# MediaChunks

chunk_text:
  big problem, but it actually has a small reach. Then I looked to see what our penetration testers are actually exploiting in the wild. Not in the wild, penetration testers. And actually, we only exploited that vulnerability once. And it made me very curious about this idea of what we're being told we should run away from compared to what we're really advising, sorry, what we really should be running away from, you know, where the line really is, compared to what we're telling our clients they should be concerned about, particularly through these scanning and penetration testing services. And that reminded me, oops, this doesn't actually work. That reminded me of a presentation from 2011, 44Con in London, by a guy called Harun Mir. Some of you may know him as an old friend of mine. We love each other very much. We also argue very much. And Harun did this presentation saying, penetration testing is considered harmful. We're actually doing ourselves a disservice. I recommend that you have a look at it. It's a very interesting topic, and I wish I could comment more. I disagreed with him, of course, on a lot of things. I was a penetration tester myself. But one of the points he makes is that when we do penetration testing, we're not actually emulating what a real adversary is doing in the wild. We're not acting like the real lion. We're just acting like the other penetration testers. And so all of these ideas sort of started to bumble up in my mind, and I conceived an experiment, a thought experiment. But before I tell you about that, let me just tell you quickly about myself. My name is Charles, Charles van der Valk. As I said to you, I'm a South African. I live in Cape Town, and I work for Orange Cyber Defense. I spent about 15 years of my life as a penetration tester, running penetration testing teams. I also ran a vulnerability scanning team. But I now act as the head for security research at Orange Cyber Defense, where it's my job to ask and answer exactly these kinds of questions. I have a very luxurious job. So the experiment that I conceived looks a little bit like this. I said to myself, well, how can we know which vulnerabilities are actually being exploited in the wild? And it


chunk_text:
  penetration tester myself. But one of the points he makes is that when we do penetration testing, we're not actually emulating what a real adversary is doing in the wild. We're not acting like the real lion. We're just acting like the other penetration testers. And so all of these ideas sort of started to bumble up in my mind, and I conceived an experiment, a thought experiment. But before I tell you about that, let me just tell you quickly about myself. My name is Charles, Charles van der Valk. As I said to you, I'm a South African. I live in Cape Town, and I work for Orange Cyber Defense. I spent about 15 years of my life as a penetration tester, running penetration testing teams. I also ran a vulnerability scanning team. But I now act as the head for security research at Orange Cyber Defense, where it's my job to ask and answer exactly these kinds of questions. I have a very luxurious job. So the experiment that I conceived looks a little bit like this. I said to myself, well, how can we know which vulnerabilities are actually being exploited in the wild? And it turns out there's three datasets that we can look at. We can look at something called the KEV, or the KEV, which stands for the Known Exploited Vulnerabilities List Catalog. And it's a list produced by the American CISA agency to advise American government agencies which vulnerabilities are actively being exploited in the wild. There's currently 860 vulnerabilities on that list. Then we can look at something that was published by Avanti called the Ransomware Top 10, which is a list of vulnerabilities that they report are actually being used by ransomware actors. And then finally, we can look at the EPSS, the Exploit Prediction Scoring System, which is a project of the first organization which attempts to predict, and apparently does so with some accuracy, which vulnerabilities are actually being exploited in the wild. So we have a reasonably good dataset about what we're being told is actually happening out there. Then I can look at our scanning data and try and determine which of these vulnerabilities actually exist on our customers' estates. So is there a match between what's being exploited in the wild and what our customers are likely to be vulnerable to? And then finally, I


chunk_text:
  turns out there's three datasets that we can look at. We can look at something called the KEV, or the KEV, which stands for the Known Exploited Vulnerabilities List Catalog. And it's a list produced by the American CISA agency to advise American government agencies which vulnerabilities are actively being exploited in the wild. There's currently 860 vulnerabilities on that list. Then we can look at something that was published by Avanti called the Ransomware Top 10, which is a list of vulnerabilities that they report are actually being used by ransomware actors. And then finally, we can look at the EPSS, the Exploit Prediction Scoring System, which is a project of the first organization which attempts to predict, and apparently does so with some accuracy, which vulnerabilities are actually being exploited in the wild. So we have a reasonably good dataset about what we're being told is actually happening out there. Then I can look at our scanning data and try and determine which of these vulnerabilities actually exist on our customers' estates. So is there a match between what's being exploited in the wild and what our customers are likely to be vulnerable to? And then finally, I can look at the penetration testing data and try and determine, are we as penetration testers, when we're emulating adversaries in the wild, are we actually exploiting these vulnerabilities and reporting them to our customers? I'm going to check my time because I'm probably going to take much too long. Right, so I want to give you some background to this data. It's part of my story because I think it was quite an interesting exercise for us. The first dataset that I have is from our vulnerability scanning services. So we offer, like many businesses, a managed vulnerability scanning service. We use a platform called Nucleus as a kind of vulnerability aggregator. So it doesn't matter what scanner we're using, we can kind of normalize these findings, collect them all in one place, and then collect information about them. So what we did is as follows. We have various scanners, Qualys, Rapid7. There are actually a few others, but those are the dominant ones. The findings from those scanners get aggregated into Nucleus. And then what we do is the operational team, so the scanning team, we call them the VOC, Vulnerability Operating Center. They anonymize the customer. So


chunk_text:
  can look at the penetration testing data and try and determine, are we as penetration testers, when we're emulating adversaries in the wild, are we actually exploiting these vulnerabilities and reporting them to our customers? I'm going to check my time because I'm probably going to take much too long. Right, so I want to give you some background to this data. It's part of my story because I think it was quite an interesting exercise for us. The first dataset that I have is from our vulnerability scanning services. So we offer, like many businesses, a managed vulnerability scanning service. We use a platform called Nucleus as a kind of vulnerability aggregator. So it doesn't matter what scanner we're using, we can kind of normalize these findings, collect them all in one place, and then collect information about them. So what we did is as follows. We have various scanners, Qualys, Rapid7. There are actually a few others, but those are the dominant ones. The findings from those scanners get aggregated into Nucleus. And then what we do is the operational team, so the scanning team, we call them the VOC, Vulnerability Operating Center. They anonymize the customer. So they mask the customer name, the business unit, IP addresses, anything that we might be able to identify from the customer. We do the same with customer information from the CRM, and then we can link those things back up together again so that we can get demographic information, so how big is the customer, what industry, what size are they in, et cetera. And we pull those all into a database, and for this experiment, we looked at just under 3 million findings on hosts. That ends up then in just one big table, which is really simple. You can see we've got an organization, an industry, country, employee size. Then things like asset name and IP address, as I said, are hashed. And then OS finding port, finding description, all the way down. It's a very simple single table that we can now model to find information about what are we actually reporting to our customers. And then on the other hand, we have penetration testing reports. Now, penetration testing reports, I don't know how it is in your organization, but really the golden standard for penetration testing reports is a Word document that's lying on someone's desk


chunk_text:
  they mask the customer name, the business unit, IP addresses, anything that we might be able to identify from the customer. We do the same with customer information from the CRM, and then we can link those things back up together again so that we can get demographic information, so how big is the customer, what industry, what size are they in, et cetera. And we pull those all into a database, and for this experiment, we looked at just under 3 million findings on hosts. That ends up then in just one big table, which is really simple. You can see we've got an organization, an industry, country, employee size. Then things like asset name and IP address, as I said, are hashed. And then OS finding port, finding description, all the way down. It's a very simple single table that we can now model to find information about what are we actually reporting to our customers. And then on the other hand, we have penetration testing reports. Now, penetration testing reports, I don't know how it is in your organization, but really the golden standard for penetration testing reports is a Word document that's lying on someone's desk somewhere. You'd think that we're aggregating all this data in a beautiful way, but we're not. It's all in Word reports. Those Word reports have a template, so we can sort of group them together by template and then start trying to extract usable information from them. And the way we do it is as follows. We take the Word documents. Then we use some Python to unzip them and parse the XML, and we try and extract the actual finding information from that template into an XML file, which then consists of the details of the report, who was it for, how long did it take, et cetera, and also the findings, what was reported and with what severity. Then we run an NLP capability called Spacey from Python to do what we call natural entity recognition. So can I pull out of that data things like a name of an operating system, a description of an exploit, and for us, most importantly for this exercise, a CVE. And it turns out this NER, I don't know if you've played with it at all, it's fascinatingly good. It can really do some amazing things. But there's something that it's


chunk_text:
  somewhere. You'd think that we're aggregating all this data in a beautiful way, but we're not. It's all in Word reports. Those Word reports have a template, so we can sort of group them together by template and then start trying to extract usable information from them. And the way we do it is as follows. We take the Word documents. Then we use some Python to unzip them and parse the XML, and we try and extract the actual finding information from that template into an XML file, which then consists of the details of the report, who was it for, how long did it take, et cetera, and also the findings, what was reported and with what severity. Then we run an NLP capability called Spacey from Python to do what we call natural entity recognition. So can I pull out of that data things like a name of an operating system, a description of an exploit, and for us, most importantly for this exercise, a CVE. And it turns out this NER, I don't know if you've played with it at all, it's fascinatingly good. It can really do some amazing things. But there's something that it's really bad at also. We want to know if the pen tester exploited a given application. If the application contains the customer's name, the NER will pull that out also. My team's not allowed to see that, so the pen testers have to spend a lot of time cleaning that sort of nonsense out so that we're not exposing things like customer names. And then we do the same trick where we hash the customer name on one hand, we hash it out of the CRM on the other, and we can pull that into a database. And for this experiment, we pulled out just under 1,500 penetration testing reports to analyze over a period of time. And that goes into a slightly more complex structure where we have descriptions of the project, descriptions of the finding, and then the NER findings are pulled out in a table of their own, and we can link that all together to get a sense of, you know, what are our penetration testers actually doing for clients. And the NER you'll see is able to identify a whole bunch of different kinds of things, application names, version names, vendor names, et cetera. And


chunk_text:
  really bad at also. We want to know if the pen tester exploited a given application. If the application contains the customer's name, the NER will pull that out also. My team's not allowed to see that, so the pen testers have to spend a lot of time cleaning that sort of nonsense out so that we're not exposing things like customer names. And then we do the same trick where we hash the customer name on one hand, we hash it out of the CRM on the other, and we can pull that into a database. And for this experiment, we pulled out just under 1,500 penetration testing reports to analyze over a period of time. And that goes into a slightly more complex structure where we have descriptions of the project, descriptions of the finding, and then the NER findings are pulled out in a table of their own, and we can link that all together to get a sense of, you know, what are our penetration testers actually doing for clients. And the NER you'll see is able to identify a whole bunch of different kinds of things, application names, version names, vendor names, et cetera. And for the purposes of today's presentation, it's able to identify with some accuracy CVEs in the data. And surprisingly, in the 1,500 reports, there's only 57 unique CVEs that were referenced specifically by pen testers in the data. So I want to give you just a little bit of background so you understand the datasets that we're looking at. As I said, in the scanning data, that's VAC, Vulnerability Operating Center, we're looking at 41,000 hosts, and there's a reasonable spread of those hosts across industries and business sizes. There's a little bit of a weighting towards manufacturing, which I found surprising. And obviously, some industries are more represented than others, but I think it's fair to say that we have a reasonable representation across different industries, right? So no massive bias there. Similarly, for business size, you'll see there's a reasonable distribution of business sizes, mainly very big or very small, but it's reasonably representative. And then just some background in terms of the things that we find. So if we look at confirmed findings per host, what we see, I'll come back to this later, is that there's about 18 or 19 findings per host, and they're distributed


chunk_text:
  for the purposes of today's presentation, it's able to identify with some accuracy CVEs in the data. And surprisingly, in the 1,500 reports, there's only 57 unique CVEs that were referenced specifically by pen testers in the data. So I want to give you just a little bit of background so you understand the datasets that we're looking at. As I said, in the scanning data, that's VAC, Vulnerability Operating Center, we're looking at 41,000 hosts, and there's a reasonable spread of those hosts across industries and business sizes. There's a little bit of a weighting towards manufacturing, which I found surprising. And obviously, some industries are more represented than others, but I think it's fair to say that we have a reasonable representation across different industries, right? So no massive bias there. Similarly, for business size, you'll see there's a reasonable distribution of business sizes, mainly very big or very small, but it's reasonably representative. And then just some background in terms of the things that we find. So if we look at confirmed findings per host, what we see, I'll come back to this later, is that there's about 18 or 19 findings per host, and they're distributed like this. To my surprise, not that many of those findings are low. The bulk are always medium. It seems like we gravitate towards the middle with our risk assessments. But there's also a significant number of what I call serious findings, so highs and criticals, so about six highs per host on average. And just under two highs per host on – or criticals per host on average. And then in terms of the time that it takes to fix them, this chart shows a distribution of the age of the vulnerability. So how long from the first time that we saw it until the last time that we saw it across all the 2 million, 3 million vulnerabilities in the database. And you'll see that the bulk of it sits around here. This is zero. So these ones are brand new. They haven't been addressed. Then we get a sort of peak here at around 175. Another peak here at around 300 days. And then this odd peak here is what I call the long tail. Those are vulnerabilities just simply never – they never get patched, right? And the bulk of those are mediums for some reason.


chunk_text:
  like this. To my surprise, not that many of those findings are low. The bulk are always medium. It seems like we gravitate towards the middle with our risk assessments. But there's also a significant number of what I call serious findings, so highs and criticals, so about six highs per host on average. And just under two highs per host on – or criticals per host on average. And then in terms of the time that it takes to fix them, this chart shows a distribution of the age of the vulnerability. So how long from the first time that we saw it until the last time that we saw it across all the 2 million, 3 million vulnerabilities in the database. And you'll see that the bulk of it sits around here. This is zero. So these ones are brand new. They haven't been addressed. Then we get a sort of peak here at around 175. Another peak here at around 300 days. And then this odd peak here is what I call the long tail. Those are vulnerabilities just simply never – they never get patched, right? And the bulk of those are mediums for some reason. But what we see is that about 28% of the vulnerabilities get addressed in under 30 days. About 72% take between 30 days or more. 52% in more than 90 days. And on average it's 215 days to remediate a vulnerability. Now bear in mind these are clients who are paying us to perform a vulnerability management service for them so that you can assume a certain level of maturity. But still, that's how long it's taking us to deal with vulnerabilities. Now you would think that critical vulnerabilities get more attention. And that turns out to be true. They do get about 35% more attention. So they're resolved about 35% quicker than low vulnerabilities you can see over there. But that's still over six months on average for a critical vulnerability to be resolved by someone who's paying us to tell them about that vulnerability. So it's all kind of slightly disconcerting information, I think. If we look at the penetration testing data, of course, here I can't look at time to fix because we don't have the same repetitivity and I can't look at findings per host. But I can get some other insight. As I said, just


chunk_text:
  But what we see is that about 28% of the vulnerabilities get addressed in under 30 days. About 72% take between 30 days or more. 52% in more than 90 days. And on average it's 215 days to remediate a vulnerability. Now bear in mind these are clients who are paying us to perform a vulnerability management service for them so that you can assume a certain level of maturity. But still, that's how long it's taking us to deal with vulnerabilities. Now you would think that critical vulnerabilities get more attention. And that turns out to be true. They do get about 35% more attention. So they're resolved about 35% quicker than low vulnerabilities you can see over there. But that's still over six months on average for a critical vulnerability to be resolved by someone who's paying us to tell them about that vulnerability. So it's all kind of slightly disconcerting information, I think. If we look at the penetration testing data, of course, here I can't look at time to fix because we don't have the same repetitivity and I can't look at findings per host. But I can get some other insight. As I said, just under 1,500 tests. Again, we have a leaning towards finance and insurance that tends to be the bulk of our client base, I guess. But a reasonable distribution across all industries in this data. Similarly, a reasonable distribution across business sizes with the bulk being big businesses. That's at 47% over there. But other business sizes also represented in this data set. Also a variety of different test types. We ended up normalizing on this subset of tests, web applications, external assessments, internal, some applications, some mobile platform assessments, some red teaming, which is kind of gloves-off, target-oriented testing as opposed to kind of pre-scoped testing. With the bulk being web applications followed by externals and then internals. And this is what we see. So what we did here was to develop a metric that we call CVSS per day. So we want to normalize because some pen tests are short, some pen tests are long, some have one tester, some have two testers. So this metric, what we simply do is we add up the CVSS score, which is the risk rating score assigned to each finding. We add them all up and we divide it by the number


chunk_text:
  under 1,500 tests. Again, we have a leaning towards finance and insurance that tends to be the bulk of our client base, I guess. But a reasonable distribution across all industries in this data. Similarly, a reasonable distribution across business sizes with the bulk being big businesses. That's at 47% over there. But other business sizes also represented in this data set. Also a variety of different test types. We ended up normalizing on this subset of tests, web applications, external assessments, internal, some applications, some mobile platform assessments, some red teaming, which is kind of gloves-off, target-oriented testing as opposed to kind of pre-scoped testing. With the bulk being web applications followed by externals and then internals. And this is what we see. So what we did here was to develop a metric that we call CVSS per day. So we want to normalize because some pen tests are short, some pen tests are long, some have one tester, some have two testers. So this metric, what we simply do is we add up the CVSS score, which is the risk rating score assigned to each finding. We add them all up and we divide it by the number of man days spent on that test. So that gives us a normalized way to compare tests with each other. And what we see there is that unsurprisingly the highest level of findings is when the test is already inside, right? Connected to the internal network. They were looking at just under eight CVSS points per day of testing. And that goes all the way down surprisingly to red teaming where we report just over two CVSS points per testing. But if you looked at the distribution of findings across these different test types, you'd see that in the red teaming, we tend to have very high severity findings, just a low number. And with web apps and externals, we tend to have mostly medium severity findings. All right, this is all just background. In terms of the severity between the two services, we see that in both cases, most of the findings are mediums. In scanning, it's slightly more mediums than in pen tests. But then there's still a high proportion of critical, so 10% for scanning and 3.5% for pen testing. And the sense that you get is that the pen testers are more deliberate, more considered in


chunk_text:
  of man days spent on that test. So that gives us a normalized way to compare tests with each other. And what we see there is that unsurprisingly the highest level of findings is when the test is already inside, right? Connected to the internal network. They were looking at just under eight CVSS points per day of testing. And that goes all the way down surprisingly to red teaming where we report just over two CVSS points per testing. But if you looked at the distribution of findings across these different test types, you'd see that in the red teaming, we tend to have very high severity findings, just a low number. And with web apps and externals, we tend to have mostly medium severity findings. All right, this is all just background. In terms of the severity between the two services, we see that in both cases, most of the findings are mediums. In scanning, it's slightly more mediums than in pen tests. But then there's still a high proportion of critical, so 10% for scanning and 3.5% for pen testing. And the sense that you get is that the pen testers are more deliberate, more considered in the assessment of risk ratings, right? Whereas the scanner will blindly assign a very high risk rating, the pen tester will moderate that risk rating, I suppose, with more temporal and localized context. But still, 46% of assets of findings from the scanners would be high or critical, and from the pen testers, 22% of findings would be high or critical. I also thought it very interesting to compare the distribution of CVSS scores assigned across the two kinds of assessment. Here, the green line represents CVSS scores assigned by pen testers, and the purple line, CVSS scores assigned by scanners. Interestingly, the pen testers will sometimes assign a CVSS score of zero, whereas the scanner will never do it. That stands to reason because we extracted the informational findings out. And then you see this peak in both cases around four and five. So that's where all the mediums are being reported. The majority of findings in both cases are mediums, but the pen testers are reporting more mediums than the scanners. And then towards the end here, you see the pen testers very seldom actually report high-criticality findings. As I said, I think there's more consideration, more thought


chunk_text:
  the assessment of risk ratings, right? Whereas the scanner will blindly assign a very high risk rating, the pen tester will moderate that risk rating, I suppose, with more temporal and localized context. But still, 46% of assets of findings from the scanners would be high or critical, and from the pen testers, 22% of findings would be high or critical. I also thought it very interesting to compare the distribution of CVSS scores assigned across the two kinds of assessment. Here, the green line represents CVSS scores assigned by pen testers, and the purple line, CVSS scores assigned by scanners. Interestingly, the pen testers will sometimes assign a CVSS score of zero, whereas the scanner will never do it. That stands to reason because we extracted the informational findings out. And then you see this peak in both cases around four and five. So that's where all the mediums are being reported. The majority of findings in both cases are mediums, but the pen testers are reporting more mediums than the scanners. And then towards the end here, you see the pen testers very seldom actually report high-criticality findings. As I said, I think there's more consideration, more thought goes into the severity assigned to a finding, whereas the scanner keeps going up at the end. But in the end, the shapes are actually very similar if you look at them. It seems like there's a similar distribution of risk ratings across findings for both types of services, one produced by a scanner and one produced manually by a tester. Also thought it interesting to look at the age of the vulnerabilities. So this is not how long it took to patch, but how long the vulnerability has actually been known about. And I found this pretty staggering. So you'll see there's a significant number of vulnerabilities over here that are over five years old, reported by both the scanners and the pen testers. And I find that extraordinary that somebody pays a pen tester to come in and test, and they have vulnerabilities on their systems that have existed since 2015, 2010 even. So 47% of the CVEs reported across both services are more than five years old, and about half a percent are more than 20 years old. So fortunately we're not seeing pen testers reporting those, but the vulnerability scanner is reporting vulnerabilities dating all the


