gets triggered that only one core goes 1516.04s - 1521.52s | into SMM at a time. And we put this to the test and what we saw is the following. When we 1521.52s - 1527.36s | have multiple cores running in normal mode so outside of SMM um when we when one of them 1527.36s - 1532.86s | triggers an SMI an interrupt gets asserted on all of the cores and all of the cores are 1532.86s - 1539.30s | gonna go into SMM mode and gonna start executing the SMM entry point codes um for uh for each 1539.32s - 1545.16s | one of them. So our assumptions were actually wrong. Right? We assumed SMIs are local but 1545.16s - 1549.42s | they're actually not. And we thought that this was actually the case because the indicate 1549.42s - 1554.90s | two code has a so called rendezvous routine which will every time you enter into SMM this 1554.90s - 1560.34s | routine is gonna be triggered and that core which entered into SMM will send an explicit 1560.34s - 1565.78s | inter-processor interrupt to all of the logical cores to explicitly pull them from whatever 1565.80s - 1570.50s | state they were in into SMM. And well what's the point of that if actually all the cores 1570.50s - 1575.20s | always go into SMM anyway right? Um and we dug a little bit deeper into the documentation 1575.20s - 1579.98s | and we found that the IO hub seems to be responsible for this to uh basically assert this 1579.98s - 1584.98s | interrupt on all of the cores so we're out of luck. So to summarize we had all cores always 1587.74s - 1593.06s | going into SMM and T-Cores


chunk_id: 133_chunk_28
chunk_text:
um for uh for each 1539.32s - 1545.16s | one of them. So our assumptions were actually wrong. Right? We assumed SMIs are local but 1545.16s - 1549.42s | they're actually not. And we thought that this was actually the case because the indicate 1549.42s - 1554.90s | two code has a so called rendezvous routine which will every time you enter into SMM this 1554.90s - 1560.34s | routine is gonna be triggered and that core which entered into SMM will send an explicit 1560.34s - 1565.78s | inter-processor interrupt to all of the logical cores to explicitly pull them from whatever 1565.80s - 1570.50s | state they were in into SMM. And well what's the point of that if actually all the cores 1570.50s - 1575.20s | always go into SMM anyway right? Um and we dug a little bit deeper into the documentation 1575.20s - 1579.98s | and we found that the IO hub seems to be responsible for this to uh basically assert this 1579.98s - 1584.98s | interrupt on all of the cores so we're out of luck. So to summarize we had all cores always 1587.74s - 1593.06s | going into SMM and T-Cores being enabled on two cores at the same time and not just one as 1593.08s - 1599.08s | we initially thought. And this will actually make just core one go haywire. Right? We have 1599.08s - 1604.28s | control of core zero but core one is uh just gonna go nuts and crash the whole system. So to 1604.28s - 1610.98s | tackle the problem we had to get control of core one some way. Uh and we dug deep into our 1610.98s - 1617.00s | bag of tricks to really uh see if maybe there's a nice elegant solution to this to just take 1617.00s - 1623.94s | core one out of the running. Um so we tried to um we tried to find another device to 1623.94s - 1629.08s | overlap with the entry point of core one. There was none. Uh we tried to disable SMT in the 1629.08s - 1635.62s | BIOS that also didn't work. We tried to uh use the uh so called init IPI and also the SKN 1635.62s - 1641.22s | instruction to put core one into a state that would actually make it ignore SMIs. That also 1641.22s - 1646.64s |


chunk_id: 133_chunk_29
chunk_text:
being enabled on two cores at the same time and not just one as 1593.08s - 1599.08s | we initially thought. And this will actually make just core one go haywire. Right? We have 1599.08s - 1604.28s | control of core zero but core one is uh just gonna go nuts and crash the whole system. So to 1604.28s - 1610.98s | tackle the problem we had to get control of core one some way. Uh and we dug deep into our 1610.98s - 1617.00s | bag of tricks to really uh see if maybe there's a nice elegant solution to this to just take 1617.00s - 1623.94s | core one out of the running. Um so we tried to um we tried to find another device to 1623.94s - 1629.08s | overlap with the entry point of core one. There was none. Uh we tried to disable SMT in the 1629.08s - 1635.62s | BIOS that also didn't work. We tried to uh use the uh so called init IPI and also the SKN 1635.62s - 1641.22s | instruction to put core one into a state that would actually make it ignore SMIs. That also 1641.22s - 1646.64s | didn't work. And finally we also tried to send a so called SMI IPI which at least according 1647.30s - 1651.98s | to the documentation would allow us to trigger a SMI on individual cores. And it also didn't 1651.98s - 1657.22s | work. So despite the documentation indicating one thing in practice we didn't manage to uh get 1657.22s - 1661.68s | it to work. So we're running out of options and we had to take a step back and analyze the 1661.68s - 1666.66s | problem. And we realized okay the LGDT is the actual problem because it's gonna be load 1666.66s - 1673.70s | loading the GDT register with all Fs. Right? So is this is there maybe some way we can 1673.70s - 1680.30s | actually still take advantage of this. Um so when the SMM entry point normally executes what 1680.30s - 1684.44s | happens with the GDT register is it's gonna be loaded with a nice value for the base. It's 1684.44s - 1690.58s | gonna be pointing to the GDT within uh SMRAM. Right? And afterwards the segment selector is 1690.58s - 1697.22s | gonna be taken, added to it, uh and the


chunk_id: 133_chunk_30
chunk_text:
didn't work. And finally we also tried to send a so called SMI IPI which at least according 1647.30s - 1651.98s | to the documentation would allow us to trigger a SMI on individual cores. And it also didn't 1651.98s - 1657.22s | work. So despite the documentation indicating one thing in practice we didn't manage to uh get 1657.22s - 1661.68s | it to work. So we're running out of options and we had to take a step back and analyze the 1661.68s - 1666.66s | problem. And we realized okay the LGDT is the actual problem because it's gonna be load 1666.66s - 1673.70s | loading the GDT register with all Fs. Right? So is this is there maybe some way we can 1673.70s - 1680.30s | actually still take advantage of this. Um so when the SMM entry point normally executes what 1680.30s - 1684.44s | happens with the GDT register is it's gonna be loaded with a nice value for the base. It's 1684.44s - 1690.58s | gonna be pointing to the GDT within uh SMRAM. Right? And afterwards the segment selector is 1690.58s - 1697.22s | gonna be taken, added to it, uh and the base within that uh descriptor is gonna be used to 1697.22s - 1703.16s | calculate the final linear address. Now in our case what's gonna happen with the 1703.16s - 1708.36s | cores is enabled uh the GDT register is gonna be loaded with all Fs. Both the limit and the 1708.36s - 1714.96s | base. And what's gonna happen then is when the four jump the segment selector is gonna be 1714.96s - 1720.50s | added to it. And once again we have our good old friends integer overflow. It's actually 1720.50s - 1725.28s | gonna result in the physical address seven. And this is actually awesome because address 1725.28s - 1729.84s | seven and the physical address space once again that's DRAM. We control DRAM. So we can 1729.86s - 1734.70s | take advantage of that. We can put our GDT at the beginning of DRAM and we can just 1734.70s - 1741.10s | overflow this thing like this. And afterwards uh from the GDT we control we set a nice base so 1741.10s - 1747.04s | that afterwards uh the code jumps wherever we want it to. So to summarize we have two types of 1747.04s -