chunk_text:
  goes into the severity assigned to a finding, whereas the scanner keeps going up at the end. But in the end, the shapes are actually very similar if you look at them. It seems like there's a similar distribution of risk ratings across findings for both types of services, one produced by a scanner and one produced manually by a tester. Also thought it interesting to look at the age of the vulnerabilities. So this is not how long it took to patch, but how long the vulnerability has actually been known about. And I found this pretty staggering. So you'll see there's a significant number of vulnerabilities over here that are over five years old, reported by both the scanners and the pen testers. And I find that extraordinary that somebody pays a pen tester to come in and test, and they have vulnerabilities on their systems that have existed since 2015, 2010 even. So 47% of the CVEs reported across both services are more than five years old, and about half a percent are more than 20 years old. So fortunately we're not seeing pen testers reporting those, but the vulnerability scanner is reporting vulnerabilities dating all the way back to 1999, which also gives you cause to think a little bit about what we're really doing. All right. But I want to get to the main question. The main question is, are we reporting vulnerabilities that are actually being exploited in the wild? And the first data set that I mentioned to you is that we can look at this Ivanti Ransomware top 10 data set. So this is a report that's published by CSW, Securin, Cyware, and Ivanti, and it gives an analysis of vulnerabilities that are actually used by ransomware threat actors in the wild. Now they don't disclose how they get those vulnerabilities, so this data set is a little bit difficult for me to make sense of, but they publish a top 10 most exploited vulnerabilities used by ransomware threat actors. And the question would be, are we seeing those vulnerabilities amongst our clients? So what you're going to see now is I'm going to repeatedly show you two graphs. I'm going to show you vulnerabilities across a percentage of our clients, so at what proportion of our clients are we seeing this vulnerability, and then at a proportion of our assets. So


chunk_text:
  way back to 1999, which also gives you cause to think a little bit about what we're really doing. All right. But I want to get to the main question. The main question is, are we reporting vulnerabilities that are actually being exploited in the wild? And the first data set that I mentioned to you is that we can look at this Ivanti Ransomware top 10 data set. So this is a report that's published by CSW, Securin, Cyware, and Ivanti, and it gives an analysis of vulnerabilities that are actually used by ransomware threat actors in the wild. Now they don't disclose how they get those vulnerabilities, so this data set is a little bit difficult for me to make sense of, but they publish a top 10 most exploited vulnerabilities used by ransomware threat actors. And the question would be, are we seeing those vulnerabilities amongst our clients? So what you're going to see now is I'm going to repeatedly show you two graphs. I'm going to show you vulnerabilities across a percentage of our clients, so at what proportion of our clients are we seeing this vulnerability, and then at a proportion of our assets. So you're talking kind of breadth and depth, I guess, is going to be the two charts. So we see that of the ransomware top 10, we only ever see half of the top 10 ransomware most exploited vulnerabilities. The other five never appear anywhere in our data. The one we see the most at just under 18%, at 17% of our clients, actually, is log4j. So log4j appears at about 17% of our clients where we do scanning, and then it goes down from there. And then, of course, if you look at the distribution across assets, it's going to look different. Log4j doesn't appear on a lot of assets, right? It's not hugely deployed on our customer estates, but it is deployed at a lot of customers. Just out of interest what those vulnerabilities are, I'm not a pen tester anymore, so I'm a little uncomfortable with all these CVE numbers. I'm looking at the percentages, really. But that one, not log4j, is a Microsoft Office remote code execution vulnerability. So that's the sort of thing you would exploit using a phishing attack or a water-holing attack, right? It's not something you would exploit over the network. And that


chunk_text:
  you're talking kind of breadth and depth, I guess, is going to be the two charts. So we see that of the ransomware top 10, we only ever see half of the top 10 ransomware most exploited vulnerabilities. The other five never appear anywhere in our data. The one we see the most at just under 18%, at 17% of our clients, actually, is log4j. So log4j appears at about 17% of our clients where we do scanning, and then it goes down from there. And then, of course, if you look at the distribution across assets, it's going to look different. Log4j doesn't appear on a lot of assets, right? It's not hugely deployed on our customer estates, but it is deployed at a lot of customers. Just out of interest what those vulnerabilities are, I'm not a pen tester anymore, so I'm a little uncomfortable with all these CVE numbers. I'm looking at the percentages, really. But that one, not log4j, is a Microsoft Office remote code execution vulnerability. So that's the sort of thing you would exploit using a phishing attack or a water-holing attack, right? It's not something you would exploit over the network. And that one, which is the most commonly seen across the assets, is an incident explorer memory corruption vulnerability, so also something that you would need a client-side exploit for, not something you're going to exploit over the network. Now, of those five vulnerabilities, how many did we report in our penetration tests? And the answer is exactly one. So exactly one of those ransomware top 10 was exploited by a pen tester over about a four-year period in that 1,500 pen tests that we looked at, and that was log4j. Log4j and log4j was exploited exactly once in one test. The next dataset we can look at is the KEV, the known exploited vulnerabilities, as I said, published by CISA. They also have their own internal processes. We don't know how they decide to add something to this list. But at the time that we did this work, there were about 860 vulnerabilities that were published on the KEV by CISA and are mandatory for U.S. government agencies to patch. There's a drive-down obligation on those agencies to patch these 860 vulnerabilities. Now, this is obviously a much bigger dataset than the 10 ransomware top 10, so we would expect to


chunk_text:
  one, which is the most commonly seen across the assets, is an incident explorer memory corruption vulnerability, so also something that you would need a client-side exploit for, not something you're going to exploit over the network. Now, of those five vulnerabilities, how many did we report in our penetration tests? And the answer is exactly one. So exactly one of those ransomware top 10 was exploited by a pen tester over about a four-year period in that 1,500 pen tests that we looked at, and that was log4j. Log4j and log4j was exploited exactly once in one test. The next dataset we can look at is the KEV, the known exploited vulnerabilities, as I said, published by CISA. They also have their own internal processes. We don't know how they decide to add something to this list. But at the time that we did this work, there were about 860 vulnerabilities that were published on the KEV by CISA and are mandatory for U.S. government agencies to patch. There's a drive-down obligation on those agencies to patch these 860 vulnerabilities. Now, this is obviously a much bigger dataset than the 10 ransomware top 10, so we would expect to see them more. And, indeed, we do. This is kind of how it looks if I look at a distribution of those KEV vulnerabilities across a distribution of our customers. So we have to think of two proportions over here. I'll try and explain it to you from here. So 52% of the KEV, just over half of those 860 vulnerabilities, are never seen anywhere at any client. 42,000 assets, we don't see half of the KEV anywhere. And then it drops down. We see about 6.5% of the KEV at 2% of our clients, 5% of the KEV at 5% of our clients. And then there's this peak over here where we see about 14% of the KEV at about 15% of our clients. And those are mostly Microsoft desktop vulnerabilities. So it's to be expected, right? It's a very, very commonly deployed software, very widely in use, also being exported in the wild, and we are seeing it at about 15% of our clients. And then the number drops down, and there's some vulnerability, basically, probably one vulnerability in the KEV that's seen at about 44% of our customers. We'll look at what that is now. If we


chunk_text:
  see them more. And, indeed, we do. This is kind of how it looks if I look at a distribution of those KEV vulnerabilities across a distribution of our customers. So we have to think of two proportions over here. I'll try and explain it to you from here. So 52% of the KEV, just over half of those 860 vulnerabilities, are never seen anywhere at any client. 42,000 assets, we don't see half of the KEV anywhere. And then it drops down. We see about 6.5% of the KEV at 2% of our clients, 5% of the KEV at 5% of our clients. And then there's this peak over here where we see about 14% of the KEV at about 15% of our clients. And those are mostly Microsoft desktop vulnerabilities. So it's to be expected, right? It's a very, very commonly deployed software, very widely in use, also being exported in the wild, and we are seeing it at about 15% of our clients. And then the number drops down, and there's some vulnerability, basically, probably one vulnerability in the KEV that's seen at about 44% of our customers. We'll look at what that is now. If we look at what those vulnerabilities actually are, you'll see there's… I just took the top 10 here, by the way, or the top 20. I can't remember. It's not all of them. The list is much longer, obviously. But there we see log4j again at the top of the list there in terms of the number of clients that are impacted by it. And if we look at the most commonly reported vulnerability, it's a Apache mod proxy vulnerability that allows unauthorized redirect into an internal network. So not a remote code execution, but something that would allow you to bypass a firewall or something, for example. In terms of distribution on assets, this one is something, a vulnerability in Next.js that allows for a redirect from an untrusted domain, from a trusted domain to an untrusted domain. Again, something that you would use in a phishing attack, for example. So not very sexy vulnerabilities, not the sort of things that you'd kind of want to sink your teeth into and get all excited about. But the point being from this graph is that we do see, if I just go back, we do see a significant number of vulnerabilities,


chunk_text:
  look at what those vulnerabilities actually are, you'll see there's… I just took the top 10 here, by the way, or the top 20. I can't remember. It's not all of them. The list is much longer, obviously. But there we see log4j again at the top of the list there in terms of the number of clients that are impacted by it. And if we look at the most commonly reported vulnerability, it's a Apache mod proxy vulnerability that allows unauthorized redirect into an internal network. So not a remote code execution, but something that would allow you to bypass a firewall or something, for example. In terms of distribution on assets, this one is something, a vulnerability in Next.js that allows for a redirect from an untrusted domain, from a trusted domain to an untrusted domain. Again, something that you would use in a phishing attack, for example. So not very sexy vulnerabilities, not the sort of things that you'd kind of want to sink your teeth into and get all excited about. But the point being from this graph is that we do see, if I just go back, we do see a significant number of vulnerabilities, 48% of the cave somewhere on our customer estate. And so the question is, which of those are we testing, are we reporting on our penetration tests? And in fact, we've only reported one, two, three, four, five, six, seven of those 860 vulnerabilities in penetration tests at our clients. So a massive, if you like, disconnect from the 860 down to just seven. One of which, again, is, of course, log4j. And this one, which is the one that's used the most frequently, but still at less than 3% of our clients, is a remote desktop services remote code execution. So unpatched Microsoft Remote Desktop, probably exposed onto the internet as being used to access the customer network by our penetration testers. And then finally, we can take a look at this EPSS model. And just out of interest, can I check how many people have engaged with EPSS as a scoring system? One. Really, are you guys being honest? This is like a French thing. It's not highly confidential. I don't think if you are. I'm surprised at how little we talk about this. So EPSS is a project by the first organization. It's an open source, not


chunk_text:
  48% of the cave somewhere on our customer estate. And so the question is, which of those are we testing, are we reporting on our penetration tests? And in fact, we've only reported one, two, three, four, five, six, seven of those 860 vulnerabilities in penetration tests at our clients. So a massive, if you like, disconnect from the 860 down to just seven. One of which, again, is, of course, log4j. And this one, which is the one that's used the most frequently, but still at less than 3% of our clients, is a remote desktop services remote code execution. So unpatched Microsoft Remote Desktop, probably exposed onto the internet as being used to access the customer network by our penetration testers. And then finally, we can take a look at this EPSS model. And just out of interest, can I check how many people have engaged with EPSS as a scoring system? One. Really, are you guys being honest? This is like a French thing. It's not highly confidential. I don't think if you are. I'm surprised at how little we talk about this. So EPSS is a project by the first organization. It's an open source, not an open source, but a free public benefit project that seeks to use machine learning to predict whether a given CVE will be exploited in the wild. And in the latest version of EPSS, which is now version 3, they've got a big cloud-based machine that does all the modeling. They look at about 1,400 and something different variables to make a prediction as to whether a given vulnerability is going to be exploited in the wild somewhere within the next 30 days. And their results are really quite astounding. Their predictions are almost perfect, right? Straight up the line. They've published a very nice white paper on how they do it. And really what they're trying to do is to allow you to make the distinction between the thousands and thousands of CVEs that exist and the exploited CVEs. And they've just recently published a paper on the effectiveness of their new model, which is version 3. And basically what they're looking at is how much effort in this comparison, how much effort would it take us to patch 82% of all exploited vulnerabilities, right? So if we wanted a coverage of 82%, how much work would we have


chunk_text:
  an open source, but a free public benefit project that seeks to use machine learning to predict whether a given CVE will be exploited in the wild. And in the latest version of EPSS, which is now version 3, they've got a big cloud-based machine that does all the modeling. They look at about 1,400 and something different variables to make a prediction as to whether a given vulnerability is going to be exploited in the wild somewhere within the next 30 days. And their results are really quite astounding. Their predictions are almost perfect, right? Straight up the line. They've published a very nice white paper on how they do it. And really what they're trying to do is to allow you to make the distinction between the thousands and thousands of CVEs that exist and the exploited CVEs. And they've just recently published a paper on the effectiveness of their new model, which is version 3. And basically what they're looking at is how much effort in this comparison, how much effort would it take us to patch 82% of all exploited vulnerabilities, right? So if we wanted a coverage of 82%, how much work would we have to do if we used CVSS as a guide or if we used EPSS as a guide? And if you're using CVSS as a guide and you want to cover 82% of all exploited vulnerabilities, then you would need to patch everything with a CVSS score of 7 or above, which means patching 58%, half of all published CVEs ever would have to be patched in your organization to deal with just 82% of the vulnerabilities that are actually being exploited in the wild, which means an efficiency of 3.9%. So only 4 out of every 100 vulnerabilities that you patch would ever actually run the risk of being exploited in the wild. EPSS version 3, on the other hand, at a threshold of above 0.88, which is a very low threshold, you would only have to patch 7.3% of all vulnerabilities to get to 80% of all exploited vulnerabilities, and that gives you an efficiency of 45%, right? So it's a much more efficient, much more accurate way of predicting what's actually being exploited in the wild. So we draw a report of all EPSS-rated vulnerabilities with a prediction score of higher than 0.03. Now, the reason we chose


chunk_text:
  to do if we used CVSS as a guide or if we used EPSS as a guide? And if you're using CVSS as a guide and you want to cover 82% of all exploited vulnerabilities, then you would need to patch everything with a CVSS score of 7 or above, which means patching 58%, half of all published CVEs ever would have to be patched in your organization to deal with just 82% of the vulnerabilities that are actually being exploited in the wild, which means an efficiency of 3.9%. So only 4 out of every 100 vulnerabilities that you patch would ever actually run the risk of being exploited in the wild. EPSS version 3, on the other hand, at a threshold of above 0.88, which is a very low threshold, you would only have to patch 7.3% of all vulnerabilities to get to 80% of all exploited vulnerabilities, and that gives you an efficiency of 45%, right? So it's a much more efficient, much more accurate way of predicting what's actually being exploited in the wild. So we draw a report of all EPSS-rated vulnerabilities with a prediction score of higher than 0.03. Now, the reason we chose that is because in their own analysis, they say you can get perfect coverage or optimal coverage from an efficiency score of 0.036, right? So we went a little further than that and we said, let's take 0.03, and we drew all the vulnerabilities that reached that rating level for the period that we also have scanning data, right? So we could see how many of these do we find in our scans. And indeed, we do find them. Again, 95% of those EPSS-rated vulnerabilities, there's about 155 vulnerabilities that meet that threshold for the period that we're looking at, 95% of them don't occur at any of our clients. But about 5% of them do. And this kind of shows the distribution, right? So 20% of those CVEs appear at 0.37% of our clients. It doesn't really matter. The point is we mostly don't see them, but we do see some of them. So everything under the curve over here are vulnerabilities with a very high probability of being exploited, extremely high probability of being exploited that are being reported at our customers on our customers' estates, right? We know that they're there. And the question, of course, then


chunk_text:
  that is because in their own analysis, they say you can get perfect coverage or optimal coverage from an efficiency score of 0.036, right? So we went a little further than that and we said, let's take 0.03, and we drew all the vulnerabilities that reached that rating level for the period that we also have scanning data, right? So we could see how many of these do we find in our scans. And indeed, we do find them. Again, 95% of those EPSS-rated vulnerabilities, there's about 155 vulnerabilities that meet that threshold for the period that we're looking at, 95% of them don't occur at any of our clients. But about 5% of them do. And this kind of shows the distribution, right? So 20% of those CVEs appear at 0.37% of our clients. It doesn't really matter. The point is we mostly don't see them, but we do see some of them. So everything under the curve over here are vulnerabilities with a very high probability of being exploited, extremely high probability of being exploited that are being reported at our customers on our customers' estates, right? We know that they're there. And the question, of course, then going back to my original thesis is, well, how many of these are our pen testers actually reporting to our clients? Sorry, these are the ones that they are. So there's an OpenSSL DDoS, which is kind of really odd, and then there's this Windows 10 HTTP server exploit. Those are the ones that we're seeing on our customers' estates. But as I said, the question really for us is, how many of them are our pen testers reporting? And the answer is an astounding zero. We couldn't find one of those vulnerabilities in a single pen test report that we gave to our clients. Now, I'm not saying that's right or wrong or good or bad. I'm not a pen tester anymore. I'm a researcher. But I did find it quite astounding. And I thought it would be worth having a conversation with the security community to ask, like, does this make sense? If we're not reporting these vulnerabilities to our clients in pen tests, then are we telling them the right thing? I want to point out something else that occurred to me when I was looking at this data, which also sparks debate. So one of the


chunk_text:
  going back to my original thesis is, well, how many of these are our pen testers actually reporting to our clients? Sorry, these are the ones that they are. So there's an OpenSSL DDoS, which is kind of really odd, and then there's this Windows 10 HTTP server exploit. Those are the ones that we're seeing on our customers' estates. But as I said, the question really for us is, how many of them are our pen testers reporting? And the answer is an astounding zero. We couldn't find one of those vulnerabilities in a single pen test report that we gave to our clients. Now, I'm not saying that's right or wrong or good or bad. I'm not a pen tester anymore. I'm a researcher. But I did find it quite astounding. And I thought it would be worth having a conversation with the security community to ask, like, does this make sense? If we're not reporting these vulnerabilities to our clients in pen tests, then are we telling them the right thing? I want to point out something else that occurred to me when I was looking at this data, which also sparks debate. So one of the things that we did was to look at how much are we reporting to clients per day over time, right? Now, these graphs get a little bit sticky. But basically, when we went back as far as 2018, you'll see that the average CVSS reported per day, so a sense of how much are we saying to the client, in 2018, in the first quarter of 2018 was 5.5. By the time we get to the first quarter or the third quarter of 2022, that's when our data collection stopped, we're only reporting just over 4.5, just over 4. So there's this dramatic increase in the volume of things that we're saying to our customers. In fact, if I were to show you this graph for only new customers, so this includes businesses that are coming back again and again and again, if I only looked at businesses that came to us for the first time, you would see a 50% decrease in the volume and severity of findings that we're reporting to our clients. There's another perspective that we can use to look at the same data. I just wanted to draw your attention to this drop. Sorry, before


chunk_text:
  things that we did was to look at how much are we reporting to clients per day over time, right? Now, these graphs get a little bit sticky. But basically, when we went back as far as 2018, you'll see that the average CVSS reported per day, so a sense of how much are we saying to the client, in 2018, in the first quarter of 2018 was 5.5. By the time we get to the first quarter or the third quarter of 2022, that's when our data collection stopped, we're only reporting just over 4.5, just over 4. So there's this dramatic increase in the volume of things that we're saying to our customers. In fact, if I were to show you this graph for only new customers, so this includes businesses that are coming back again and again and again, if I only looked at businesses that came to us for the first time, you would see a 50% decrease in the volume and severity of findings that we're reporting to our clients. There's another perspective that we can use to look at the same data. I just wanted to draw your attention to this drop. Sorry, before I forget. So this is at the peak of the COVID lockdowns, right? I'm going to just draw your attention to this because we're going to come back to that in a moment. But this is another perspective on the same question, where we look at the ratio between serious and not serious findings in a report. So in 2018, in fact, here in Q4 of 2018, 71% of the findings in a penetration test on average would have been serious, high or critical findings. By the time we get to Q1 in 2022, it's only 33%. So we've gone from three quarters of the findings being serious to only one-third of the findings being serious over a four-year period. And this question of why these numbers are going down like this makes me very curious. Why would it be? So another perspective we took, and again, there's that dip, by the way. There's the Q1 or Q2 of 2022 where it reaches its absolute lowest. So one of the explanations might be that as customers are coming back over and over, the number of findings we're reporting is getting less and less. And in fact, that does seem to


chunk_text:
  I forget. So this is at the peak of the COVID lockdowns, right? I'm going to just draw your attention to this because we're going to come back to that in a moment. But this is another perspective on the same question, where we look at the ratio between serious and not serious findings in a report. So in 2018, in fact, here in Q4 of 2018, 71% of the findings in a penetration test on average would have been serious, high or critical findings. By the time we get to Q1 in 2022, it's only 33%. So we've gone from three quarters of the findings being serious to only one-third of the findings being serious over a four-year period. And this question of why these numbers are going down like this makes me very curious. Why would it be? So another perspective we took, and again, there's that dip, by the way. There's the Q1 or Q2 of 2022 where it reaches its absolute lowest. So one of the explanations might be that as customers are coming back over and over, the number of findings we're reporting is getting less and less. And in fact, that does seem to be the case. So for customers who only test with us once, we're reporting 4.7 CVSS points per day. For customers who come to us more than 10 times, it's like 4.6. So there's a line downwards. What's odd is this jump over here. So I said more than one, but basically this means two, because more than one but not more than two is two. So I don't know why I made it so complicated, but it's two. So this is two. When they do two, we have the highest number of findings. And the conclusion we reached is because normally when a customer does exactly two tests with our teams, they're doing one internal and one external once. So basically, this is almost an anomalous situation where it's like a once-off for compliance. The customer comes in for like a one-two. It's like a mani and a pedi. You know, you get your feet and your nails done. But you only do it once. So that's where that very high number comes in. But then it sort of drops down from there the more tests the customers do. So why would it be that we're seeing this decrease


chunk_text:
  be the case. So for customers who only test with us once, we're reporting 4.7 CVSS points per day. For customers who come to us more than 10 times, it's like 4.6. So there's a line downwards. What's odd is this jump over here. So I said more than one, but basically this means two, because more than one but not more than two is two. So I don't know why I made it so complicated, but it's two. So this is two. When they do two, we have the highest number of findings. And the conclusion we reached is because normally when a customer does exactly two tests with our teams, they're doing one internal and one external once. So basically, this is almost an anomalous situation where it's like a once-off for compliance. The customer comes in for like a one-two. It's like a mani and a pedi. You know, you get your feet and your nails done. But you only do it once. So that's where that very high number comes in. But then it sort of drops down from there the more tests the customers do. So why would it be that we're seeing this decrease in levels of finding over time? Well, the one theory could be that security is just getting better. Maybe between 2018 and 2022, our clients have become better at securing their systems. Another theory is that maybe our testers are getting worse. You know, I don't know how many of you are young testers, but obviously, my generation were much better than Mia's generation. You know, we had the... But I don't think either of those are the case. One theory that I've got, which I think is very interesting, is that when we look at new customers who are coming to test, they're generally testing new systems. And those systems are now often being built with, you know, cloud-based hosting, you know, all kinds of sort of cloud-based back-end stuff, much more robust development frameworks, et cetera. There's much less legacy in those platforms. And that would help to explain why we see this massive drop-down, which I think is encouraging and is a good sign. And then Dominic White, who's sadly not here, but he leads our pentesting operations, he made another point, which is, if you recall that dip in 2022, he says, what happened is that


chunk_text:
  in levels of finding over time? Well, the one theory could be that security is just getting better. Maybe between 2018 and 2022, our clients have become better at securing their systems. Another theory is that maybe our testers are getting worse. You know, I don't know how many of you are young testers, but obviously, my generation were much better than Mia's generation. You know, we had the... But I don't think either of those are the case. One theory that I've got, which I think is very interesting, is that when we look at new customers who are coming to test, they're generally testing new systems. And those systems are now often being built with, you know, cloud-based hosting, you know, all kinds of sort of cloud-based back-end stuff, much more robust development frameworks, et cetera. There's much less legacy in those platforms. And that would help to explain why we see this massive drop-down, which I think is encouraging and is a good sign. And then Dominic White, who's sadly not here, but he leads our pentesting operations, he made another point, which is, if you recall that dip in 2022, he says, what happened is that in 2022, we couldn't go onsite to customers anymore. And so now testing started to happen over a VPN. And so the perspective that the tester gets of the environment that they're testing becomes much more constrained. And of course, even though the lockdown's lifted, those habits continued. And so now basically the testers are getting a much more constrained scope of what they're seeing. Anyways, that's a bit of a throw-aside observation of the data that I hoped you would find interesting. I want to end with a bit of a different observation. So we've been looking a lot at numbers and how much we see things and how often, you know, they occur, et cetera. But, of course, what people have been talking about a lot, and I'm sure you have also, is this recent last-pass compromise. And I don't know about you, but I've been working very hard to try and understand exactly how that compromise happened. Thank you. And I haven't fully got my head around it. But, of course, they were hacked purportedly for the first time in, like, August of last year and then for the last time in March of this year. And


chunk_text:
  in 2022, we couldn't go onsite to customers anymore. And so now testing started to happen over a VPN. And so the perspective that the tester gets of the environment that they're testing becomes much more constrained. And of course, even though the lockdown's lifted, those habits continued. And so now basically the testers are getting a much more constrained scope of what they're seeing. Anyways, that's a bit of a throw-aside observation of the data that I hoped you would find interesting. I want to end with a bit of a different observation. So we've been looking a lot at numbers and how much we see things and how often, you know, they occur, et cetera. But, of course, what people have been talking about a lot, and I'm sure you have also, is this recent last-pass compromise. And I don't know about you, but I've been working very hard to try and understand exactly how that compromise happened. Thank you. And I haven't fully got my head around it. But, of course, they were hacked purportedly for the first time in, like, August of last year and then for the last time in March of this year. And it turns out that it's actually a series of three interrelated compromises, right? So we know that in the beginning they compromised some development environment using compromised endpoints, which allowed them to bypass MFA. And now they're drifting around in a development environment somewhere. LastPass catches them and throws them out. And the report they give us is no damage done. A little bit of customer data perhaps leaked out, but it's all in vaults. It's all encrypted. Everyone is safe. Then we find out that there was a second compromise. And this compromise involved a cloud environment, which was co-hosted or shared with their owner, which is a company called Goto. And they're able to get some other data, including access to the backups of the full vaults, right? So now they've got the full encrypted vault, but they don't have the passwords to unlock the vault. And so just a few weeks ago, we get the report that they somehow managed to find a developer's home network, somehow identified a Plex server that the developer was running that had a vulnerability on it that they were able to exploit. And then somehow from there ran a key logger


chunk_text:
  it turns out that it's actually a series of three interrelated compromises, right? So we know that in the beginning they compromised some development environment using compromised endpoints, which allowed them to bypass MFA. And now they're drifting around in a development environment somewhere. LastPass catches them and throws them out. And the report they give us is no damage done. A little bit of customer data perhaps leaked out, but it's all in vaults. It's all encrypted. Everyone is safe. Then we find out that there was a second compromise. And this compromise involved a cloud environment, which was co-hosted or shared with their owner, which is a company called Goto. And they're able to get some other data, including access to the backups of the full vaults, right? So now they've got the full encrypted vault, but they don't have the passwords to unlock the vault. And so just a few weeks ago, we get the report that they somehow managed to find a developer's home network, somehow identified a Plex server that the developer was running that had a vulnerability on it that they were able to exploit. And then somehow from there ran a key logger on a machine that he was using to log into the vault and then use that password from the vault to decrypt the passwords from stage one and stage two. And now it's, I don't know, now it's a disaster, right? Now it's a big thing. And I thought to myself, this sort of thinking, this sort of activity is not being represented in my data, right? This sort of stringing things together from like one environment to another environment and finding the developer's home network. How did they even do that? I don't know. You know, they found this guy's home environment, found his Plex server. It's just a remarkable level of sophistication and operational coherence. And it occurs to me that one of the stories we could be telling about pentesting is that this is what pentesting should be showing us, not reporting on the CVEs that the bad guys are also using in the wild. Of course, the twist in this story is that they did exploit a CVE, right? That's what almost everyone is talking about the most. They exploited a CVE in Plex, CVE-2025-741, high severity flaw in Plex media server. And this was apparently


chunk_text:
  on a machine that he was using to log into the vault and then use that password from the vault to decrypt the passwords from stage one and stage two. And now it's, I don't know, now it's a disaster, right? Now it's a big thing. And I thought to myself, this sort of thinking, this sort of activity is not being represented in my data, right? This sort of stringing things together from like one environment to another environment and finding the developer's home network. How did they even do that? I don't know. You know, they found this guy's home environment, found his Plex server. It's just a remarkable level of sophistication and operational coherence. And it occurs to me that one of the stories we could be telling about pentesting is that this is what pentesting should be showing us, not reporting on the CVEs that the bad guys are also using in the wild. Of course, the twist in this story is that they did exploit a CVE, right? That's what almost everyone is talking about the most. They exploited a CVE in Plex, CVE-2025-741, high severity flaw in Plex media server. And this was apparently what allowed them to get access to the developer's network to deploy the key logger, to steal the password vault, to decrypt the data, right? Key. So I got to wondering, well, do we see that vulnerability? Turns out that if you take the EPSS scores for the last 12 months and you look at everything over 0.03, it doesn't appear. So I don't know if that would have been useful to them. And, of course, we didn't see it anyway, right? We didn't see it on any of our customer environments. Anyway, I don't know what that means. I just thought it provided a bit of an interesting counter example to, like, how exploits actually happen, or compromises actually happen and how useful our scanning and our testing is at predicting how they happen. I want to end with this thought. Harun Mir, at the end of his presentation, says having criticized pen testing left, right, and center, he says, look, if you think you have smarts, if you think you're a clever person, then maybe this is something that we need to think about. I don't know what this data, what these observations are telling us about how


chunk_text:
  what allowed them to get access to the developer's network to deploy the key logger, to steal the password vault, to decrypt the data, right? Key. So I got to wondering, well, do we see that vulnerability? Turns out that if you take the EPSS scores for the last 12 months and you look at everything over 0.03, it doesn't appear. So I don't know if that would have been useful to them. And, of course, we didn't see it anyway, right? We didn't see it on any of our customer environments. Anyway, I don't know what that means. I just thought it provided a bit of an interesting counter example to, like, how exploits actually happen, or compromises actually happen and how useful our scanning and our testing is at predicting how they happen. I want to end with this thought. Harun Mir, at the end of his presentation, says having criticized pen testing left, right, and center, he says, look, if you think you have smarts, if you think you're a clever person, then maybe this is something that we need to think about. I don't know what this data, what these observations are telling us about how effective our risk assessment is using scanning and pen testing, but it certainly raises a lot of questions for me about whether we're doing the right thing to advise our clients about how to make sense of all the threats that are chasing us down in the wild. And that's all we're going to have time for. Thank you very much, everyone. Just a quick one. If you want to read our report where most of this data is in, it's called the Security Navigator. There's the URL there. Not all the data is in that report, but some of it is in there, so take a moment to have a look-see. Otherwise, I think we've maybe got a few minutes for questions. Yes. Thank you, Charles. So, ladies and gentlemen, if you have some questions, you have 15 minutes to ask Mr. van der Valk. Thank you. Please, somebody ask a question. Oh, there's one. Hello. Thank you. Nice presentation. I love the slide background with the high score. That was awesome. But the question is do you think that one of the issues we're seeing with vulnerabilities is that we have an increased number of vulnerabilities with CVEs


chunk_text:
  effective our risk assessment is using scanning and pen testing, but it certainly raises a lot of questions for me about whether we're doing the right thing to advise our clients about how to make sense of all the threats that are chasing us down in the wild. And that's all we're going to have time for. Thank you very much, everyone. Just a quick one. If you want to read our report where most of this data is in, it's called the Security Navigator. There's the URL there. Not all the data is in that report, but some of it is in there, so take a moment to have a look-see. Otherwise, I think we've maybe got a few minutes for questions. Yes. Thank you, Charles. So, ladies and gentlemen, if you have some questions, you have 15 minutes to ask Mr. van der Valk. Thank you. Please, somebody ask a question. Oh, there's one. Hello. Thank you. Nice presentation. I love the slide background with the high score. That was awesome. But the question is do you think that one of the issues we're seeing with vulnerabilities is that we have an increased number of vulnerabilities with CVEs reported for very specific non-enterprise technologies like IoT, OT systems that are inflating these numbers and so making it harder to get stronger signal from that overall noise? Yes, I do think so. I think it's very clear to me that between CVE and CVSS, we've created a bit of a monster that might not actually be useful to us. And I think that the security community, the vendor side of the security community definitely needs to start changing our narrative around those vulnerabilities. It's not useful, I think, to, you know, as a pen testing company, one of the things that we're asked when we present to customers is, well, how many CVEs have you published? You know, so CVEs, publishing CVEs becomes a sort of a scoreboard. And I don't think that's useful. It's not helping us. I think it's useful to have that common designator, but I think we're using it in the wrong way. And it seems also clear to me that the CVSS score, for all its good intent, is not actually adding a lot of value, certainly when it's statically ascribed to a single vulnerability. I do think so. One more question. Oh, there's


chunk_text:
  reported for very specific non-enterprise technologies like IoT, OT systems that are inflating these numbers and so making it harder to get stronger signal from that overall noise? Yes, I do think so. I think it's very clear to me that between CVE and CVSS, we've created a bit of a monster that might not actually be useful to us. And I think that the security community, the vendor side of the security community definitely needs to start changing our narrative around those vulnerabilities. It's not useful, I think, to, you know, as a pen testing company, one of the things that we're asked when we present to customers is, well, how many CVEs have you published? You know, so CVEs, publishing CVEs becomes a sort of a scoreboard. And I don't think that's useful. It's not helping us. I think it's useful to have that common designator, but I think we're using it in the wrong way. And it seems also clear to me that the CVSS score, for all its good intent, is not actually adding a lot of value, certainly when it's statically ascribed to a single vulnerability. I do think so. One more question. Oh, there's another one. Yeah, inspiring talk. Thanks. Thank you. I wanted to follow up. I thought the part of the different industries is really interesting. And I wanted to ask if, was there some indication that some industries which are maybe like denoted to be slower adopting new stacks, be less tech savvy, that they kind of perform worse in terms of your terminology of CVSS points per day? Yeah, there is. Let me see. I might actually even have the data. There's one of these slides. There you go. That's what it looks like across the industries we have in our data set. Now, it's not a perfect representation. The blue line shows the total number of days that we spend testing in that industry. So it gives you a sense of how many customers, how much effort we put into that industry. And the green line shows the CVSS per day. Now, I think the ones with very low blue lines we can ignore because they're probably anomalous. So I think you can ignore retail. Sorry, you can ignore real estate. That's obviously a very small data set, so I wouldn't worry about that too much. But you can


chunk_text:
  another one. Yeah, inspiring talk. Thanks. Thank you. I wanted to follow up. I thought the part of the different industries is really interesting. And I wanted to ask if, was there some indication that some industries which are maybe like denoted to be slower adopting new stacks, be less tech savvy, that they kind of perform worse in terms of your terminology of CVSS points per day? Yeah, there is. Let me see. I might actually even have the data. There's one of these slides. There you go. That's what it looks like across the industries we have in our data set. Now, it's not a perfect representation. The blue line shows the total number of days that we spend testing in that industry. So it gives you a sense of how many customers, how much effort we put into that industry. And the green line shows the CVSS per day. Now, I think the ones with very low blue lines we can ignore because they're probably anomalous. So I think you can ignore retail. Sorry, you can ignore real estate. That's obviously a very small data set, so I wouldn't worry about that too much. But you can see, for example, as one would expect in finance and insurance, the number is much lower than in something like, there you go, in professional and scientific services where we see a higher number. So there is a variance. I can send you this data. In fact, I think we published this data in the report also. But I don't think that my data set is big enough to really draw conclusions about whether some industries perform better than others. I'll share another anecdote. One of the things that my team has been very interested in understanding is that we see, in terms of compromises in the wild, we see a very high number of compromises in the wild at manufacturing businesses, so businesses that are NAICS classified as manufacturing. And we're trying to understand why that is. And so we compared the manufacturing industry to all other industries in terms of how long does it take them to patch, how many vulnerabilities per host, CVSS per day, all of those things to see if they stand out. And actually they don't. I was very disappointed as a researcher. I had all this data and I thought I was going


chunk_text:
  see, for example, as one would expect in finance and insurance, the number is much lower than in something like, there you go, in professional and scientific services where we see a higher number. So there is a variance. I can send you this data. In fact, I think we published this data in the report also. But I don't think that my data set is big enough to really draw conclusions about whether some industries perform better than others. I'll share another anecdote. One of the things that my team has been very interested in understanding is that we see, in terms of compromises in the wild, we see a very high number of compromises in the wild at manufacturing businesses, so businesses that are NAICS classified as manufacturing. And we're trying to understand why that is. And so we compared the manufacturing industry to all other industries in terms of how long does it take them to patch, how many vulnerabilities per host, CVSS per day, all of those things to see if they stand out. And actually they don't. I was very disappointed as a researcher. I had all this data and I thought I was going to be able to explain why we see so many exploits or compromises in one industry compared to other industries. But the answer to that question doesn't seem to be in how long it takes them to patch or how many vulnerabilities they have per host. I don't know if that answers your question. There's one more there, I think, in the middle. Thanks a lot. My question is, in my experience for pentests, a lot of the things that you see are, I would say, maybe 40%, in my case, are actually not really related to CVEs but more business logic flaws and implementation flaws, more credential management, clear text. How do you deal with that and how do you put that in your... In this study, we're not trying to look at that because we wanted something that we could cross-reference and, of course, that's CVE. So I haven't actually looked at how often those kinds of flaws appear in the data. The NER is actually able to pull it out, which is quite nice, but I haven't studied that. I guess the question that I would ask back is that pentester is reporting sophisticated web application business


chunk_text:
  to be able to explain why we see so many exploits or compromises in one industry compared to other industries. But the answer to that question doesn't seem to be in how long it takes them to patch or how many vulnerabilities they have per host. I don't know if that answers your question. There's one more there, I think, in the middle. Thanks a lot. My question is, in my experience for pentests, a lot of the things that you see are, I would say, maybe 40%, in my case, are actually not really related to CVEs but more business logic flaws and implementation flaws, more credential management, clear text. How do you deal with that and how do you put that in your... In this study, we're not trying to look at that because we wanted something that we could cross-reference and, of course, that's CVE. So I haven't actually looked at how often those kinds of flaws appear in the data. The NER is actually able to pull it out, which is quite nice, but I haven't studied that. I guess the question that I would ask back is that pentester is reporting sophisticated web application business logic flaws to a customer and they're fixing it. That's obviously work well done. But if the customer is actually being popped by ransomware actors using a known vulnerability in Internet Explorer, that's the dissonance that I'm curious to understand. And I think that's the point Harun Mir was making when he said, are we emulating the attacker or are we emulating the other pentesters? There's this sort of remarkable level of technical agility that emerges in the pentesting space, but really what's happening if you look at, for example, cyber extortion and ransomware is it's password reuse, credential stuffing, unpatched Internet-facing servers, and phishing over and over and over again. And I suppose exactly that is the question that I'm asking is, should we be doing all that web application gymnastics or should we rather be focusing on looking broadly and identifying these vulnerabilities that are exposed in the wild and patching those very quickly? Maybe that's a more sensible approach. I don't know, but I think that's the question I'm asking. I think there was a gentleman over here. And just to add, I'm sure there's not one answer to that, right? It's probably some mixture between both.