chunk_id: 133_chunk_31
chunk_text:
base within that uh descriptor is gonna be used to 1697.22s - 1703.16s | calculate the final linear address. Now in our case what's gonna happen with the 1703.16s - 1708.36s | cores is enabled uh the GDT register is gonna be loaded with all Fs. Both the limit and the 1708.36s - 1714.96s | base. And what's gonna happen then is when the four jump the segment selector is gonna be 1714.96s - 1720.50s | added to it. And once again we have our good old friends integer overflow. It's actually 1720.50s - 1725.28s | gonna result in the physical address seven. And this is actually awesome because address 1725.28s - 1729.84s | seven and the physical address space once again that's DRAM. We control DRAM. So we can 1729.86s - 1734.70s | take advantage of that. We can put our GDT at the beginning of DRAM and we can just 1734.70s - 1741.10s | overflow this thing like this. And afterwards uh from the GDT we control we set a nice base so 1741.10s - 1747.04s | that afterwards uh the code jumps wherever we want it to. So to summarize we have two types of 1747.04s - 1751.38s | wraparounds. One is between the GDT descriptor base and the four jump offset. And the second 1751.38s - 1757.26s | one between the GDT register base and the four jump segment selector. And the nice thing 1757.28s - 1762.28s | about this is we can actually reuse the same fake GDT for both core zero and core one. And 1764.48s - 1770.59s | the added bonus is we don't even need the spy bar anymore. The only thing that we really have 1770.59s - 1775.93s | to take care of is the SMM safe state. Once again for core one. For core zero we just do the 1775.93s - 1780.77s | same thing as before. But core one is gonna be running in some unknown state. It could be 1780.77s - 1784.87s | running in ring three, ring zero just in an unknown context. We have to bring it to uh the 1784.87s - 1790.21s | same controlled state as core zero. And we do so by using a kernel synchronization API. 1790.21s - 1796.29s | Which on Windows is the deferred procedure call. Or on Linux symmetric multiprocessing. And 1796.29s - 1802.13s | basically once that's done


chunk_id: 133_chunk_32
chunk_text:
1751.38s | wraparounds. One is between the GDT descriptor base and the four jump offset. And the second 1751.38s - 1757.26s | one between the GDT register base and the four jump segment selector. And the nice thing 1757.28s - 1762.28s | about this is we can actually reuse the same fake GDT for both core zero and core one. And 1764.48s - 1770.59s | the added bonus is we don't even need the spy bar anymore. The only thing that we really have 1770.59s - 1775.93s | to take care of is the SMM safe state. Once again for core one. For core zero we just do the 1775.93s - 1780.77s | same thing as before. But core one is gonna be running in some unknown state. It could be 1780.77s - 1784.87s | running in ring three, ring zero just in an unknown context. We have to bring it to uh the 1784.87s - 1790.21s | same controlled state as core zero. And we do so by using a kernel synchronization API. 1790.21s - 1796.29s | Which on Windows is the deferred procedure call. Or on Linux symmetric multiprocessing. And 1796.29s - 1802.13s | basically once that's done uh we have both cores in a known state. And we can use the same 1802.13s - 1808.17s | trick we did uh use for core zero. So all good things are three. So let's try again. The 1808.17s - 1813.67s | exploit this time is greatly simplified. And well the only thing we have to do is we create 1813.67s - 1818.47s | a fake GDT in the beginning of the address space. We choose the um base address within the 1818.47s - 1824.35s | descriptor accordingly. And that's it. And then when we trigger when we enable T-Close and 1824.35s - 1829.51s | run the uh SMM entry point code again. The old GDT this time around is gonna point to the 1829.51s - 1835.09s | very end of the address space of the first four gigs. But then when the far jump happens it's 1835.09s - 1839.23s | gonna wrap around. It's gonna fetch the GDT descriptor entry from the beginning of the 1839.25s - 1844.73s | address space. From our fake GDT. And then afterwards it's gonna redirect execution for both 1844.73s - 1851.13s | core zero and core one to our own payload. And that