chunk_text:
  logic flaws to a customer and they're fixing it. That's obviously work well done. But if the customer is actually being popped by ransomware actors using a known vulnerability in Internet Explorer, that's the dissonance that I'm curious to understand. And I think that's the point Harun Mir was making when he said, are we emulating the attacker or are we emulating the other pentesters? There's this sort of remarkable level of technical agility that emerges in the pentesting space, but really what's happening if you look at, for example, cyber extortion and ransomware is it's password reuse, credential stuffing, unpatched Internet-facing servers, and phishing over and over and over again. And I suppose exactly that is the question that I'm asking is, should we be doing all that web application gymnastics or should we rather be focusing on looking broadly and identifying these vulnerabilities that are exposed in the wild and patching those very quickly? Maybe that's a more sensible approach. I don't know, but I think that's the question I'm asking. I think there was a gentleman over here. And just to add, I'm sure there's not one answer to that, right? It's probably some mixture between both. The gentleman with the orange shirt. Thank you. My question was in the same way. It was much more about context. Because if you look at a given CVE, it will not be the same risk if it's inside or outside. How do you deal with that in your reports? So I'm not trying to deal with it in my reports. It is one of the criticisms that's leveraged against the EPSS. It's exactly that. And there's this concept of, what is it? It's like path to code or something. So what is the route that you have to get there? But the EPSS working group counters that by saying, actually, if you ignore that completely and you just look at what are we seeing being exploited in the wild, then their prediction system, path to code notwithstanding, is in fact very, very powerful at knowing how you're going to be hit. So I think, yeah, I'm not trying to address it, but I know that EPSS addresses it by showing this perfect 45% 45-degree correlation graph that says, if they said 100% it's going to be exploited, then 100% it gets exploited, regardless of what the path is. So


chunk_text:
  The gentleman with the orange shirt. Thank you. My question was in the same way. It was much more about context. Because if you look at a given CVE, it will not be the same risk if it's inside or outside. How do you deal with that in your reports? So I'm not trying to deal with it in my reports. It is one of the criticisms that's leveraged against the EPSS. It's exactly that. And there's this concept of, what is it? It's like path to code or something. So what is the route that you have to get there? But the EPSS working group counters that by saying, actually, if you ignore that completely and you just look at what are we seeing being exploited in the wild, then their prediction system, path to code notwithstanding, is in fact very, very powerful at knowing how you're going to be hit. So I think, yeah, I'm not trying to address it, but I know that EPSS addresses it by showing this perfect 45% 45-degree correlation graph that says, if they said 100% it's going to be exploited, then 100% it gets exploited, regardless of what the path is. So I guess their model is perhaps taking some of those variables into account, even if it's not deliberate. Okay, I guess that's all we have time for. Thank you very much for your attention.


chunk_text:
  I guess their model is perhaps taking some of those variables into account, even if it's not deliberate. Okay, I guess that's all we have time for. Thank you very much for your attention.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=QUsZzILzJnA", "title": "Inglourious Drivers: The Revenge Of The Peripheral Devices by Omer Tsarfati", "description": "", "channel_url": "https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA", "duration": 2301, "channel": "scrt.insomnihack", "uploader": "scrt.insomnihack", "upload_date": "20230411" } This text was transcribed using whisper model: large-v2 Thank you. Hello, Insomniac. It's really great having you all here today. It's really great to be here today. So today we'll talk about inglorious drivers. The less glorious drivers that exist out there. And for those of you who already managed to detect the typo in my slide, so congrats. There probably might be more in other slides. Those are not intended, but this one is. So basically it's an homage to the great movie of Quentin Tarantino, Inglorious Basterds, which just uses the same typo. Unfortunately, we are not here to talk about movies, right? We're here to talk about kernel drivers. So let's begin. My name is Omer Tsarfati. I'm a senior security researcher at CyberArk Labs. I'm doing security research for more than eight years, something like this. In my spare time, I like playing basketball. When I'm not doing that, probably I will play some video games. And when I'm not doing that, I do some research for my own pleasure. All right. So today we'll talk about a few things. So at the very beginning, we'll talk about the Windows driver framework. Right after that, we'll talk about some common mistakes that driver developers tend to do. And then we'll talk about one specific driver that created a really big mess and for some reason is widely used by a lot of vendors. Right after that, we'll talk about how we managed to utilize total for finding even more vulnerabilities than we found in the research that we conducted. And at the very end, we'll talk about some mitigations to the vulnerabilities we found and how you guys can mitigate most of them with one simple trick. All right. So before we start talking about the Windows driver framework, I want to tell you a short story. So a few years ago, I made a decision. Maybe not the best decision that I ever made, but it was a decision. And I went to the store and I bought myself a gaming laptop. So I got this gaming laptop manufactured by MSI. And as some of you may know, the most important thing when you're playing video games


chunk_text:
  own pleasure. All right. So today we'll talk about a few things. So at the very beginning, we'll talk about the Windows driver framework. Right after that, we'll talk about some common mistakes that driver developers tend to do. And then we'll talk about one specific driver that created a really big mess and for some reason is widely used by a lot of vendors. Right after that, we'll talk about how we managed to utilize total for finding even more vulnerabilities than we found in the research that we conducted. And at the very end, we'll talk about some mitigations to the vulnerabilities we found and how you guys can mitigate most of them with one simple trick. All right. So before we start talking about the Windows driver framework, I want to tell you a short story. So a few years ago, I made a decision. Maybe not the best decision that I ever made, but it was a decision. And I went to the store and I bought myself a gaming laptop. So I got this gaming laptop manufactured by MSI. And as some of you may know, the most important thing when you're playing video games on your computer, it's not about the graphics. It's not about the whole experience of the game. It's more about FPS. So basically, the more frames you have, the more fun you have eventually. So there are a lot of ways to achieve FPS. One excellent way is to ensure that your cooling system is good and everything will stay chill. Unfortunately, gaming laptops suffers from overrating. So basically, you need to set your fans to their max most of the time. Another way to solve this problem, you can just add a nice spoiler to your rig. It might also help. I don't know about that, but it might. So MSI was kind enough to develop this program called Dragon Center, which allows you to control a lot of things around your computer. And one of them is the cooling fans. But there is one thing about that. I don't really like its GUI. So I wanted to create my own program that controlled the cooling fans. And before I started to write any code, I started thinking which component in the system controls the cooling fan speed and how everything works around this. So basically, I thought that


chunk_text:
  on your computer, it's not about the graphics. It's not about the whole experience of the game. It's more about FPS. So basically, the more frames you have, the more fun you have eventually. So there are a lot of ways to achieve FPS. One excellent way is to ensure that your cooling system is good and everything will stay chill. Unfortunately, gaming laptops suffers from overrating. So basically, you need to set your fans to their max most of the time. Another way to solve this problem, you can just add a nice spoiler to your rig. It might also help. I don't know about that, but it might. So MSI was kind enough to develop this program called Dragon Center, which allows you to control a lot of things around your computer. And one of them is the cooling fans. But there is one thing about that. I don't really like its GUI. So I wanted to create my own program that controlled the cooling fans. And before I started to write any code, I started thinking which component in the system controls the cooling fan speed and how everything works around this. So basically, I thought that it's a user mode program application which talks to a low level kernel driver. And before we're talking about user mode application communicate with kernel drivers, we need at least in all operation system and specifically in Windows, we need to talk about privilege level architecture. So in Windows, we have four different levels of privilege. Four different privilege levels. So the lowest one is the sandbox process, which there are not a lot of processes run as a sandbox process. Mainly your browser, teams, Slack, Discord, stuff like this. And we have the non-admin processes, which most of your program on your computer runs as. And then we have the services and the admin processes, which are considered to be a privilege level, which means that if an attacker runs as an admin process or a service, probably your computer could be ultimately taken over. And last but not least, we have the OS kernel, which includes also the kernel drivers. So some of those kernel drivers interact with hardware, and one of them might interact with the cooling fans. So basically, MSI needed to develop kernel drivers that interact with the cooling fans, but when one is developing


chunk_text:
  it's a user mode program application which talks to a low level kernel driver. And before we're talking about user mode application communicate with kernel drivers, we need at least in all operation system and specifically in Windows, we need to talk about privilege level architecture. So in Windows, we have four different levels of privilege. Four different privilege levels. So the lowest one is the sandbox process, which there are not a lot of processes run as a sandbox process. Mainly your browser, teams, Slack, Discord, stuff like this. And we have the non-admin processes, which most of your program on your computer runs as. And then we have the services and the admin processes, which are considered to be a privilege level, which means that if an attacker runs as an admin process or a service, probably your computer could be ultimately taken over. And last but not least, we have the OS kernel, which includes also the kernel drivers. So some of those kernel drivers interact with hardware, and one of them might interact with the cooling fans. So basically, MSI needed to develop kernel drivers that interact with the cooling fans, but when one is developing a kernel driver, it actually takes a lot of risk and also a lot of responsibility for this. So that's because you are part of the kernel. So all the drivers just share the same system address space and essentially are part of the kernel. Fortunately, nowadays, they all need to be signed. So there is a mitigation for that. You can disable it. Don't do that. Also, you need to be in admin privileges. So, yeah, just a good thing. And don't screw up, because you're talking to hardware. You're filtering stuff. If you're not handling things correctly, you will just crush the system, and this is not a good thing to do. At least if you're a developer. If you're an attacker, do whatever you want. All right. So here we are as security researchers, right? So from security perspective, when we are talking about drivers, we want to know two main things. We would like to know which access we have to the driver. So do I have access to talk with the driver and what are my permissions and how do I communicate with the driver and how does the driver actually parse data that I'm


chunk_text:
  a kernel driver, it actually takes a lot of risk and also a lot of responsibility for this. So that's because you are part of the kernel. So all the drivers just share the same system address space and essentially are part of the kernel. Fortunately, nowadays, they all need to be signed. So there is a mitigation for that. You can disable it. Don't do that. Also, you need to be in admin privileges. So, yeah, just a good thing. And don't screw up, because you're talking to hardware. You're filtering stuff. If you're not handling things correctly, you will just crush the system, and this is not a good thing to do. At least if you're a developer. If you're an attacker, do whatever you want. All right. So here we are as security researchers, right? So from security perspective, when we are talking about drivers, we want to know two main things. We would like to know which access we have to the driver. So do I have access to talk with the driver and what are my permissions and how do I communicate with the driver and how does the driver actually parse data that I'm sending to it? So let's talk about access. In Windows, in order to interact with the driver, the driver needs to create a device. So the driver creates a device object and should specify which user can access it. So this is actually done by using a security descriptor, which can be located either in the INF file that comes along with the driver or in the driver entry. And this is set by calling Iocreate device secure. So as you can already understand, there is also a function called Iocreate device. Not secure. Basically, what's going to happen when you call this one, so the default security descriptor will be applied, and basically it means most of the users on the system can interact with the device. So in order to make sure also the device object accessible from user space, you need to create a symbolic link, and this can be done by calling Iocreate symbolic link or Iocreate device interface. Then the user or the user application or the driver needs to call create file or create file to have a handle to the device. So here we can see a driver called VidSys exposing a device


chunk_text:
  sending to it? So let's talk about access. In Windows, in order to interact with the driver, the driver needs to create a device. So the driver creates a device object and should specify which user can access it. So this is actually done by using a security descriptor, which can be located either in the INF file that comes along with the driver or in the driver entry. And this is set by calling Iocreate device secure. So as you can already understand, there is also a function called Iocreate device. Not secure. Basically, what's going to happen when you call this one, so the default security descriptor will be applied, and basically it means most of the users on the system can interact with the device. So in order to make sure also the device object accessible from user space, you need to create a symbolic link, and this can be done by calling Iocreate symbolic link or Iocreate device interface. Then the user or the user application or the driver needs to call create file or create file to have a handle to the device. So here we can see a driver called VidSys exposing a device object called VidExo. You probably can't see anything, so let's do a quick zoom. Yeah. All right. So on the left-hand side, we can see the driver object and all the devices it exposes to the object manager, and on the right-hand side, we can see the groups and the users that have access to the device and what they can actually do with the device. All right. So let's talk about communication. So the driver register need to register and dispatch routines through using the major function. So basically, it means which operation the driver supports. So there are about 27 different major functions that exist. Most of them are not commonly in use. Mainly those five are in use commonly. So you have the create, close, read, write, and device Iocontrol. Which is we'll talk about it later is the most important one for us. All right. So this is our driver entry will look like. So it's like your main function of the driver. And we can see here there is a call to Iocreate device, which will create a device called test DRV. And after that, there is the registration of the major function. And as


chunk_text:
  object called VidExo. You probably can't see anything, so let's do a quick zoom. Yeah. All right. So on the left-hand side, we can see the driver object and all the devices it exposes to the object manager, and on the right-hand side, we can see the groups and the users that have access to the device and what they can actually do with the device. All right. So let's talk about communication. So the driver register need to register and dispatch routines through using the major function. So basically, it means which operation the driver supports. So there are about 27 different major functions that exist. Most of them are not commonly in use. Mainly those five are in use commonly. So you have the create, close, read, write, and device Iocontrol. Which is we'll talk about it later is the most important one for us. All right. So this is our driver entry will look like. So it's like your main function of the driver. And we can see here there is a call to Iocreate device, which will create a device called test DRV. And after that, there is the registration of the major function. And as I told you before, the most important one, the IRPMJ device control, which most of the interesting logic exists in at least for our needs. All right. So just like in network, like network packets, we also here have also packets. But little different packets. So those packets called Iorequest packets or IRP for short. So IRP contains any of the dispatch routine you would ever need. So the IRP structure is generated by the IOManager. And it consists of stack location, which is where all the important members reside. We have the request mode. We initiate the call. If it's the kernel, if it's the user land. The input and output buffer sent to the driver. And the IO status information, which indicates how many bytes should be written back to the output buffer. Any misuse of those fields would probably cause a bug. So you might crash the system. You might allow arbitrary read, write in the kernel. So this is bad. All right. So besides that, the IRP struct also contains a field called IO control code or IOctal for short. It's a number that's used as an identifier for other programs to execute specific logic in


chunk_text:
  I told you before, the most important one, the IRPMJ device control, which most of the interesting logic exists in at least for our needs. All right. So just like in network, like network packets, we also here have also packets. But little different packets. So those packets called Iorequest packets or IRP for short. So IRP contains any of the dispatch routine you would ever need. So the IRP structure is generated by the IOManager. And it consists of stack location, which is where all the important members reside. We have the request mode. We initiate the call. If it's the kernel, if it's the user land. The input and output buffer sent to the driver. And the IO status information, which indicates how many bytes should be written back to the output buffer. Any misuse of those fields would probably cause a bug. So you might crash the system. You might allow arbitrary read, write in the kernel. So this is bad. All right. So besides that, the IRP struct also contains a field called IO control code or IOctal for short. It's a number that's used as an identifier for other programs to execute specific logic in the driver. So the IOctal is just a function identifier, right? So it's basically packing a little bit more than that. So it's a 32-bit packed structure. So the first two bits indicates what is the transfer type of the request that's sent. And the 13 and 14 indicates the required access of the request. All right. So let's talk about the required access. So it's actually described the required permission to send to the device IO control request. It's based on your permission when you called anti-create file or create file. So it depends on the handle you have. So there are about four different options. File any access, file read access, file write access, and file read and write access. So those are actually in order from the least privileged one to the most privileged one. Also, we have the transfer type. So this actually describes how the IO manager treats the user data. So here we have a lot of different nonsense that the driver developer must know. And when there are a lot of different things you need to know, you should know there might be a lot of bugs. So there are four different options


chunk_text:
  the driver. So the IOctal is just a function identifier, right? So it's basically packing a little bit more than that. So it's a 32-bit packed structure. So the first two bits indicates what is the transfer type of the request that's sent. And the 13 and 14 indicates the required access of the request. All right. So let's talk about the required access. So it's actually described the required permission to send to the device IO control request. It's based on your permission when you called anti-create file or create file. So it depends on the handle you have. So there are about four different options. File any access, file read access, file write access, and file read and write access. So those are actually in order from the least privileged one to the most privileged one. Also, we have the transfer type. So this actually describes how the IO manager treats the user data. So here we have a lot of different nonsense that the driver developer must know. And when there are a lot of different things you need to know, you should know there might be a lot of bugs. So there are four different options here. We have the method buffer, method indirect, method out direct, and method neither. So here it's also in order from the most secure one that is commonly considered to be the most secure one to the least secure one. So method neither as one of my colleagues call it the mother of all evil. So, yeah. All right. So in order to send a device control request, we will use the device IO control function which takes a handle to the device. It takes an IO control code and the input buffer and its size and the output buffer and its size. All right. So by now we know a lot and we know how to interact with drivers in Windows. So let's talk about mistakes. All right. So let's talk about method neither. So in this case, the IO manager is actually pretty much lazy. So the buffers and the lamps will reside in user mode and the kernel doesn't copy them to the kernel space. They can be paged out and it can cause some problems. The input buffer will be type 3 input buffer. The output buffer will be the user buffer. So the user can


chunk_text:
  here. We have the method buffer, method indirect, method out direct, and method neither. So here it's also in order from the most secure one that is commonly considered to be the most secure one to the least secure one. So method neither as one of my colleagues call it the mother of all evil. So, yeah. All right. So in order to send a device control request, we will use the device IO control function which takes a handle to the device. It takes an IO control code and the input buffer and its size and the output buffer and its size. All right. So by now we know a lot and we know how to interact with drivers in Windows. So let's talk about mistakes. All right. So let's talk about method neither. So in this case, the IO manager is actually pretty much lazy. So the buffers and the lamps will reside in user mode and the kernel doesn't copy them to the kernel space. They can be paged out and it can cause some problems. The input buffer will be type 3 input buffer. The output buffer will be the user buffer. So the user can allocate and deallocate the buffers making those pages invalid. So you need to be cautious when dealing with them and also you need to know that every access to the buffers must be in a try except block. Also, you need to do some probing. So whenever you want to read or write to the buffers, you need to use probe for read and probe for write accordingly. But if you don't do them or you don't use them correctly, it will throw some errors on invalid address. So the call actually, if it's not in try except block, will crash the system. If the lamp is zero of the buffer that is sent by the user, so actually those probing do nothing and the validation just passed away. It just passes. So if you're not probing correctly, the kernel reads and the kernel reads from the buffer, you will crash the system at the very least and, well, at least for us as security such as you might have some info leak and if you're doing it for writing, you will either crash the system or allow arbitrary kernel write. All right. So this is an example of a


chunk_text:
  allocate and deallocate the buffers making those pages invalid. So you need to be cautious when dealing with them and also you need to know that every access to the buffers must be in a try except block. Also, you need to do some probing. So whenever you want to read or write to the buffers, you need to use probe for read and probe for write accordingly. But if you don't do them or you don't use them correctly, it will throw some errors on invalid address. So the call actually, if it's not in try except block, will crash the system. If the lamp is zero of the buffer that is sent by the user, so actually those probing do nothing and the validation just passed away. It just passes. So if you're not probing correctly, the kernel reads and the kernel reads from the buffer, you will crash the system at the very least and, well, at least for us as security such as you might have some info leak and if you're doing it for writing, you will either crash the system or allow arbitrary kernel write. All right. So this is an example of a buggy code from a real driver. Here we can see that the driver developers didn't hear about probing. So in the first box, the driver reads the input buffer. We see there is no probing function before the usage. In the second box, there is a dereference of a pointer without checking if the buffer is null. So this also might crash the system. On the third box, the address could already be paged out causing a crash when writing to the output buffer. And besides that, the input and the output buffers access not in a try except block, try catch block. So the driver can get access denied and crash the system. And also, in the second box, just like in the second box, also in the fourth box, there is accessing to the input buffer without any validation. And lastly, it's not in a box, but the access to the output buffer doesn't involve probing, which will eventually allow us to do an arbitrary kernel write. Memory write. So, yeah, this is also a problem. Let's talk about the better brother in the family. The method buffer. So method buffer, in this case, the manager copies the


chunk_text:
  buggy code from a real driver. Here we can see that the driver developers didn't hear about probing. So in the first box, the driver reads the input buffer. We see there is no probing function before the usage. In the second box, there is a dereference of a pointer without checking if the buffer is null. So this also might crash the system. On the third box, the address could already be paged out causing a crash when writing to the output buffer. And besides that, the input and the output buffers access not in a try except block, try catch block. So the driver can get access denied and crash the system. And also, in the second box, just like in the second box, also in the fourth box, there is accessing to the input buffer without any validation. And lastly, it's not in a box, but the access to the output buffer doesn't involve probing, which will eventually allow us to do an arbitrary kernel write. Memory write. So, yeah, this is also a problem. Let's talk about the better brother in the family. The method buffer. So method buffer, in this case, the manager copies the buffers and the lamps to the kernel in a secure manner. So those reside in kernel memory, not in user space memory. You don't need to probe anything. So this is good. But you have to remember, if there's any fields that are embedded in the buffer, you need to treat them properly. So you need to do validations when you're accessing those. In this case, the input buffer and output buffer will be the system buffer as part of the IRP structure. And also, we have the IO status information, which actually, as I told you before, indicates how many bytes should be copied to the user's output buffer. If the IO status information is bigger than the input buffer length and the output buffer length is bigger than the input buffer length, the rest of the system buffer will be copied to the output buffer. It will be uninitialized memory. And this could lead to info leak or crashing the system. So let's say we have one page of the output buffer length. It's one page. The input buffer length, it's eight bytes. And the IO status information will be output buffer length. So we will leak about


chunk_text:
  buffers and the lamps to the kernel in a secure manner. So those reside in kernel memory, not in user space memory. You don't need to probe anything. So this is good. But you have to remember, if there's any fields that are embedded in the buffer, you need to treat them properly. So you need to do validations when you're accessing those. In this case, the input buffer and output buffer will be the system buffer as part of the IRP structure. And also, we have the IO status information, which actually, as I told you before, indicates how many bytes should be copied to the user's output buffer. If the IO status information is bigger than the input buffer length and the output buffer length is bigger than the input buffer length, the rest of the system buffer will be copied to the output buffer. It will be uninitialized memory. And this could lead to info leak or crashing the system. So let's say we have one page of the output buffer length. It's one page. The input buffer length, it's eight bytes. And the IO status information will be output buffer length. So we will leak about one page of memory from the kernel to the user space. All right. So here we have also an example to method buffer to implement a method buffer. Again, it's not safe to assume that this code is bug free. Of course, it's not if it's in the presentation. All right. So on the second box, we can see a nice length check. And beneath the check, they initialize some memory. After that, there is a if statement. If we fail to go into the first if statement, we'll go to the else. And in the else, there is a information with a really big number. Around 11K of kernel memory that could be leaked. And in this case, we'll just have a huge memory leak or we'll crash the system if we'll get into an invalid page. All right. Let's talk about direct IO. So in this case, we have two different methods. So we have method indirect and method IO direct. So in this case, there are two buffers that send into the kernel. So we have the system buffer and the MDL address. The second buffer is a direct buffer, which always will be paged in. So


chunk_text:
  one page of memory from the kernel to the user space. All right. So here we have also an example to method buffer to implement a method buffer. Again, it's not safe to assume that this code is bug free. Of course, it's not if it's in the presentation. All right. So on the second box, we can see a nice length check. And beneath the check, they initialize some memory. After that, there is a if statement. If we fail to go into the first if statement, we'll go to the else. And in the else, there is a information with a really big number. Around 11K of kernel memory that could be leaked. And in this case, we'll just have a huge memory leak or we'll crash the system if we'll get into an invalid page. All right. Let's talk about direct IO. So in this case, we have two different methods. So we have method indirect and method IO direct. So in this case, there are two buffers that send into the kernel. So we have the system buffer and the MDL address. The second buffer is a direct buffer, which always will be paged in. So faster access for us. And this buffer can be used either for input or output. A kernel driver can also create MDL by using IO create MDL. Which is quite important. We'll talk a little bit about that in the next slide. And if this function fails for some reason, so let's assume that you gave it an invalid page. So it will, for an exception, and if this one is not handled properly, you will crash the system. All right. So you might ask yourself what is MDL? So MDL is a structure that describes the fixed physical memory location that comprise a contiguous data buffer in virtual memory or in simpler words. So the MDL actually describes the data buffer in a fixed position in physical memory, which will be always paged in and locked in memory. So basically double mapping one for the user and one for the kernel. Let's see an example of not writing a good code with direct IO. So in this case, we can see in the red box, we have a full control over the MDL. So there is a variable with an original name, controllable virtual address. And here we can


chunk_text:
  faster access for us. And this buffer can be used either for input or output. A kernel driver can also create MDL by using IO create MDL. Which is quite important. We'll talk a little bit about that in the next slide. And if this function fails for some reason, so let's assume that you gave it an invalid page. So it will, for an exception, and if this one is not handled properly, you will crash the system. All right. So you might ask yourself what is MDL? So MDL is a structure that describes the fixed physical memory location that comprise a contiguous data buffer in virtual memory or in simpler words. So the MDL actually describes the data buffer in a fixed position in physical memory, which will be always paged in and locked in memory. So basically double mapping one for the user and one for the kernel. Let's see an example of not writing a good code with direct IO. So in this case, we can see in the red box, we have a full control over the MDL. So there is a variable with an original name, controllable virtual address. And here we can see that there is a call to MM probe and lock pages, which is not wrapped in try except lock. And if we will send an invalid virtual address, we will trigger a BSOD and we will actually crash the system. All right. So we talked a lot about mistakes that other developers do. We also I also showed you some examples. Let's get back to the MSI thing. All right. So back to my laptop. I tried to find the driver that Dragon Center interacts with. Lucky me, I found the one that it interacts with. It's WinIO, which is loaded by the Dragon Service. And I check if I have access to the device. It exposes. And fortunately, I do have access to interact with it. So I open IDA and started doing some reverse engineering. All right. So here is the decompiled code of the dispatch routine. Here we can see the system buffer, which is the buffer sent by the user to the driver and its length. And here we can see there is a switch case. A switch case goes over the different major function. And there's also another switch case embedded in it, which


chunk_text:
  see that there is a call to MM probe and lock pages, which is not wrapped in try except lock. And if we will send an invalid virtual address, we will trigger a BSOD and we will actually crash the system. All right. So we talked a lot about mistakes that other developers do. We also I also showed you some examples. Let's get back to the MSI thing. All right. So back to my laptop. I tried to find the driver that Dragon Center interacts with. Lucky me, I found the one that it interacts with. It's WinIO, which is loaded by the Dragon Service. And I check if I have access to the device. It exposes. And fortunately, I do have access to interact with it. So I open IDA and started doing some reverse engineering. All right. So here is the decompiled code of the dispatch routine. Here we can see the system buffer, which is the buffer sent by the user to the driver and its length. And here we can see there is a switch case. A switch case goes over the different major function. And there's also another switch case embedded in it, which goes over the different IOC that the driver supports. And for those of you who managed to see line 47, you might already found a bug. So in line 47, there is a mem copy from the user buffer with a controllable length to a local variable. So it actually means there is a potential buffer overflow here. Right? So, yeah. If you send a buffer in the size of 32X plus 8, we maybe would be able to overrun the return address. Right? And this is what we did. So we send the buffer and because the system. So, basically, we overwrite the return address and we manage to run code in the kernel. You're probably asking yourself, hold on. Isn't there any stack that would prevent this? So they didn't compile the driver with stack. And this is bad. Don't do that. Use stack. All right. So don't worry. It's not the only bug that exists in the driver. Basically, the driver also lets low level processes to read from IO ports and read to IO ports. And also, it lets you to yeah. All right? And also, it lets you to unmap and map physical memory into


chunk_text:
  goes over the different IOC that the driver supports. And for those of you who managed to see line 47, you might already found a bug. So in line 47, there is a mem copy from the user buffer with a controllable length to a local variable. So it actually means there is a potential buffer overflow here. Right? So, yeah. If you send a buffer in the size of 32X plus 8, we maybe would be able to overrun the return address. Right? And this is what we did. So we send the buffer and because the system. So, basically, we overwrite the return address and we manage to run code in the kernel. You're probably asking yourself, hold on. Isn't there any stack that would prevent this? So they didn't compile the driver with stack. And this is bad. Don't do that. Use stack. All right. So don't worry. It's not the only bug that exists in the driver. Basically, the driver also lets low level processes to read from IO ports and read to IO ports. And also, it lets you to yeah. All right? And also, it lets you to unmap and map physical memory into virtual addresses. So, basically, you can read the whole memory. Yeah. So, this driver was a really buggy one. I didn't find what I wanted to find. But I found a lot of bugs. Yeah. So, this is a lot of process. But wait. There is more. So, as I told you before, as a gamer, I want as much FPS in games as I can get. And only real gamers know that RGB gives you more FPS. So, I made another decision. Again, not the best decision, but it is a decision. And I went to the store and bought myself a gaming keyboard manufactured by Razer. All right. So, Razer was also kind enough to develop a program called Razer Synapse, which lets you control the RGB lights on your computer and stuff. And of course, as a good gaming program, it also has its own drivers. So, there is a driver that the Razer Synapse service loads called R0 Razer Synapse service. Original. And it exposes a device object name. Right. So, just like before, I located the driver file and started doing some reverse engineering. So, let's jump into the code. So, we also have the


chunk_text:
  virtual addresses. So, basically, you can read the whole memory. Yeah. So, this driver was a really buggy one. I didn't find what I wanted to find. But I found a lot of bugs. Yeah. So, this is a lot of process. But wait. There is more. So, as I told you before, as a gamer, I want as much FPS in games as I can get. And only real gamers know that RGB gives you more FPS. So, I made another decision. Again, not the best decision, but it is a decision. And I went to the store and bought myself a gaming keyboard manufactured by Razer. All right. So, Razer was also kind enough to develop a program called Razer Synapse, which lets you control the RGB lights on your computer and stuff. And of course, as a good gaming program, it also has its own drivers. So, there is a driver that the Razer Synapse service loads called R0 Razer Synapse service. Original. And it exposes a device object name. Right. So, just like before, I located the driver file and started doing some reverse engineering. So, let's jump into the code. So, we also have the main dispatch routine. We'll go to the device control function. Yep. So, fortunately here, we can see that the driver developers did something different. They did some validation over the buffer length. So, this is good. Right? So, we won't find any buffer overflows here, unfortunately. Yet, there are still some vulnerabilities in this as well. So, here we have a port read and write primitives, just as before. And also, we got this thing. So, this is actually interesting. Because the driver lets us to read and write to arbitrary MSRs. All right. So, at this point, you might ask yourself what MSRs are. All right. So, MSRs are model specific registers. So, it's basically any various control registers in x86 instruction set used for debugging, program execution pricing, computer performance monitoring, toggling certain CPU features. And there is MSR called IA32L star, which holds the pointer to the system call handler, which upon sys calls, this pointer is loaded into IRP. And as you can already understand, if you will overwrite this specific MSR with arbitrary pointer to whatever we want, we will achieve arbitrary code execution in kernel context. So, this is not good for the developers.


chunk_text:
  main dispatch routine. We'll go to the device control function. Yep. So, fortunately here, we can see that the driver developers did something different. They did some validation over the buffer length. So, this is good. Right? So, we won't find any buffer overflows here, unfortunately. Yet, there are still some vulnerabilities in this as well. So, here we have a port read and write primitives, just as before. And also, we got this thing. So, this is actually interesting. Because the driver lets us to read and write to arbitrary MSRs. All right. So, at this point, you might ask yourself what MSRs are. All right. So, MSRs are model specific registers. So, it's basically any various control registers in x86 instruction set used for debugging, program execution pricing, computer performance monitoring, toggling certain CPU features. And there is MSR called IA32L star, which holds the pointer to the system call handler, which upon sys calls, this pointer is loaded into IRP. And as you can already understand, if you will overwrite this specific MSR with arbitrary pointer to whatever we want, we will achieve arbitrary code execution in kernel context. So, this is not good for the developers. For us, it's great. All right. So, but we didn't do one thing. We didn't check if we have access to device object. So, let's jump into the driver entry to the Iocreate device. So, as I told you, the Iocreate device is the not secured one, which will create a device with a default security descriptor. So, in this case, it means that we will have access to the device and we will be able to trigger this vulnerability. So, previous escalation confirmed. Or is it? When we went to the device object properties, we looked at the security that applied to the device, and we can see that only administrators system can interact with that. So, we can see a clear inconsistent between the driver code and the device security object. So, the driver doesn't enforce any security descriptor. So, the only logical explanation for this phenomena is that some other process just changes the device object security. All right. So, basically, it will look something like this. So, we have the WinRing 0 driver loaded. Then the WinRing 0 creates a device with the default security descriptor. Then some random process just changes the security descriptor. And


chunk_text:
  For us, it's great. All right. So, but we didn't do one thing. We didn't check if we have access to device object. So, let's jump into the driver entry to the Iocreate device. So, as I told you, the Iocreate device is the not secured one, which will create a device with a default security descriptor. So, in this case, it means that we will have access to the device and we will be able to trigger this vulnerability. So, previous escalation confirmed. Or is it? When we went to the device object properties, we looked at the security that applied to the device, and we can see that only administrators system can interact with that. So, we can see a clear inconsistent between the driver code and the device security object. So, the driver doesn't enforce any security descriptor. So, the only logical explanation for this phenomena is that some other process just changes the device object security. All right. So, basically, it will look something like this. So, we have the WinRing 0 driver loaded. Then the WinRing 0 creates a device with the default security descriptor. Then some random process just changes the security descriptor. And here we are. Yeah. But there is a small time gap between the creation of the device object and the time that some random process just changes the security descriptor. So, there is a race condition there. And as attackers or security researchers, we can actually abuse this one. This is true as long as we are managed to run our code before the random process runs its code. Yeah. So, basically, after doing some research, some further research, we get into this one. So, Razor signup service uses an open source project called Libra, which loads the WinRing 0 driver. Then the WinRing 0 creates a device object. And there is a race condition. And some random process changes the device security descriptor. Fortunately, the Libra will monitor Lib. It's an open source project. So, we quite easily could find its source code. So, let's see what this one does. Right. So, here we can see the DLL actually open handle to the service manager and creates a new service or, in other words, in this case, creates a new driver. And then it's asked the service manager to load the driver. Right after that, it opens an handle


chunk_text:
  here we are. Yeah. But there is a small time gap between the creation of the device object and the time that some random process just changes the security descriptor. So, there is a race condition there. And as attackers or security researchers, we can actually abuse this one. This is true as long as we are managed to run our code before the random process runs its code. Yeah. So, basically, after doing some research, some further research, we get into this one. So, Razor signup service uses an open source project called Libra, which loads the WinRing 0 driver. Then the WinRing 0 creates a device object. And there is a race condition. And some random process changes the device security descriptor. Fortunately, the Libra will monitor Lib. It's an open source project. So, we quite easily could find its source code. So, let's see what this one does. Right. So, here we can see the DLL actually open handle to the service manager and creates a new service or, in other words, in this case, creates a new driver. And then it's asked the service manager to load the driver. Right after that, it opens an handle to the created device. Yep. All right. So, right after that, it opens handle to the created device and changes the security descriptor. Right. That's cool. Unfortunately, this service runs way before us. So, basically, we won't be able to win this race condition. As far as I know, we need only to restore the driver in order to restore the service in order to achieve to win this race condition. Yeah. So, this is bad. But they still want to find a way to exploit this vulnerability. Right? So, in order to restore the service, you need to be admin or in the privileged level. Or you can just trigger an update. So, basically, when there are updates, there is a signup program, commit an update. Everything shuts down. So, all the services and all the other stuff that comes with it just closes. The update is triggering. And then you can actually create a race condition. Unfortunately, updates happen once in a month. Twice. Like once in two months. So, this is not good for us. We want to trigger it upon our request. Right? So, we found that we can abuse the plugin mechanism to trigger an


chunk_text:
  to the created device. Yep. All right. So, right after that, it opens handle to the created device and changes the security descriptor. Right. That's cool. Unfortunately, this service runs way before us. So, basically, we won't be able to win this race condition. As far as I know, we need only to restore the driver in order to restore the service in order to achieve to win this race condition. Yeah. So, this is bad. But they still want to find a way to exploit this vulnerability. Right? So, in order to restore the service, you need to be admin or in the privileged level. Or you can just trigger an update. So, basically, when there are updates, there is a signup program, commit an update. Everything shuts down. So, all the services and all the other stuff that comes with it just closes. The update is triggering. And then you can actually create a race condition. Unfortunately, updates happen once in a month. Twice. Like once in two months. So, this is not good for us. We want to trigger it upon our request. Right? So, we found that we can abuse the plugin mechanism to trigger an update like scenario. So, yeah. Basically, Razer lets you to install some three plugins, maybe more. And we whenever you install a plugin, so, it will consider as an update. Everything will shut down. And then we can trigger the race condition. And another fun fact about the source code, there is a to do, which replaced with call to Iocreate device secure driver. They didn't do that until today. So, yeah. All right. So, this is how the flow looks like. So, we will write our POCX. It will ask a Razer service to install the plugin. A Razer GMS service will initiate an update like scenario, which shuts everything down. Wing 0 will be unloaded. Then it will be reloaded and it will create an object with a default security descriptor. We have our race condition there. And then the DLL will change the device security descriptor. All right. So, let's see a demo. Cool. So, you have the Razer setups. All right. So, here we can see all the plugins you can install. We will install the Alexa plugin, for example. Yeah. We run as low privilege user without that many privileges, unfortunately. We will run our


chunk_text:
  update like scenario. So, yeah. Basically, Razer lets you to install some three plugins, maybe more. And we whenever you install a plugin, so, it will consider as an update. Everything will shut down. And then we can trigger the race condition. And another fun fact about the source code, there is a to do, which replaced with call to Iocreate device secure driver. They didn't do that until today. So, yeah. All right. So, this is how the flow looks like. So, we will write our POCX. It will ask a Razer service to install the plugin. A Razer GMS service will initiate an update like scenario, which shuts everything down. Wing 0 will be unloaded. Then it will be reloaded and it will create an object with a default security descriptor. We have our race condition there. And then the DLL will change the device security descriptor. All right. So, let's see a demo. Cool. So, you have the Razer setups. All right. So, here we can see all the plugins you can install. We will install the Alexa plugin, for example. Yeah. We run as low privilege user without that many privileges, unfortunately. We will run our exploit. So, now, actually, we're downloading the Alexa plugin. After it finishes downloading, we will send a message to the GMS service to install the plugin. Here we can see that everything shuts down. The service is unloaded and deleted. Now it's reloaded and we will try to open handle to it. We manage to open handle. We abuse the MSR IA32 to run code and we manage to change our permission into system or application token. Right. So, let's talk about aggregation. So, basically, we use ViewersTotal to find even more vulnerabilities. Most of the time you will use ViewersTotal to run for malwares. So, we came up with an idea to find similar vulnerable drivers. Because the one that MSI used is really similar to the one that Razer actually is using. So, we thought that there might be more. So, we wrote a simple return job query that includes some debug strings from the driver and we found 114 drivers that exist out there by that too many vendors actually using those. We are talking about ASRock, MSI, Razer, ASUS, memory, and much more. So, this actually was really nice to find even more vulnerable drivers by


chunk_text:
  exploit. So, now, actually, we're downloading the Alexa plugin. After it finishes downloading, we will send a message to the GMS service to install the plugin. Here we can see that everything shuts down. The service is unloaded and deleted. Now it's reloaded and we will try to open handle to it. We manage to open handle. We abuse the MSR IA32 to run code and we manage to change our permission into system or application token. Right. So, let's talk about aggregation. So, basically, we use ViewersTotal to find even more vulnerabilities. Most of the time you will use ViewersTotal to run for malwares. So, we came up with an idea to find similar vulnerable drivers. Because the one that MSI used is really similar to the one that Razer actually is using. So, we thought that there might be more. So, we wrote a simple return job query that includes some debug strings from the driver and we found 114 drivers that exist out there by that too many vendors actually using those. We are talking about ASRock, MSI, Razer, ASUS, memory, and much more. So, this actually was really nice to find even more vulnerable drivers by just using ViewersTotal. Yeah. All right. So, let's talk about mitigations. So, interestingly, just by having Hyper-V enabled on your system, you can mitigate some of the risks we talked about. So, hypervisors, by design, can intercept any modification action initiated by the OS kernel. And Hyper-V, by default, prevents any modification to I32L star because it doesn't make sense that you will want to change this one. As long as you're a legitimate user, if you're an attacker. So, yeah. You might want to do that, but Hyper-V won't let you. Unfortunately, Hyper-V can do that and won't protect you from buffer overflows and stuff like this. All right. So, this problem is fixed. Sadly, only partially. The kernel driver is still there and it's actually still being used by different vendors. I don't know why, but it still happens. As an end user, I will recommend you to enable Hyper-V on the system and use antivirus that blocks malicious drivers. So, some of those drivers are considered to be malicious nowadays. As a developer, please, don't use the WinIO codebase. And neither any of the different variations like WinRing 0, MSI 64, and et cetera. And if you