chunk_id: 133_chunk_33
chunk_text:
uh we have both cores in a known state. And we can use the same 1802.13s - 1808.17s | trick we did uh use for core zero. So all good things are three. So let's try again. The 1808.17s - 1813.67s | exploit this time is greatly simplified. And well the only thing we have to do is we create 1813.67s - 1818.47s | a fake GDT in the beginning of the address space. We choose the um base address within the 1818.47s - 1824.35s | descriptor accordingly. And that's it. And then when we trigger when we enable T-Close and 1824.35s - 1829.51s | run the uh SMM entry point code again. The old GDT this time around is gonna point to the 1829.51s - 1835.09s | very end of the address space of the first four gigs. But then when the far jump happens it's 1835.09s - 1839.23s | gonna wrap around. It's gonna fetch the GDT descriptor entry from the beginning of the 1839.25s - 1844.73s | address space. From our fake GDT. And then afterwards it's gonna redirect execution for both 1844.73s - 1851.13s | core zero and core one to our own payload. And that finally worked. Well we managed to 1851.13s - 1856.27s | control both cores. Core zero and core one. Uh our payload was executed with SMM privileges. 1856.27s - 1861.87s | And uh it would return gracefully from SMM to the operating system and nothing would crash. 1861.87s - 1865.61s | And that was great. There were only a couple of things that we wanted to improve uh in our 1865.63s - 1870.63s | exploit. And that was um to reload the GDT because the base actually is um a bit off. So we 1874.91s - 1879.01s | just reloaded the GDT so that the base address is zero again. So that we don't have strange 1879.01s - 1884.39s | misalignment issues. We set up long modes. Uh so page tables, stack pointer etc. So we can 1884.39s - 1890.89s | execute like uh any SQL that we want. Uh and then we also install an SMI handler so that we 1890.89s - 1894.73s | only have to exploit the bug once. And then basically we have kind of semi persistence of 1894.75s - 1901.19s | the system resets. Right? So for the demo just to show you I'm not selling


chunk_id: 133_chunk_34
chunk_text:
finally worked. Well we managed to 1851.13s - 1856.27s | control both cores. Core zero and core one. Uh our payload was executed with SMM privileges. 1856.27s - 1861.87s | And uh it would return gracefully from SMM to the operating system and nothing would crash. 1861.87s - 1865.61s | And that was great. There were only a couple of things that we wanted to improve uh in our 1865.63s - 1870.63s | exploit. And that was um to reload the GDT because the base actually is um a bit off. So we 1874.91s - 1879.01s | just reloaded the GDT so that the base address is zero again. So that we don't have strange 1879.01s - 1884.39s | misalignment issues. We set up long modes. Uh so page tables, stack pointer etc. So we can 1884.39s - 1890.89s | execute like uh any SQL that we want. Uh and then we also install an SMI handler so that we 1890.89s - 1894.73s | only have to exploit the bug once. And then basically we have kind of semi persistence of 1894.75s - 1901.19s | the system resets. Right? So for the demo just to show you I'm not selling just some snake 1901.19s - 1906.19s | snake oil. Uh we have a system over here which is a Huawei MateBook V16 from 2000 uh 23. And 1912.17s - 1916.51s | you can see when the system boots it actually shows the Huawei logo. That logo is embedded in 1916.51s - 1922.65s | the firmware code. For that um so for our exploit we're actually gonna modify that uh that 1922.67s - 1927.67s | logo. So um we're gonna run our exploit with uh kernel privileges. So you'll see over here 1930.01s - 1934.91s | that we have to elevate privileges and it's gonna be triggered via a malicious driver. And 1934.91s - 1940.49s | then our exploit is gonna do uh 3 things. At first it's gonna use the synclose issue to 1940.49s - 1946.59s | elevate privileges to SMM. Then it's gonna disable the spy flash protections. And then 1946.59s - 1952.17s | afterwards it's gonna write to the spy flash the portion where the um boot splash logo is 1952.19s - 1957.19s | actually residing. This takes a little while about 15 minutes so we just fast forward that 1957.19s - 1963.69s | portion. And you can