chunk_text:
  just using ViewersTotal. Yeah. All right. So, let's talk about mitigations. So, interestingly, just by having Hyper-V enabled on your system, you can mitigate some of the risks we talked about. So, hypervisors, by design, can intercept any modification action initiated by the OS kernel. And Hyper-V, by default, prevents any modification to I32L star because it doesn't make sense that you will want to change this one. As long as you're a legitimate user, if you're an attacker. So, yeah. You might want to do that, but Hyper-V won't let you. Unfortunately, Hyper-V can do that and won't protect you from buffer overflows and stuff like this. All right. So, this problem is fixed. Sadly, only partially. The kernel driver is still there and it's actually still being used by different vendors. I don't know why, but it still happens. As an end user, I will recommend you to enable Hyper-V on the system and use antivirus that blocks malicious drivers. So, some of those drivers are considered to be malicious nowadays. As a developer, please, don't use the WinIO codebase. And neither any of the different variations like WinRing 0, MSI 64, and et cetera. And if you do, please, fix the embedded security issues. All right. So, we got some CVs during the research. We also wrote a blog post about that. The QR code will be also in the next slide if you want to scan it. So, yeah. Thank you very much. I had a great time presenting this talk to you. And feel free to contact me via Twitter for any questions. I'm also around here. Thank you. Do you have any questions? Yep. Might get you the microphone. Thanks for the great talk. So, you have said that the Hypervisor intercepts the rights to the MSRs. But does it do it for all the MSRs? No, actually. So, basically, it can catch every MSR change, but it treats different MSRs. Like, whenever it needs to block the change, it will. Whenever it just needs to pass it along. So, is there still potential that maybe some other MSRs would actually allow you to, like, exploit this further, even on the Hypervisors? Maybe. It depends on the MSR. I know you might do some research on that and find out. Yeah. And I've got also a question about the... Because you are changing the


chunk_text:
  do, please, fix the embedded security issues. All right. So, we got some CVs during the research. We also wrote a blog post about that. The QR code will be also in the next slide if you want to scan it. So, yeah. Thank you very much. I had a great time presenting this talk to you. And feel free to contact me via Twitter for any questions. I'm also around here. Thank you. Do you have any questions? Yep. Might get you the microphone. Thanks for the great talk. So, you have said that the Hypervisor intercepts the rights to the MSRs. But does it do it for all the MSRs? No, actually. So, basically, it can catch every MSR change, but it treats different MSRs. Like, whenever it needs to block the change, it will. Whenever it just needs to pass it along. So, is there still potential that maybe some other MSRs would actually allow you to, like, exploit this further, even on the Hypervisors? Maybe. It depends on the MSR. I know you might do some research on that and find out. Yeah. And I've got also a question about the... Because you are changing the LSTAR MSR so that if I understood correctly, you can then specify, like, what will be the syscall handler, right? But how do you, like, place your executable code in the kernel? Or is there, like, no SMAP or SMAP or things like that on Windows? Right. So, this is actually a good question. So, you don't have SMAP with A. You do have SMAP with E. So, you cannot actually let the kernel just change into user space code, and it will just run it in the internal context. So, basically, what I did there, I used a really cool open source project called MSR exec, which let you just do that. So, basically, you are creating a ROP on the stack to disable the SMAP mitigation. Then you just jump to your user model function and everything. Okay. Very nice. Thank you. Okay. So, regarding the previous question, there's a really good blog post about secure kernel page guard, which runs in the Hyper-V mitigation. And it explains in detail how it works, what are the extents, etc. So, it describes all the MSRs which are handled, which are not, and stuff. Because there's much more. It protects


chunk_text:
  LSTAR MSR so that if I understood correctly, you can then specify, like, what will be the syscall handler, right? But how do you, like, place your executable code in the kernel? Or is there, like, no SMAP or SMAP or things like that on Windows? Right. So, this is actually a good question. So, you don't have SMAP with A. You do have SMAP with E. So, you cannot actually let the kernel just change into user space code, and it will just run it in the internal context. So, basically, what I did there, I used a really cool open source project called MSR exec, which let you just do that. So, basically, you are creating a ROP on the stack to disable the SMAP mitigation. Then you just jump to your user model function and everything. Okay. Very nice. Thank you. Okay. So, regarding the previous question, there's a really good blog post about secure kernel page guard, which runs in the Hyper-V mitigation. And it explains in detail how it works, what are the extents, etc. So, it describes all the MSRs which are handled, which are not, and stuff. Because there's much more. It protects the core of the Windows kernel, so you cannot hijack some of the pages, and more like that. You're talking about the one that Jordan Shafir wrote, right? Probably, yes. Yep. Hello. Thank you. Very nice talk. I have a little question. So, you said several times developers have a lot to know about. How is the documentation? It's pretty good. Well, the major problem here was that this codebase actually written in the early 2000s. And it's still being used today. And actually, this was written as a proof of concept, not a production driver. For some reason, it's still being used as a production driver. I don't know why. Yeah. So, it's created a lot of problems, really. Any questions? That's rather a comment. Maybe someone should create an AV product where they would try to disassemble their drivers, like custom drivers, and try to find out those bugs and block them. Yeah. So, Microsoft tried to do some of this. And also, some of the variation of this driver is actually in the block list of the driver that should not be loaded. So, Defender should block this one. But there are too many variations of this


chunk_text:
  the core of the Windows kernel, so you cannot hijack some of the pages, and more like that. You're talking about the one that Jordan Shafir wrote, right? Probably, yes. Yep. Hello. Thank you. Very nice talk. I have a little question. So, you said several times developers have a lot to know about. How is the documentation? It's pretty good. Well, the major problem here was that this codebase actually written in the early 2000s. And it's still being used today. And actually, this was written as a proof of concept, not a production driver. For some reason, it's still being used as a production driver. I don't know why. Yeah. So, it's created a lot of problems, really. Any questions? That's rather a comment. Maybe someone should create an AV product where they would try to disassemble their drivers, like custom drivers, and try to find out those bugs and block them. Yeah. So, Microsoft tried to do some of this. And also, some of the variation of this driver is actually in the block list of the driver that should not be loaded. So, Defender should block this one. But there are too many variations of this driver. And they always resign those. So, basically, you cannot find all the different variations, as long as you're not really putting a lot of effort into that. And unfortunately, nobody did it by today. Other questions? All right. All right. So, thank you again. Thank you. Thank you, guys. A round of applause.


chunk_text:
  driver. And they always resign those. So, basically, you cannot find all the different variations, as long as you're not really putting a lot of effort into that. And unfortunately, nobody did it by today. Other questions? All right. All right. So, thank you again. Thank you. Thank you, guys. A round of applause.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=jy1filtQY4w", "title": "USBvalve: Expose USB Activity On The Fly by Cesare Pizzi", "description": "", "channel_url": "https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA", "duration": 2568, "channel": "scrt.insomnihack", "uploader": "scrt.insomnihack", "upload_date": "20230411" } This text was transcribed using whisper model: large-v2 Hello, everybody. Thank you for being here today. And we are speaking about USBValve, which is kind of a strange thing that I created. So let's start with a bit of presentation from myself. My name is Cesare Pizzi, and I work for an Italian company, Sorrent Lab, which is doing a lot of things in IT. And I'm following more or less the security part in that company. So I'm here today with you, because I love hacking, obviously. And also thank you to the organizer, because I would like to thank them for such a great event, because it's really, really great. And what I do usually in security field, it's, let's say, I work a lot with open source software. I'm really an open source advocate, and I like to participate and to contribute to several open source projects like, you know, Volatility, Persistent Sniper, C2s, a lot of other have my contribution in some ways, PickEasy, I had a lot of them. And also I have a couple of major projects run by me directly, like Resploit, and CNUAL, some others. So if you want to have a look to what I'm doing, just have a look to my GitHub. And open issues, get in touch with me, also on Twitter, with Redshift. So I'm more than happy to hear from you, and to discuss with you about any things related to security and so on. And okay, sorry for the flashy presentation today. I think I'm going to burn some eyes today, but okay. I like very much these templates coming from Slight Carnival. And so I decided to use it even if it's a bit, yes, a bit flashy. Yeah. Okay. Let's now start and go into the presentation. And starting from which is the problem I would like to solve, which is, first of all, my problem. Because if it's your problem, you will find a solution. Then you maybe also try to find out if it's a problem of someone else, which is even better, because in this point, in this case, you are going to solve also a problem of someone else. But let's start from


chunk_text:
  them. And also I have a couple of major projects run by me directly, like Resploit, and CNUAL, some others. So if you want to have a look to what I'm doing, just have a look to my GitHub. And open issues, get in touch with me, also on Twitter, with Redshift. So I'm more than happy to hear from you, and to discuss with you about any things related to security and so on. And okay, sorry for the flashy presentation today. I think I'm going to burn some eyes today, but okay. I like very much these templates coming from Slight Carnival. And so I decided to use it even if it's a bit, yes, a bit flashy. Yeah. Okay. Let's now start and go into the presentation. And starting from which is the problem I would like to solve, which is, first of all, my problem. Because if it's your problem, you will find a solution. Then you maybe also try to find out if it's a problem of someone else, which is even better, because in this point, in this case, you are going to solve also a problem of someone else. But let's start from my problem, which is USB drives. And why we may think that USB drives are still an issue in 2023. Because at the beginning, I was thinking that malware spreading via USB was something from the past. It's not actually the case. Because I started to look around, and I see that we have a lot of examples of malware still using USB to spread. And I did a little research for this. And I'm mentioning here some of them. One is Mistclock. You can find some great analysis at these links. Okay. They are written a bit, but I will release the slides with the repository, so no problem. You can get them. Raspberry Robins, something like NJRat, Try2Cry, PlugX. These names will recur into the presentations, because I would like to show you how this software is actually using USB to spread, and why this is an issue for my side, and why I try to build something to make these things a little better. And you may think that, yes, in 2023, USB spreading, it's pretty outdated. Actually, you may think why it's still something at these days. First of all, because the implementation is pretty easy.


chunk_text:
  my problem, which is USB drives. And why we may think that USB drives are still an issue in 2023. Because at the beginning, I was thinking that malware spreading via USB was something from the past. It's not actually the case. Because I started to look around, and I see that we have a lot of examples of malware still using USB to spread. And I did a little research for this. And I'm mentioning here some of them. One is Mistclock. You can find some great analysis at these links. Okay. They are written a bit, but I will release the slides with the repository, so no problem. You can get them. Raspberry Robins, something like NJRat, Try2Cry, PlugX. These names will recur into the presentations, because I would like to show you how this software is actually using USB to spread, and why this is an issue for my side, and why I try to build something to make these things a little better. And you may think that, yes, in 2023, USB spreading, it's pretty outdated. Actually, you may think why it's still something at these days. First of all, because the implementation is pretty easy. It's a lot easier than implementing any other kind of warming, or network spreading, or whatever else. It's just a matter of enumerating devices and write something there. Second thing is that, probably, USB drives are easily exchanged without precautions. Even me, that I'm a, let's say, security guy and so on, I see a lot of times USB drives put in some unknown PC and so on without many precautions. And third, probably the most important reason is that USB allows spillover. So when you deploy a malware, you are in some ways sandboxed in a network or in segmented spaces, because you cannot get out of them. And USB allows you to pass these kind of barriers and get maybe in something that is not expected. So I think that that's the reason why this is still used, and this is still a problem, actually. It's not just something related to malware, actually, because every time you are inserting a USB key in a system, you don't know what is really happening. This is at least what, which is my feeling. When I put a key in someone else's PC, I still don't know what is going on,


chunk_text:
  It's a lot easier than implementing any other kind of warming, or network spreading, or whatever else. It's just a matter of enumerating devices and write something there. Second thing is that, probably, USB drives are easily exchanged without precautions. Even me, that I'm a, let's say, security guy and so on, I see a lot of times USB drives put in some unknown PC and so on without many precautions. And third, probably the most important reason is that USB allows spillover. So when you deploy a malware, you are in some ways sandboxed in a network or in segmented spaces, because you cannot get out of them. And USB allows you to pass these kind of barriers and get maybe in something that is not expected. So I think that that's the reason why this is still used, and this is still a problem, actually. It's not just something related to malware, actually, because every time you are inserting a USB key in a system, you don't know what is really happening. This is at least what, which is my feeling. When I put a key in someone else's PC, I still don't know what is going on, because I don't have any kind of visible visibility on that. And maybe it's just not a matter of something writing on my disk, but maybe something is maybe stealing my files. Do I remember which file I had on this key that I'm not using from two months or something like that? Probably not. And so this is why I decided to build USB Valve. So what it is, it's a very simple way to have visibility on what a system is doing when you insert a USB drive in a system. So it's actually a hardware project. And okay, now we come to this part, because it's a keychain, we'll see. And okay, yes, it's built on something that it's really easy to find, cheap, and well-known. And so I decided to build this hardware project on a couple of things which are probably well-known, probably you know them. One is the Raspberry Pi which is something like $6 board, probably you can find it also for less than this if you look around in the internet. And the second part, which is the only other hardware part needed for building this, it's an OLED screen, which is


chunk_text:
  because I don't have any kind of visible visibility on that. And maybe it's just not a matter of something writing on my disk, but maybe something is maybe stealing my files. Do I remember which file I had on this key that I'm not using from two months or something like that? Probably not. And so this is why I decided to build USB Valve. So what it is, it's a very simple way to have visibility on what a system is doing when you insert a USB drive in a system. So it's actually a hardware project. And okay, now we come to this part, because it's a keychain, we'll see. And okay, yes, it's built on something that it's really easy to find, cheap, and well-known. And so I decided to build this hardware project on a couple of things which are probably well-known, probably you know them. One is the Raspberry Pi which is something like $6 board, probably you can find it also for less than this if you look around in the internet. And the second part, which is the only other hardware part needed for building this, it's an OLED screen, which is something like eight or maybe less dollars. So it's something like $10 or something more you can build it, and you can have your own checker for this kind of things. Why I decided to go with the Pi Pico? Because it is well-documented, it has a very good SDK, it's well-known, well-supported, and so on. So it's really a great platform and I would suggest you to use it also for your hardware projects if you have anything about this. So I try to keep things simple in this case. So at a certain point of the project, I thought to use a real SD card in order to emulate the drive and have some storage. But then I decided to go with an emulation. So what I'm doing, it's actually, I'm emulating everything into the RAM of the Pi Pico and nothing else is needed other than the two components before. The very same code should run on any RP2040 platforms, like for example, the Arduino Nano has a specific version of the boards with this processor on it. Probably it's overkill because that board also has a lot of other functions and it costs a bit more


chunk_text:
  something like eight or maybe less dollars. So it's something like $10 or something more you can build it, and you can have your own checker for this kind of things. Why I decided to go with the Pi Pico? Because it is well-documented, it has a very good SDK, it's well-known, well-supported, and so on. So it's really a great platform and I would suggest you to use it also for your hardware projects if you have anything about this. So I try to keep things simple in this case. So at a certain point of the project, I thought to use a real SD card in order to emulate the drive and have some storage. But then I decided to go with an emulation. So what I'm doing, it's actually, I'm emulating everything into the RAM of the Pi Pico and nothing else is needed other than the two components before. The very same code should run on any RP2040 platforms, like for example, the Arduino Nano has a specific version of the boards with this processor on it. Probably it's overkill because that board also has a lot of other functions and it costs a bit more than a Raspberry Pi. So I think that you can go with Raspberry Pi Pico, but it's actually compatible with any platform, probably, or supporting tiny USB library, sorry, which is the library on which the project has been built. Also, I created a PCB because I would like to keep things compact and tough. And so I created a super simple custom PCB where you can put the components on and you can build your own key. And this is what actually results at the end. So this is the final result. You can also build by your own with the instruction, the repository. And now during the presentation, we'll go through an example of how it works and how it actually helps you in securing your USB activities in the future, let's say. There is also, if you want, there is also a surprise. I printed a bunch of, okay, this PCB is not mandatory. So you can build your own with breadboard or whatever you want, just wiring and something. But if you want a PCB, I have some of them here with me. I'm giving them away. So if you want one for building your own,


chunk_text:
  than a Raspberry Pi. So I think that you can go with Raspberry Pi Pico, but it's actually compatible with any platform, probably, or supporting tiny USB library, sorry, which is the library on which the project has been built. Also, I created a PCB because I would like to keep things compact and tough. And so I created a super simple custom PCB where you can put the components on and you can build your own key. And this is what actually results at the end. So this is the final result. You can also build by your own with the instruction, the repository. And now during the presentation, we'll go through an example of how it works and how it actually helps you in securing your USB activities in the future, let's say. There is also, if you want, there is also a surprise. I printed a bunch of, okay, this PCB is not mandatory. So you can build your own with breadboard or whatever you want, just wiring and something. But if you want a PCB, I have some of them here with me. I'm giving them away. So if you want one for building your own, you can just ask me just after the talk, I will give you one of these without any issue. I have a bunch of them, so not too much, but I'm more than happy to give it to you if you want to build one. You will see at the end of the presentation if you want, actually. So we spoke about the hardware because that was the other part, but obviously this is not only done with hardware because there is also the SAM software, which is the firmware of this device. And the software, it's based on TinyUSB library, which is a library built to emulate in some way USB activities in a lot of ways, actually. So it's a very wide library doing a lot of things. And what I did, it's to create a fake file system directly on the RAM of the Pico and monitoring what is going on when this key is actually plugged into the system. The file system has been crafted in a proper way. I use the word crafted here because actually it has been necessary to put things in the proper place in order to avoid false positive and something


chunk_text:
  you can just ask me just after the talk, I will give you one of these without any issue. I have a bunch of them, so not too much, but I'm more than happy to give it to you if you want to build one. You will see at the end of the presentation if you want, actually. So we spoke about the hardware because that was the other part, but obviously this is not only done with hardware because there is also the SAM software, which is the firmware of this device. And the software, it's based on TinyUSB library, which is a library built to emulate in some way USB activities in a lot of ways, actually. So it's a very wide library doing a lot of things. And what I did, it's to create a fake file system directly on the RAM of the Pico and monitoring what is going on when this key is actually plugged into the system. The file system has been crafted in a proper way. I use the word crafted here because actually it has been necessary to put things in the proper place in order to avoid false positive and something that we'll see during the presentation. Obviously, I'm exposing more space than what I have available on the RAM of the Pico because the Pico does not have a lot of RAM. I'm exposing more space. So the system thinks that I'm inserting a USB drive with some space, which does not exist, actually. But that's not our point because we don't need to store files. We need to monitor activity on the USB part. So not a problem, this one. And okay, we'll see how it works. As I said, I had to craft the file system because in order to have it working in a proper way on both Linux and Windows, I had to place files in specific clusters, in specific places in order to avoid caching issue and some other things we will see during the presentation. And I created this fake OS, sorry, fake file system. And this is already done and ready to be loaded. You can also create your own. We will see how at the end of the presentation. If you want to personalize it or customize it, for example, you can do it. No mockery here. The fake file system is


chunk_text:
  that we'll see during the presentation. Obviously, I'm exposing more space than what I have available on the RAM of the Pico because the Pico does not have a lot of RAM. I'm exposing more space. So the system thinks that I'm inserting a USB drive with some space, which does not exist, actually. But that's not our point because we don't need to store files. We need to monitor activity on the USB part. So not a problem, this one. And okay, we'll see how it works. As I said, I had to craft the file system because in order to have it working in a proper way on both Linux and Windows, I had to place files in specific clusters, in specific places in order to avoid caching issue and some other things we will see during the presentation. And I created this fake OS, sorry, fake file system. And this is already done and ready to be loaded. You can also create your own. We will see how at the end of the presentation. If you want to personalize it or customize it, for example, you can do it. No mockery here. The fake file system is just a giant array like this one. So nothing, it's not rocket science. It's a giant array done with things in the proper place. And okay, what I would like to do now, it's going with you through some field testing because actually I built this and I would like also to show you how and why it is. I think it's still useful to have something like that. I didn't mention that the PCB has also a convenient hole for using to be a keychain like this one. For example, I'm using actually, this is the key of my car. And I'm actually using, even if it's everything exposed, it is pretty tough. So you can use it actually without breaking anything. And okay, field testing means that we are going to test it with four real malwares. And we will see four different techniques used by these malware to trigger execution and to infect through USB. We will see that some of them will be pretty naive and not really sophisticated, but then we will see also something more interesting and more difficult to spot out and to identify. Obviously, as I said, these, all these malware and


chunk_text:
  just a giant array like this one. So nothing, it's not rocket science. It's a giant array done with things in the proper place. And okay, what I would like to do now, it's going with you through some field testing because actually I built this and I would like also to show you how and why it is. I think it's still useful to have something like that. I didn't mention that the PCB has also a convenient hole for using to be a keychain like this one. For example, I'm using actually, this is the key of my car. And I'm actually using, even if it's everything exposed, it is pretty tough. So you can use it actually without breaking anything. And okay, field testing means that we are going to test it with four real malwares. And we will see four different techniques used by these malware to trigger execution and to infect through USB. We will see that some of them will be pretty naive and not really sophisticated, but then we will see also something more interesting and more difficult to spot out and to identify. Obviously, as I said, these, all these malware and all these BU activities will be cached and disposed by USB valve. And we will see some of the samples at the end. It looks, when I started this, let's say this research on the field testing, I noticed that a lot of authors, malware authors that are using USB spreading techniques are using .NET executables. At the beginning, I thought it was because maybe we were facing some naive and simple malware, so written baby, but not sophisticated attacker or something like that. And it is true, for example, for a couple of the malware we will see, which are ngerat and try2cry, for example. ngerat, it's a random, sorry, an access Trojan and try2cry, it's a ransomware. These two are actually not so sophisticated malware, we'll see. But we have a couple of other examples in the same, in the same testing. And one is Raspberry Robin, the other one is Plugix. And we are facing here a completely different story. We are facing with some real complex malware here. And we see that they are also using more sophisticated technique to trick the user in doing something that it shouldn't. Let's start, sorry, let's start with the