chunk_id: 133_chunk_35
chunk_text:
just some snake 1901.19s - 1906.19s | snake oil. Uh we have a system over here which is a Huawei MateBook V16 from 2000 uh 23. And 1912.17s - 1916.51s | you can see when the system boots it actually shows the Huawei logo. That logo is embedded in 1916.51s - 1922.65s | the firmware code. For that um so for our exploit we're actually gonna modify that uh that 1922.67s - 1927.67s | logo. So um we're gonna run our exploit with uh kernel privileges. So you'll see over here 1930.01s - 1934.91s | that we have to elevate privileges and it's gonna be triggered via a malicious driver. And 1934.91s - 1940.49s | then our exploit is gonna do uh 3 things. At first it's gonna use the synclose issue to 1940.49s - 1946.59s | elevate privileges to SMM. Then it's gonna disable the spy flash protections. And then 1946.59s - 1952.17s | afterwards it's gonna write to the spy flash the portion where the um boot splash logo is 1952.19s - 1957.19s | actually residing. This takes a little while about 15 minutes so we just fast forward that 1957.19s - 1963.69s | portion. And you can see okay it shows done patching. All good. And at this point we just 1963.69s - 1968.71s | reset the system and pray that it works. So let's see. Yeah this one takes a little while. And 1982.28s - 1996.10s | there we go. Well successful. So I mean this was just one example of what we can do with this 1996.14s - 2000.94s | kind of access into the system. But let's take a more systematic approach to see whether this 2000.94s - 2005.32s | works on all systems just on some. What does this actually depend on? So the next attack 2005.32s - 2011.92s | path um paths depend on how the platform is actually configured. Um so every vendor 2011.92s - 2016.36s | configures certain features that uh AMD provides to them. And specifically there are 2 of 2016.36s - 2021.64s | them which are key to this. One is room armor which can be used to restrict access to the 2021.64s - 2026.98s | portions of the spy flash. And the second one is platform secure boot which is AMD's 2026.98s - 2033.66s | equivalent of boot guard which will verify the initial stages of the


chunk_id: 133_chunk_36
chunk_text:
see okay it shows done patching. All good. And at this point we just 1963.69s - 1968.71s | reset the system and pray that it works. So let's see. Yeah this one takes a little while. And 1982.28s - 1996.10s | there we go. Well successful. So I mean this was just one example of what we can do with this 1996.14s - 2000.94s | kind of access into the system. But let's take a more systematic approach to see whether this 2000.94s - 2005.32s | works on all systems just on some. What does this actually depend on? So the next attack 2005.32s - 2011.92s | path um paths depend on how the platform is actually configured. Um so every vendor 2011.92s - 2016.36s | configures certain features that uh AMD provides to them. And specifically there are 2 of 2016.36s - 2021.64s | them which are key to this. One is room armor which can be used to restrict access to the 2021.64s - 2026.98s | portions of the spy flash. And the second one is platform secure boot which is AMD's 2026.98s - 2033.66s | equivalent of boot guard which will verify the initial stages of the firmware code. Um so if 2033.66s - 2038.60s | everything is enabled the very least thing that we can do is we can write to a portion of the 2038.60s - 2041.80s | spy flash where you have your variables lived. So for instance in these variables you're 2041.80s - 2047.60s | gonna have things like the secure boot uh keys which I used. So we can break secure boot. 2047.60s - 2052.30s | That's nice. Um but if nothing is enabled actually we have firmware implants. I'm gonna 2052.30s - 2055.98s | explain in a moment uh what the difference actually is. So in the first configuration 2055.98s - 2060.32s | whenever where everything is uh properly configured. We see ok we escalate from the 2060.32s - 2066.02s | operating system to SMM. And from there we can write to the let's say firmware uh data 2066.02s - 2069.92s | portion of the spy flash where the configurations are. So we can manipulate like secure 2069.92s - 2074.70s | boot keys. So that afterwards we can actually load our own malicious boot loader before the 2075.06s - 2080.34s | OS loader runs. And the second configuration where the PSB