chunk_text:
  all these BU activities will be cached and disposed by USB valve. And we will see some of the samples at the end. It looks, when I started this, let's say this research on the field testing, I noticed that a lot of authors, malware authors that are using USB spreading techniques are using .NET executables. At the beginning, I thought it was because maybe we were facing some naive and simple malware, so written baby, but not sophisticated attacker or something like that. And it is true, for example, for a couple of the malware we will see, which are ngerat and try2cry, for example. ngerat, it's a random, sorry, an access Trojan and try2cry, it's a ransomware. These two are actually not so sophisticated malware, we'll see. But we have a couple of other examples in the same, in the same testing. And one is Raspberry Robin, the other one is Plugix. And we are facing here a completely different story. We are facing with some real complex malware here. And we see that they are also using more sophisticated technique to trick the user in doing something that it shouldn't. Let's start, sorry, let's start with the very first one, which is ngerat, which is a pretty simple malware. This is, okay, it's, as I said, it's written in .NET. And we can see here one of the most basic way of infecting or spreading through USB, which is the usage of the autorun.inf file, which is a file that is saved on, could be, can be saved on a USB in order to be, in order to trigger automatic execution of specific executable. This is done through, you see, it's not even obfuscated or nothing into the, into the malware. And it's done in a very clear way. What happens is that this is going to write this file pointing to an executable, which is in this case, in number two, the svchost. This will be triggered if the system where you are going to put the key has the autoplay function of Windows on. The autoplay function actually executes this part. Most of the systems right now does have this disabled. So it's not real, a sophisticated way of conducting an attack using USB. But okay, it's, it's one of the way they can use it as being used by this, this file here. Let's


chunk_text:
  very first one, which is ngerat, which is a pretty simple malware. This is, okay, it's, as I said, it's written in .NET. And we can see here one of the most basic way of infecting or spreading through USB, which is the usage of the autorun.inf file, which is a file that is saved on, could be, can be saved on a USB in order to be, in order to trigger automatic execution of specific executable. This is done through, you see, it's not even obfuscated or nothing into the, into the malware. And it's done in a very clear way. What happens is that this is going to write this file pointing to an executable, which is in this case, in number two, the svchost. This will be triggered if the system where you are going to put the key has the autoplay function of Windows on. The autoplay function actually executes this part. Most of the systems right now does have this disabled. So it's not real, a sophisticated way of conducting an attack using USB. But okay, it's, it's one of the way they can use it as being used by this, this file here. Let's go to the second example, which is try2cry. Try2cry, it's a ransomware. Even in this case, we are facing with a very simple one, very simple, very simple ransomware here. And even in this case, we are going to use a very basic way of enumerating the devices and writing on them. And the different technique used by try2cry here is just to create some files, as you can see, in .3 and .4 on USB. And these files, okay, are written in Arabic, so probably the target of try2cry was Arabic countries, are some fancy, fancy name, let's say, in order to trigger the execution from the user. Even in this case, okay, we see some files named important.exe, password.exe, and so on, so that the user maybe double click on them, executing the ransomware itself. So even in this case, nothing, it's really complex or really sophisticated. We are speaking about field testing here, mainly about Windows environments, because actually, in this case, USB spreading files, USB spreading malware, it's focused more on Windows. I tried to look for Linux samples of this kind of things, of this kind of spreading, but I didn't find any, probably also


chunk_text:
  go to the second example, which is try2cry. Try2cry, it's a ransomware. Even in this case, we are facing with a very simple one, very simple, very simple ransomware here. And even in this case, we are going to use a very basic way of enumerating the devices and writing on them. And the different technique used by try2cry here is just to create some files, as you can see, in .3 and .4 on USB. And these files, okay, are written in Arabic, so probably the target of try2cry was Arabic countries, are some fancy, fancy name, let's say, in order to trigger the execution from the user. Even in this case, okay, we see some files named important.exe, password.exe, and so on, so that the user maybe double click on them, executing the ransomware itself. So even in this case, nothing, it's really complex or really sophisticated. We are speaking about field testing here, mainly about Windows environments, because actually, in this case, USB spreading files, USB spreading malware, it's focused more on Windows. I tried to look for Linux samples of this kind of things, of this kind of spreading, but I didn't find any, probably also because, I guess, Linux has less the focus on removable device, more on file system. So probably it's not really something that we will see in Linux environments, because it's, they are more, let's say, Linux in general as environment, it's more focused on file system view, more than removable or not removable devices. Let's go to something more complex then, because now we are speaking about a different malware here, Raspberry Robin. It has been around starting from probably November, December of the last year, and we had some analysis done on that by Microsoft and Canary. This malware, it's pretty complex, it's still around, and it actually use USB to spread, also USB, not only USB, because actually, when it comes to this kind of malware, we will see that the spreading is done through different ways. So USB, it's one of them, it's not just the only one like the previous two we saw. We have a couple of analysis here done by Raspberry, as I said, from Red Canary and Microsoft. They are very well done, so I will look to them. And this is the infection chain used by Raspberry Robin, for example. You see


chunk_text:
  because, I guess, Linux has less the focus on removable device, more on file system. So probably it's not really something that we will see in Linux environments, because it's, they are more, let's say, Linux in general as environment, it's more focused on file system view, more than removable or not removable devices. Let's go to something more complex then, because now we are speaking about a different malware here, Raspberry Robin. It has been around starting from probably November, December of the last year, and we had some analysis done on that by Microsoft and Canary. This malware, it's pretty complex, it's still around, and it actually use USB to spread, also USB, not only USB, because actually, when it comes to this kind of malware, we will see that the spreading is done through different ways. So USB, it's one of them, it's not just the only one like the previous two we saw. We have a couple of analysis here done by Raspberry, as I said, from Red Canary and Microsoft. They are very well done, so I will look to them. And this is the infection chain used by Raspberry Robin, for example. You see here that we are facing something a lot more complex than what we saw before. So it's not just a matter of a simple malware written in .NET and so on, so it's really complex. And if you really want to go through and to deep dive into the complexity of this, you may have a look to the sample or to this analysis done by Avast, where you see Raspberry Robin and deploying also Roshistack, where you can see that this malware has something like 14 levels of different encryption obfuscations, one into the other, with tons of tricks of like anti-VM, anti-debug, anti-sandbox, and so on. So in this case, we are facing with another story. This is coming from an advanced attacker and uses USB as one of the ways for spreading. It creates, in this case, it uses a different technique. It creates a LNK file, which is a link file in Windows, disguised as a folder. It can use a name like Recovery or maybe USB drive brands like Samsung or whatever, or Fairbatim or something like that, because in this way, it can maybe trick you in double click on it with thinking that


chunk_text:
  here that we are facing something a lot more complex than what we saw before. So it's not just a matter of a simple malware written in .NET and so on, so it's really complex. And if you really want to go through and to deep dive into the complexity of this, you may have a look to the sample or to this analysis done by Avast, where you see Raspberry Robin and deploying also Roshistack, where you can see that this malware has something like 14 levels of different encryption obfuscations, one into the other, with tons of tricks of like anti-VM, anti-debug, anti-sandbox, and so on. So in this case, we are facing with another story. This is coming from an advanced attacker and uses USB as one of the ways for spreading. It creates, in this case, it uses a different technique. It creates a LNK file, which is a link file in Windows, disguised as a folder. It can use a name like Recovery or maybe USB drive brands like Samsung or whatever, or Fairbatim or something like that, because in this way, it can maybe trick you in double click on it with thinking that that's a folder, but because it has actually a icon folder on that. And now I would like to have to the last one, which is probably the funnest one, I think, because in some way, it target as like a security analyst or malware analyst, because PLUGIX, at least in one of some of the samples, has been sent out as a XDBG DLL, so the famous debugger. You can have a look to it in this analysis done by Palo Alto, where you can see this kind of analysis. And here I would like to stop one second, because I would like to personally thank you to Duncan, who is the maintainer of XDBG project, who is doing a lot of work on it. I think that as a malware analyst, and all the malware analysts are using it, so I would like to ask him, I would like to ask you to contribute to the project itself by donation or by also working on the project. He already fixed this issue, because the issue that is using PLUGIX to spread in this case, it's because it's tried to sideload DLLs into the XDBG, and he already fixed


chunk_text:
  that's a folder, but because it has actually a icon folder on that. And now I would like to have to the last one, which is probably the funnest one, I think, because in some way, it target as like a security analyst or malware analyst, because PLUGIX, at least in one of some of the samples, has been sent out as a XDBG DLL, so the famous debugger. You can have a look to it in this analysis done by Palo Alto, where you can see this kind of analysis. And here I would like to stop one second, because I would like to personally thank you to Duncan, who is the maintainer of XDBG project, who is doing a lot of work on it. I think that as a malware analyst, and all the malware analysts are using it, so I would like to ask him, I would like to ask you to contribute to the project itself by donation or by also working on the project. He already fixed this issue, because the issue that is using PLUGIX to spread in this case, it's because it's tried to sideload DLLs into the XDBG, and he already fixed it, actually, as said, as you can see here in the comment of his repository. So, big thank you and kudos to Duncan for his hard work on this. Close parentheses, and let's go back on the PLUGIX, which is, as I said, distributed as an X32 bridge DLL file, which is sideloaded when you start X64DBG application. The payload itself, it's into the X32 bridge.file. So, that is something that could be sideloaded starting. It was sideloaded, because now it has been fixed, starting XDBG. And what is going on is that, in various things he's doing, it's also spreading in a similar way of Raspberry Robin, but there is something more, which is very interesting and very clever from this point of view. It creates a LNK file, again, disguised as a device in this case, and then all the files that are used to spread are saved in a folder named with a Unicode char 00A0, which is a no-break space in Unicode. That's pretty interesting, because this is a nice effect, like this one. So, you will see something like this, which is actually a removable disk, the name of the disk itself, with an icon


chunk_text:
  it, actually, as said, as you can see here in the comment of his repository. So, big thank you and kudos to Duncan for his hard work on this. Close parentheses, and let's go back on the PLUGIX, which is, as I said, distributed as an X32 bridge DLL file, which is sideloaded when you start X64DBG application. The payload itself, it's into the X32 bridge.file. So, that is something that could be sideloaded starting. It was sideloaded, because now it has been fixed, starting XDBG. And what is going on is that, in various things he's doing, it's also spreading in a similar way of Raspberry Robin, but there is something more, which is very interesting and very clever from this point of view. It creates a LNK file, again, disguised as a device in this case, and then all the files that are used to spread are saved in a folder named with a Unicode char 00A0, which is a no-break space in Unicode. That's pretty interesting, because this is a nice effect, like this one. So, you will see something like this, which is actually a removable disk, the name of the disk itself, with an icon here. No other files are there, because even if you put your check here on display hidden files, nothing else will be displayed, because Explorer is not showing files with this non-breaking space in it. And so, this is actually what you see. I don't know you, but if I see something like that, I probably wouldn't realize that this is not a real USB drive, and I'm going to double click on it. It's very probable that I'm going to do that, because it's very, very sneaky, it's very, very clever. But what actually you see, and this is actually what you see even if you enable the check on hidden files, because actually they are also hidden, but they have this additional trick of using this not-breakable space. If you have a look on the drive itself, you will see the usbvalve.lnk file, for example, here. And if you try to type it, you will see pointing to something which is x32dbg.exe, but you don't see actually anything there. Switching to, let's say, a more robust operating system like Linux, you will start to see something. This is the list of the same directory done from a Linux


chunk_text:
  here. No other files are there, because even if you put your check here on display hidden files, nothing else will be displayed, because Explorer is not showing files with this non-breaking space in it. And so, this is actually what you see. I don't know you, but if I see something like that, I probably wouldn't realize that this is not a real USB drive, and I'm going to double click on it. It's very probable that I'm going to do that, because it's very, very sneaky, it's very, very clever. But what actually you see, and this is actually what you see even if you enable the check on hidden files, because actually they are also hidden, but they have this additional trick of using this not-breakable space. If you have a look on the drive itself, you will see the usbvalve.lnk file, for example, here. And if you try to type it, you will see pointing to something which is x32dbg.exe, but you don't see actually anything there. Switching to, let's say, a more robust operating system like Linux, you will start to see something. This is the list of the same directory done from a Linux environment, and you see here at point one that there's this entry here showing something strange, because you see an empty entry of the directory. And if you try to drill down, you will see that going from point one and point two, where we change the directory, we see that in point three, we see another folder which contains some other files and another empty folder here. And if you drill down even more, you will get finally to the folder where the payload resides. And this is completely hidden into the explorer view. So, I think that this is a very clever and a nice way to spread. Now, we saw four different ways for using by malware for spreading, and I'm sure that you probably said, okay, the first two are pretty much impossible to notice because they are very naive, very easy to spot out. The other two, it depends. How USB Valve interacts. So, what you have to do is just to put your USB Valve device into a PC, into a USB port of a PC, just to see what happens. And what do we see at the beginning? It's something like this. So,


chunk_text:
  environment, and you see here at point one that there's this entry here showing something strange, because you see an empty entry of the directory. And if you try to drill down, you will see that going from point one and point two, where we change the directory, we see that in point three, we see another folder which contains some other files and another empty folder here. And if you drill down even more, you will get finally to the folder where the payload resides. And this is completely hidden into the explorer view. So, I think that this is a very clever and a nice way to spread. Now, we saw four different ways for using by malware for spreading, and I'm sure that you probably said, okay, the first two are pretty much impossible to notice because they are very naive, very easy to spot out. The other two, it depends. How USB Valve interacts. So, what you have to do is just to put your USB Valve device into a PC, into a USB port of a PC, just to see what happens. And what do we see at the beginning? It's something like this. So, when the board boots up, you will see something like this on your OLED screen, because you will have one of the points here, it's to have immediate output on what is going on. And okay, USB Valve run a self-test before starting and seeing that everything is okay. This self-test is basically a self-check on the USB, on the fake file system, just to check for the integrity. I did it. It's probably overkill because I think it's pretty hard to being able to modify it directly from the USB. It's something that's flashing on the RAM. So, but okay, I had some space, so I did it. And then you will see something, okay, we are obviously here saying that we are putting this into a Windows system, obviously. We will see something like an access to autorun. A couple of things. When you see on USB Valve something marked with a plus, it means, okay, it's expected, nothing to worry about. If you see something like an exclamation mark, it's something that you have to pay attention to. In this case, why autorun is not an issue? Because, as I said before, the autorun.nf, it's used to


chunk_text:
  when the board boots up, you will see something like this on your OLED screen, because you will have one of the points here, it's to have immediate output on what is going on. And okay, USB Valve run a self-test before starting and seeing that everything is okay. This self-test is basically a self-check on the USB, on the fake file system, just to check for the integrity. I did it. It's probably overkill because I think it's pretty hard to being able to modify it directly from the USB. It's something that's flashing on the RAM. So, but okay, I had some space, so I did it. And then you will see something, okay, we are obviously here saying that we are putting this into a Windows system, obviously. We will see something like an access to autorun. A couple of things. When you see on USB Valve something marked with a plus, it means, okay, it's expected, nothing to worry about. If you see something like an exclamation mark, it's something that you have to pay attention to. In this case, why autorun is not an issue? Because, as I said before, the autorun.nf, it's used to execute files if autoplay is on. But I actually realized that Windows is accessing this file in any case. Even if autoplay is off, Windows is trying to access it in a reader for reading. And okay, so this is completely expected when you put a USB drive on the device. So that's fine. Okay, something is accessing the autorun. Pretty normal. And okay, you will see here the read access beside the warning here, which is not a warning in this case, because it's more an informative message, as I said, with a plus. Now let's go to case number two. We actually inserted our USB Valve again in a PC. In this case, we don't have an access to autorun, but we have something like, we see here an exclamation mark. Why? Because I placed also some canary files on my fake file system, like a readme, for example, which are telling us if something is accessing all the files. This should not happen. In a default Windows installation with Windows Defender on, when you put a USB drive in a system, it shouldn't access all the files on the file system. It could happen if you may


chunk_text:
  execute files if autoplay is on. But I actually realized that Windows is accessing this file in any case. Even if autoplay is off, Windows is trying to access it in a reader for reading. And okay, so this is completely expected when you put a USB drive on the device. So that's fine. Okay, something is accessing the autorun. Pretty normal. And okay, you will see here the read access beside the warning here, which is not a warning in this case, because it's more an informative message, as I said, with a plus. Now let's go to case number two. We actually inserted our USB Valve again in a PC. In this case, we don't have an access to autorun, but we have something like, we see here an exclamation mark. Why? Because I placed also some canary files on my fake file system, like a readme, for example, which are telling us if something is accessing all the files. This should not happen. In a default Windows installation with Windows Defender on, when you put a USB drive in a system, it shouldn't access all the files on the file system. It could happen if you may have, maybe have some other antivirus software. So I saw it during the tests, but it's definitely you have to pay attention to, because that means that if you are inserting your own drive, in any case, something is going to access everything that is saved on that system. Maybe it's benign because it's an antivirus, maybe not, because maybe it's something, it's also stealing your data. I don't know. It depends. But you at least have this information before doing what you want. You put your real USB in the system. And that's kind of useful information. And the last one, the last case, it's if something is writing actually on the device itself. In this case, we will see a specific sentence here, a specific warning with the exclamation mark again, because something is actually writing on the USB drive. And this is definitely wrong. This shouldn't happen in any case, except for one thing that now I tell you. Something is, I don't know, encrypting your file or writing something there, but this is definitely wrong. I saw some false positives in writing files when you put a USB drive in a Windows system where the Recycle


chunk_text:
  have, maybe have some other antivirus software. So I saw it during the tests, but it's definitely you have to pay attention to, because that means that if you are inserting your own drive, in any case, something is going to access everything that is saved on that system. Maybe it's benign because it's an antivirus, maybe not, because maybe it's something, it's also stealing your data. I don't know. It depends. But you at least have this information before doing what you want. You put your real USB in the system. And that's kind of useful information. And the last one, the last case, it's if something is writing actually on the device itself. In this case, we will see a specific sentence here, a specific warning with the exclamation mark again, because something is actually writing on the USB drive. And this is definitely wrong. This shouldn't happen in any case, except for one thing that now I tell you. Something is, I don't know, encrypting your file or writing something there, but this is definitely wrong. I saw some false positives in writing files when you put a USB drive in a Windows system where the Recycle Bin does not exist on the device itself. Because for some reasons, Windows wants to write a Recycle Bin file. So, the file system built on USB Valve handled this and have the Recycle Bin created. So, we will not see this false positive. But, and if you see this sentence here, that means that you are going to have some issues if you are going to put your own USB into that system. Now, this is the basic functionalities of USB Valve. So, you have just to put it into a system with a USB cable and you will have immediate feedback. So, that's the device. You have immediate feedback on what is going on on that system. But, you can also use it as a more advanced tool in order to do some additional debug and forensics on USB protocol. Like, for example, monitoring what is going on in terms of reading and writing at the lowest level, at the SCSI level of the USB protocol. Once you put this device and you connect it to a Windows system, you will get a USB drive, obviously mapped on the system, and an additional COM port that you can


chunk_text:
  Bin does not exist on the device itself. Because for some reasons, Windows wants to write a Recycle Bin file. So, the file system built on USB Valve handled this and have the Recycle Bin created. So, we will not see this false positive. But, and if you see this sentence here, that means that you are going to have some issues if you are going to put your own USB into that system. Now, this is the basic functionalities of USB Valve. So, you have just to put it into a system with a USB cable and you will have immediate feedback. So, that's the device. You have immediate feedback on what is going on on that system. But, you can also use it as a more advanced tool in order to do some additional debug and forensics on USB protocol. Like, for example, monitoring what is going on in terms of reading and writing at the lowest level, at the SCSI level of the USB protocol. Once you put this device and you connect it to a Windows system, you will get a USB drive, obviously mapped on the system, and an additional COM port that you can use to attach your preferred terminal. So, you can attach PTTY or whatever you want to this COM port and you will see something like this. So, here I'm emulating a write on the disk. Here on the right side, yeah, for you it's right. I'm copying a file, one of the canary files, which is the type the readme.txt in another one. And on the left side, you see what exactly is written on the COM port, which are some debug information here saying what is actually going on at SCSI read 10 and write 10 commands on the USB protocol. It tells you which is the sector written, the size, it also dumps part of the packets, not the entire one, at least not this release, because dumping the entire 512 bytes is causing some timing issues which are interacting with the protocol. So, they are going to break things, but probably it's something that could be can be fixed. And that's an additional way you can use it to debug at the lowest level what is going on the USB drive. Another more advanced thing is that you can use it as a debugger in this case,