chunk_id: 133_chunk_37
chunk_text:
firmware code. Um so if 2033.66s - 2038.60s | everything is enabled the very least thing that we can do is we can write to a portion of the 2038.60s - 2041.80s | spy flash where you have your variables lived. So for instance in these variables you're 2041.80s - 2047.60s | gonna have things like the secure boot uh keys which I used. So we can break secure boot. 2047.60s - 2052.30s | That's nice. Um but if nothing is enabled actually we have firmware implants. I'm gonna 2052.30s - 2055.98s | explain in a moment uh what the difference actually is. So in the first configuration 2055.98s - 2060.32s | whenever where everything is uh properly configured. We see ok we escalate from the 2060.32s - 2066.02s | operating system to SMM. And from there we can write to the let's say firmware uh data 2066.02s - 2069.92s | portion of the spy flash where the configurations are. So we can manipulate like secure 2069.92s - 2074.70s | boot keys. So that afterwards we can actually load our own malicious boot loader before the 2075.06s - 2080.34s | OS loader runs. And the second configuration where the PSB is not enabled. We have basically 2080.34s - 2085.34s | the same scenario. Um roam armor still will still restrict write access to um to the data 2087.84s - 2094.58s | portion. And we can we can still just um uh inject our own boot kits. And the third 2094.58s - 2099.32s | configuration we can write to even firmware code but that's gonna be still verified by 2099.34s - 2105.18s | platform secure boot. So ok in these three we have the same scenario. We can just inject a 2105.18s - 2109.18s | boot kit which is still nice because it runs before the OS loader. Any protections provided 2109.18s - 2116.26s | by the operating system would still be um rendered null. But in the last scenario where 2116.26s - 2120.86s | none of these features are enabled what we can do is we can inject our uh malware into the 2120.86s - 2126.24s | spy flash into the firmware code portion of it. And when that happens uh uh is what we're 2126.26s - 2133.20s | gonna get is we can um run our own malware at the very earliest stage of the boot process. 2133.20s -


chunk_id: 133_chunk_38
chunk_text:
is not enabled. We have basically 2080.34s - 2085.34s | the same scenario. Um roam armor still will still restrict write access to um to the data 2087.84s - 2094.58s | portion. And we can we can still just um uh inject our own boot kits. And the third 2094.58s - 2099.32s | configuration we can write to even firmware code but that's gonna be still verified by 2099.34s - 2105.18s | platform secure boot. So ok in these three we have the same scenario. We can just inject a 2105.18s - 2109.18s | boot kit which is still nice because it runs before the OS loader. Any protections provided 2109.18s - 2116.26s | by the operating system would still be um rendered null. But in the last scenario where 2116.26s - 2120.86s | none of these features are enabled what we can do is we can inject our uh malware into the 2120.86s - 2126.24s | spy flash into the firmware code portion of it. And when that happens uh uh is what we're 2126.26s - 2133.20s | gonna get is we can um run our own malware at the very earliest stage of the boot process. 2133.20s - 2139.80s | And there's a key difference here between a firmware implant and uh a boot kit. Is that this 2139.80s - 2144.68s | attack actually is resistant to uh to OS reinstallations. So even if you wipe your drive 2144.68s - 2148.92s | it's still gonna be around. Um and even if you try to push a firmware update from the 2148.92s - 2153.36s | operating system it's still gonna be around because the uh the malware can just say well 2153.58s - 2160.32s | update was successful. Um and the only way to really get rid of it at that point is to take 2160.32s - 2166.66s | apart your system, take a spy programmer to read out the spy flash, inspect it and if it's 2166.66s - 2173.76s | infected um just uh rewrite it. But typically it's not really in the repertoire of a typical 2173.76s - 2179.50s | IT guy right? So to illustrate how prevalent actually these misconfigurations are we did 2179.52s - 2184.16s | some research last year on that and we saw that the majority of the systems have none of the 2184.16s - 2188.96s | security features actually enabled. Which means


chunk_id: 133_chunk_39
chunk_text:
2139.80s | And there's a key difference here between a firmware implant and uh a boot kit. Is that this 2139.80s - 2144.68s | attack actually is resistant to uh to OS reinstallations. So even if you wipe your drive 2144.68s - 2148.92s | it's still gonna be around. Um and even if you try to push a firmware update from the 2148.92s - 2153.36s | operating system it's still gonna be around because the uh the malware can just say well 2153.58s - 2160.32s | update was successful. Um and the only way to really get rid of it at that point is to take 2160.32s - 2166.66s | apart your system, take a spy programmer to read out the spy flash, inspect it and if it's 2166.66s - 2173.76s | infected um just uh rewrite it. But typically it's not really in the repertoire of a typical 2173.76s - 2179.50s | IT guy right? So to illustrate how prevalent actually these misconfigurations are we did 2179.52s - 2184.16s | some research last year on that and we saw that the majority of the systems have none of the 2184.16s - 2188.96s | security features actually enabled. Which means all the systems which have none of the 2188.96s - 2194.44s | features enabled are vulnerable to firmware implants. Which is pretty bad. And to put a cherry 2194.44s - 2199.20s | on top we also found that once you're infected with that kind of uh firmware implant you can 2199.20s - 2204.18s | even disable platform secure boot forever by burning a specific fuse so that your system 2204.20s - 2209.20s | remains vulnerable to firmware uh implant reinfections forever. Sweet. So let's wrap up the 2212.14s - 2220.12s | presentation. Thanks Christoph. So yeah in terms of affected systems right? Pretty much all of 2224.20s - 2229.20s | them. Uh yeah um our tests were on Ryzen mostly, several laptops uh but turns out the Threat 2229.36s - 2234.36s | Reaper series is also affected, Epic series is also affected meaning servers. Um and yeah uh due 2242.90s - 2247.90s | to the longevity of this this this thing we can estimate the total number of affected chips 2251.24s - 2256.24s | are in around the hundreds of millions. Um there's an advisory from AMD published now um 2259.42s - 2265.92s | where more information on the system,


chunk_id: 133_chunk_40
chunk_text:
all the systems which have none of the 2188.96s - 2194.44s | features enabled are vulnerable to firmware implants. Which is pretty bad. And to put a cherry 2194.44s - 2199.20s | on top we also found that once you're infected with that kind of uh firmware implant you can 2199.20s - 2204.18s | even disable platform secure boot forever by burning a specific fuse so that your system 2204.20s - 2209.20s | remains vulnerable to firmware uh implant reinfections forever. Sweet. So let's wrap up the 2212.14s - 2220.12s | presentation. Thanks Christoph. So yeah in terms of affected systems right? Pretty much all of 2224.20s - 2229.20s | them. Uh yeah um our tests were on Ryzen mostly, several laptops uh but turns out the Threat 2229.36s - 2234.36s | Reaper series is also affected, Epic series is also affected meaning servers. Um and yeah uh due 2242.90s - 2247.90s | to the longevity of this this this thing we can estimate the total number of affected chips 2251.24s - 2256.24s | are in around the hundreds of millions. Um there's an advisory from AMD published now um 2259.42s - 2265.92s | where more information on the system, the affected systems and cover uh there's a microcode 2265.92s - 2270.92s | update now. Information is there and so you can check. Mitigations. Yeah AMD as I just said 2275.06s - 2281.56s | provided um with microcode updates. However it might not cover all of the affected systems of 2281.56s - 2286.58s | course. Um in terms of what an OEM can do, they can just modify the SMM entry point code and 2289.44s - 2295.92s | to detect if the T-close bit is set. And if it is then just abort the execution and this this 2295.92s - 2302.62s | will just render the exploitation unfeasible. Uh this can even be done at the EDK 2 level for 2302.62s - 2307.62s | AMD system right? And we really haven't covered here core boot but core boot is affected in 2311.00s - 2315.84s | the same way. We just I mean um core boot does the very beginning of the entry point performs 2315.84s - 2322.42s | a low GDT. They have to go to protected mode as well so it's it's the same thing. Um and 2322.42s - 2326.76s | actually core boot they are checking for this


chunk_id: 133_chunk_41
chunk_text:
the affected systems and cover uh there's a microcode 2265.92s - 2270.92s | update now. Information is there and so you can check. Mitigations. Yeah AMD as I just said 2275.06s - 2281.56s | provided um with microcode updates. However it might not cover all of the affected systems of 2281.56s - 2286.58s | course. Um in terms of what an OEM can do, they can just modify the SMM entry point code and 2289.44s - 2295.92s | to detect if the T-close bit is set. And if it is then just abort the execution and this this 2295.92s - 2302.62s | will just render the exploitation unfeasible. Uh this can even be done at the EDK 2 level for 2302.62s - 2307.62s | AMD system right? And we really haven't covered here core boot but core boot is affected in 2311.00s - 2315.84s | the same way. We just I mean um core boot does the very beginning of the entry point performs 2315.84s - 2322.42s | a low GDT. They have to go to protected mode as well so it's it's the same thing. Um and 2322.42s - 2326.76s | actually core boot they are checking for this uh for for other issues as well at the entry 2326.76s - 2331.76s | point so they could they could very well do this. Um and users well they can you know a 2334.56s - 2339.56s | hypervisor could trap the access on the TSEC mask MSR so that's another uh way to stop this. 2340.06s - 2345.06s | Timeline wise well we reported this back in October of 2023. A CVE of 2023 uh 3.1.3.15 was 2350.64s - 2355.28s | assigned in November. And then we discussed mitigations and impact with AMD over the course 2355.28s - 2361.18s | of the next months. Um and yeah finally yesterday um the advisory was published and we are 2361.18s - 2366.18s | here at DEF CON today. This was the official AMD response. Essentially we work with them in a 2370.12s - 2378.24s | process of uh responsible disclosure. And yeah they've been great to work with. Conclusions 2378.24s - 2384.54s | and takeaways. Well the vulnerability has been around for nearly two decades. Um the 2384.54s - 2389.82s | complexity of the architecture clearly plays in favor of attackers and we see this uh with 2389.82s - 2396.20s | the


chunk_id: 133_chunk_42
chunk_text:
uh for for other issues as well at the entry 2326.76s - 2331.76s | point so they could they could very well do this. Um and users well they can you know a 2334.56s - 2339.56s | hypervisor could trap the access on the TSEC mask MSR so that's another uh way to stop this. 2340.06s - 2345.06s | Timeline wise well we reported this back in October of 2023. A CVE of 2023 uh 3.1.3.15 was 2350.64s - 2355.28s | assigned in November. And then we discussed mitigations and impact with AMD over the course 2355.28s - 2361.18s | of the next months. Um and yeah finally yesterday um the advisory was published and we are 2361.18s - 2366.18s | here at DEF CON today. This was the official AMD response. Essentially we work with them in a 2370.12s - 2378.24s | process of uh responsible disclosure. And yeah they've been great to work with. Conclusions 2378.24s - 2384.54s | and takeaways. Well the vulnerability has been around for nearly two decades. Um the 2384.54s - 2389.82s | complexity of the architecture clearly plays in favor of attackers and we see this uh with 2389.82s - 2396.20s | the flexibility of of of the GDT. Um the two types of wraparounds, the the the byte level 2397.06s - 2402.06s | uh um address um like granularity that there is with it, no problem. Um and also with the how 2405.34s - 2411.40s | the MSRs can be accessed without any restriction. Uh that that's that's all good for attackers 2411.40s - 2416.42s | right? Um these things combined are what made this exploit approach possible. It might be 2417.42s - 2422.42s | on other exploit methods too. Um but yeah all of this of of course requires an in depth 2426.66s - 2431.46s | understanding of the architecture. And in the end we managed to exploit this without 2431.46s - 2437.00s | requiring physical presence. So that's very good. And yeah, exploit code will be released 2437.00s - 2441.90s | soon. So stay tuned for that. Questions? 2442.90s - 2456.31s | What is the question up there? Is there a microphone? Okay. Oh there's Christoph. 2462.18s - 2467.18s | Uh uh hello. Um it wasn't entirely clear to me. Is the spyflash chip you're referring to on 2470.76s - 2475.76s | the uh CPU die or is it external?