chunk_text:
  use to attach your preferred terminal. So, you can attach PTTY or whatever you want to this COM port and you will see something like this. So, here I'm emulating a write on the disk. Here on the right side, yeah, for you it's right. I'm copying a file, one of the canary files, which is the type the readme.txt in another one. And on the left side, you see what exactly is written on the COM port, which are some debug information here saying what is actually going on at SCSI read 10 and write 10 commands on the USB protocol. It tells you which is the sector written, the size, it also dumps part of the packets, not the entire one, at least not this release, because dumping the entire 512 bytes is causing some timing issues which are interacting with the protocol. So, they are going to break things, but probably it's something that could be can be fixed. And that's an additional way you can use it to debug at the lowest level what is going on the USB drive. Another more advanced thing is that you can use it as a debugger in this case, because Raspberry Pi Picon and also my PCB expose the three SWP pins. So, you can attach, for example, a Jlink debugger at the device itself and then run GDB on it. And so, you can have full access to one from outside to the firmware of the USB valve itself and on the activity done on the USB drive. So, in this case, you can have a lot of insight on what is going on. So, this is another way how you can use the device. Now, I said before that you can also customize. I told you, I created a file system and it's pre-built on the firmware itself. But I'm also providing a script in order to build your own, because if you want to change something or try something yourself, you can actually do it. The procedure is pretty easy from one side and a bit more complex from another. In the sense that, okay, it's pretty easy to create a fake file system. You can just create with these three Linux commands. Okay, you can create a file system on it and mount it as a file system in a folder and then create whatever


chunk_text:
  because Raspberry Pi Picon and also my PCB expose the three SWP pins. So, you can attach, for example, a Jlink debugger at the device itself and then run GDB on it. And so, you can have full access to one from outside to the firmware of the USB valve itself and on the activity done on the USB drive. So, in this case, you can have a lot of insight on what is going on. So, this is another way how you can use the device. Now, I said before that you can also customize. I told you, I created a file system and it's pre-built on the firmware itself. But I'm also providing a script in order to build your own, because if you want to change something or try something yourself, you can actually do it. The procedure is pretty easy from one side and a bit more complex from another. In the sense that, okay, it's pretty easy to create a fake file system. You can just create with these three Linux commands. Okay, you can create a file system on it and mount it as a file system in a folder and then create whatever you want. Then you can run maybe the Python script and create the proper giant array that I was speaking before to be loaded into USB valve. But I would like to ask you one thing. If you are going to do this, I would like to work with you maybe because we can improve the project together. So, if you think that it makes sense to create a different file system with some other things and some other files and so on, because you want to monitor specific things, I would like to ask you to open an issue on GitHub where the project is published. And so we can work on it together and maybe improve the project together. So, please do it if you have any idea on that. And thank you for that in advance. And then also let's go to something that is curious to try. For example, what I'm doing now that I built this one, it's just to try to put this device in every USB port I found. Like in my house, for example, the television decoder, the modem, the Steam Deck, or whatever I found just to see if maybe this


chunk_text:
  you want. Then you can run maybe the Python script and create the proper giant array that I was speaking before to be loaded into USB valve. But I would like to ask you one thing. If you are going to do this, I would like to work with you maybe because we can improve the project together. So, if you think that it makes sense to create a different file system with some other things and some other files and so on, because you want to monitor specific things, I would like to ask you to open an issue on GitHub where the project is published. And so we can work on it together and maybe improve the project together. So, please do it if you have any idea on that. And thank you for that in advance. And then also let's go to something that is curious to try. For example, what I'm doing now that I built this one, it's just to try to put this device in every USB port I found. Like in my house, for example, the television decoder, the modem, the Steam Deck, or whatever I found just to see if maybe this device are doing something strange with my data. So, I encourage you also to do that because it's quite funny to see. And the last part, it's about open sourcing everything, obviously, because as I said, I'm an open source advocate. So, everything I do, it's usually released in this way, unless very few things that are too bad written to be shared. That's the only reason why I'm not sharing, because I don't want to show you how bad am I at writing code. And so, everything is published on my GitHub under the repository of USB Valve. Everything is there. You can build your own. You can also download, if you want, the PCB Gerber file. So, you can print your, if you want. But I remind you to ask me for one if you want to build one. And okay, that's the repository. So, you can find building instruction for both the PCB version or your own version. So, you can just download everything from there. And now, okay, let's go to the credit parts, because I would like to obviously thank a lot of people, actually, like, for example, the TinyUSB Project, which is the group


chunk_text:
  device are doing something strange with my data. So, I encourage you also to do that because it's quite funny to see. And the last part, it's about open sourcing everything, obviously, because as I said, I'm an open source advocate. So, everything I do, it's usually released in this way, unless very few things that are too bad written to be shared. That's the only reason why I'm not sharing, because I don't want to show you how bad am I at writing code. And so, everything is published on my GitHub under the repository of USB Valve. Everything is there. You can build your own. You can also download, if you want, the PCB Gerber file. So, you can print your, if you want. But I remind you to ask me for one if you want to build one. And okay, that's the repository. So, you can find building instruction for both the PCB version or your own version. So, you can just download everything from there. And now, okay, let's go to the credit parts, because I would like to obviously thank a lot of people, actually, like, for example, the TinyUSB Project, which is the group who built the library, Adafruit, because I actually used the Arduino IDE for Raspberry Pi Pico, even if I'm thinking that it makes sense to migrate directly to the Pico SDK, to be honest, because it's more supported and so on. So, probably, I will go to that direction. But so far, I used that part. And okay. So, I also want to thank all the people who did the analysis that I mentioned in my presentation. Also, the presentation template provided by Slides Carnival. And so, I think we are at the end. So, you can take your sunglasses off, because the presentation is going to be finished. And okay. If you have any questions, I'm here. **BEN HONG.** Any questions? **BEN HONG.** No? **JASON LENGSTORF** Come on. **BEN HONG.** Anyway, if you then have any question, maybe it came to you later on, just write me a message on GitHub or on Twitter. Okay? **JASON LENGSTORF** Very interesting, this tool you're doing. What was the... **BEN HONG.** Sorry, I don't see you. **JASON LENGSTORF** Just here. Sorry. So, what was the most strange thing you saw that something did with your device? So, you showed that it reads


chunk_text:
  who built the library, Adafruit, because I actually used the Arduino IDE for Raspberry Pi Pico, even if I'm thinking that it makes sense to migrate directly to the Pico SDK, to be honest, because it's more supported and so on. So, probably, I will go to that direction. But so far, I used that part. And okay. So, I also want to thank all the people who did the analysis that I mentioned in my presentation. Also, the presentation template provided by Slides Carnival. And so, I think we are at the end. So, you can take your sunglasses off, because the presentation is going to be finished. And okay. If you have any questions, I'm here. **BEN HONG.** Any questions? **BEN HONG.** No? **JASON LENGSTORF** Come on. **BEN HONG.** Anyway, if you then have any question, maybe it came to you later on, just write me a message on GitHub or on Twitter. Okay? **JASON LENGSTORF** Very interesting, this tool you're doing. What was the... **BEN HONG.** Sorry, I don't see you. **JASON LENGSTORF** Just here. Sorry. So, what was the most strange thing you saw that something did with your device? So, you showed that it reads some devices, it reads some files, it can write new files. Did you see something where it tried to attack the firmware or so, which would theoretically also be possible? And would you see something like that, like try to attack the firmware of the USB device? **BEN HONG.** So far, I didn't see at least from... I tried to use it as, let's say, canary to see what devices are doing. So far, I didn't see anything strange directly from, let's say, home devices or something like that. The strangest things are done by, let's say, the malwares we saw in the analysis. So, so far, I actually didn't see anything strange yet, but I'm still researching on it. So, I think that something could come out from that. Thank you. **JASON LENGSTORF** Okay. I have one more question. **BEN HONG.** Sure. **JASON LENGSTORF** Because your device, by default, exposes a serial port and it's named USB Valve. Do you think that some malware in the future can just detect that it's not an actual USB stick, it's just a USB Valve, and then just not do any suspicious stuff? **BEN HONG** Definitely, yes. That's why, actually, it's provided


chunk_text:
  some devices, it reads some files, it can write new files. Did you see something where it tried to attack the firmware or so, which would theoretically also be possible? And would you see something like that, like try to attack the firmware of the USB device? **BEN HONG.** So far, I didn't see at least from... I tried to use it as, let's say, canary to see what devices are doing. So far, I didn't see anything strange directly from, let's say, home devices or something like that. The strangest things are done by, let's say, the malwares we saw in the analysis. So, so far, I actually didn't see anything strange yet, but I'm still researching on it. So, I think that something could come out from that. Thank you. **JASON LENGSTORF** Okay. I have one more question. **BEN HONG.** Sure. **JASON LENGSTORF** Because your device, by default, exposes a serial port and it's named USB Valve. Do you think that some malware in the future can just detect that it's not an actual USB stick, it's just a USB Valve, and then just not do any suspicious stuff? **BEN HONG** Definitely, yes. That's why, actually, it's provided as open source. So, we can rebuild the firmware very easily, just renaming with your own name. And that's actually a point, yes, for sure. You mean, okay, you can also hide the COM port, for example. It's something that can be done, for example, yeah. But that's actually a point. And I think that it could be easily solved. One of the things that probably have to do is provide a kind of, let's say, firmware that randomizes names of the disk itself or the COM port and so on. So, that's a good idea, for example. **JASON LENGSTORF** Okay, thank you. **BEN HONG** Thank you. **JASON LENGSTORF** There is one question. **SPEAKER 2** Have you considered to also have it work the other way around, for example, to detect any kind of bad USB sticks that expose something else than just mass storage? So, basically, being a USB host where you can plug in a USB stick you don't trust? **BEN HONG** Ah, okay. On the opposite side, you mean. Yeah, good point. I think that's something that could in this case, it's a bit, let's say, since in this case, the only way you can get infected


chunk_text:
  as open source. So, we can rebuild the firmware very easily, just renaming with your own name. And that's actually a point, yes, for sure. You mean, okay, you can also hide the COM port, for example. It's something that can be done, for example, yeah. But that's actually a point. And I think that it could be easily solved. One of the things that probably have to do is provide a kind of, let's say, firmware that randomizes names of the disk itself or the COM port and so on. So, that's a good idea, for example. **JASON LENGSTORF** Okay, thank you. **BEN HONG** Thank you. **JASON LENGSTORF** There is one question. **SPEAKER 2** Have you considered to also have it work the other way around, for example, to detect any kind of bad USB sticks that expose something else than just mass storage? So, basically, being a USB host where you can plug in a USB stick you don't trust? **BEN HONG** Ah, okay. On the opposite side, you mean. Yeah, good point. I think that's something that could in this case, it's a bit, let's say, since in this case, the only way you can get infected by something like that is that it's more under your control. I mean, if you're going to put a USB drive which is infected in your system, it's your system, you know that maybe, I don't know, you have autoplay run or autoplay activated or whatever, because you have control on the system where you have to put the device itself. Here, I thought it the other way around because it's actually something I don't have control to because I have to put my key into an unknown system where it's become more useful, in my opinion. But yeah, in any case, that's something that could be, we can think about use case about that. Yeah. **JASON LENGSTORF** Sorry. I've looked at a project a long time ago called Face Dancer. Have you perhaps looked at it also? **HONG** Face Dancer, you mean? **JASON LENGSTORF** Face Dancer, yes. **HONG** Yeah, it's something which could be similar in terms that Face Dancer is more a framework in this case because it offers a lot of other functionalities. The point here is to build something that you can bring in your keys and have it ready for whenever you want to test


chunk_text:
  by something like that is that it's more under your control. I mean, if you're going to put a USB drive which is infected in your system, it's your system, you know that maybe, I don't know, you have autoplay run or autoplay activated or whatever, because you have control on the system where you have to put the device itself. Here, I thought it the other way around because it's actually something I don't have control to because I have to put my key into an unknown system where it's become more useful, in my opinion. But yeah, in any case, that's something that could be, we can think about use case about that. Yeah. **JASON LENGSTORF** Sorry. I've looked at a project a long time ago called Face Dancer. Have you perhaps looked at it also? **HONG** Face Dancer, you mean? **JASON LENGSTORF** Face Dancer, yes. **HONG** Yeah, it's something which could be similar in terms that Face Dancer is more a framework in this case because it offers a lot of other functionalities. The point here is to build something that you can bring in your keys and have it ready for whenever you want to test something. Face Dancer, it requires a bit more computer power, let's say, because it requires specific boards, which are bigger than this, for sure. And it also offers more functionalities than this. That's for sure. But yeah, actually, it's something that has the similar functionalities, but this is built for specific usage like this one and to also be carried out together with us. Thank you. **JASON LENGSTORF** Other questions? Okay. So, thank you again for the presentation. **HONG** Thank you very much.


chunk_text:
  something. Face Dancer, it requires a bit more computer power, let's say, because it requires specific boards, which are bigger than this, for sure. And it also offers more functionalities than this. That's for sure. But yeah, actually, it's something that has the similar functionalities, but this is built for specific usage like this one and to also be carried out together with us. Thank you. **JASON LENGSTORF** Other questions? Okay. So, thank you again for the presentation. **HONG** Thank you very much.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=wROyhQMLyIY", "title": "Hacking Your Jump Rope Or Your Coffee Machine by Axelle Apvrille", "description": "", "channel_url": "https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA", "duration": 2944, "channel": "scrt.insomnihack", "uploader": "scrt.insomnihack", "upload_date": "20230411" } This text was transcribed using whisper model: large-v2 Thank you, so my name is Axelle, I work for Fortinet, and I work mainly on Android malware and connected objects, and today it's going to be mostly on connected objects. I'm also the lead organizer of a phone CTF, which is a CTF in the south of France, and which is dedicated to connected objects. And last but not least, I'll be talking to you today about a smart coffee maker machine. I don't drink coffee, so during all my research, my colleagues had to drink the coffee I was brewing for that, so thanks to them. So those are the two devices we are going to discuss today. You've got on the left-hand side the coffee machine, which is connected on both devices are Bluetooth, low-energy devices connected that way. And on the other side, you've got the jump rope, we'll be discussing both. Both have been integrated in challenges for phone, the coffee machine, it was in 2019, and the jump rope, it was in 2022, in December, sorry, 2022. So let's start with the coffee machine. Well, actually it's really interesting because, well, I'll discuss actually that a little bit later, but you can hack in three different points. You can hack on the hardware, in the communication, and on the smartphone, okay? So let's start a little bit, but with hardware reconnaissance. In there, I opened the coffee machine, and this is what you see. You see the buttons on the top, okay? And this is the back of it with something, also all the mechanisms which control the flow of the coffee. And if you go beneath the buttons, well, you've got a PCB, and if you have a look at what is written on the top right, well, basically you get some numbers, and basically it says also I think that it's waterproof, one part of it, and the other part is helpful to find it on the net. And you can find the separate part for it sold on eBay, which is pretty cool because it means that if your coffee machine has an issue, well, you can repair it. It's something like 35 euros, depending.


chunk_text:
  rope, it was in 2022, in December, sorry, 2022. So let's start with the coffee machine. Well, actually it's really interesting because, well, I'll discuss actually that a little bit later, but you can hack in three different points. You can hack on the hardware, in the communication, and on the smartphone, okay? So let's start a little bit, but with hardware reconnaissance. In there, I opened the coffee machine, and this is what you see. You see the buttons on the top, okay? And this is the back of it with something, also all the mechanisms which control the flow of the coffee. And if you go beneath the buttons, well, you've got a PCB, and if you have a look at what is written on the top right, well, basically you get some numbers, and basically it says also I think that it's waterproof, one part of it, and the other part is helpful to find it on the net. And you can find the separate part for it sold on eBay, which is pretty cool because it means that if your coffee machine has an issue, well, you can repair it. It's something like 35 euros, depending. So this one I think is from eBay in Italy, but yeah, it depends. I also saw one in Australia, I think. And the other thing that you see in eBay is that actually this PCB also works for lots of different coffee machines. So probably they, well, it's a supposition, I'm not entirely sure of that, but probably it was sub-constructed to a company who then sold it to multiple coffee makers, different brands, and it works for all of these. If you have a look at the hardware components on there, well, you see an STM chip, which is an 8-bit microcontroller, and more interesting to me, the other chip there is the BLE chip. So actually, if you've got good eyes, you can see on the stamp on it that you've got the FCC ID, you can go to the FCC.io website and look for that, and you get all the details exactly what chip this is and all the specs which are there. So this is pretty interesting. And then the other thing which is really interesting when you're trying to hack a device, I think, is to have a look at the documentation. That is,


chunk_text:
  So this one I think is from eBay in Italy, but yeah, it depends. I also saw one in Australia, I think. And the other thing that you see in eBay is that actually this PCB also works for lots of different coffee machines. So probably they, well, it's a supposition, I'm not entirely sure of that, but probably it was sub-constructed to a company who then sold it to multiple coffee makers, different brands, and it works for all of these. If you have a look at the hardware components on there, well, you see an STM chip, which is an 8-bit microcontroller, and more interesting to me, the other chip there is the BLE chip. So actually, if you've got good eyes, you can see on the stamp on it that you've got the FCC ID, you can go to the FCC.io website and look for that, and you get all the details exactly what chip this is and all the specs which are there. So this is pretty interesting. And then the other thing which is really interesting when you're trying to hack a device, I think, is to have a look at the documentation. That is, if you are lucky enough to have some documentation, and for the smart coffee machine, there is very good documentation there. In the instruction manual, in particular, you can see the reset to factory settings. Now, this is really, really important to have as an information when you're trying to hack something. I had to, of course, use it several times. So this is really interesting information, for instance. More information this time in the service manual. This is awesome. I wish that all manufacturers were providing such good documentation, honestly. Look at this. I mean, this is wonderful. You've got everything you need to repair it. Besides my work, I'm actually working in a repair cafe down in Nice in the south of France, and if I had all this documentation for all the things I'm trying to repair, it would be really great. And that, okay, this is good. So what have we learned? Well, we've learned that the coffee machine has a BLE chip. It's not a great deal. We already knew that, okay? But well, okay. We know that the PCB is used for many different coffee machines, probably. We know how to reset to factory


chunk_text:
  if you are lucky enough to have some documentation, and for the smart coffee machine, there is very good documentation there. In the instruction manual, in particular, you can see the reset to factory settings. Now, this is really, really important to have as an information when you're trying to hack something. I had to, of course, use it several times. So this is really interesting information, for instance. More information this time in the service manual. This is awesome. I wish that all manufacturers were providing such good documentation, honestly. Look at this. I mean, this is wonderful. You've got everything you need to repair it. Besides my work, I'm actually working in a repair cafe down in Nice in the south of France, and if I had all this documentation for all the things I'm trying to repair, it would be really great. And that, okay, this is good. So what have we learned? Well, we've learned that the coffee machine has a BLE chip. It's not a great deal. We already knew that, okay? But well, okay. We know that the PCB is used for many different coffee machines, probably. We know how to reset to factory settings, so this is going to prove out to be very useful. And we know probably, or at least better, how to repair the coffee machine, and this is really awesome. If you are more skilled than I am in hardware, if you have, for instance, well, corresponding to the previous talk of Thomas, well, if you have his skills in hardware, you can probably dig in much more on the hardware part and find many more things. Those are not my skills, okay? So if you are like me, like I am, not skilled in that part, well, you have more than your eyes to cry. You can do something else still, is, well, you can hack, for instance, in the BLE communication. So there we can try and sniff the Bluetooth communication. There are basically two different tools that I know of. Both are really old. It's Ubertooth and Adafruit LE Sniffer. I think that Ubertooth was presented, I think, in 2011, so it's pretty old, more than 10 years old, but it's still maintained, and you can use it, like the other one, to sniff the Bluetooth communication. It works very well, and you get all the


chunk_text:
  settings, so this is going to prove out to be very useful. And we know probably, or at least better, how to repair the coffee machine, and this is really awesome. If you are more skilled than I am in hardware, if you have, for instance, well, corresponding to the previous talk of Thomas, well, if you have his skills in hardware, you can probably dig in much more on the hardware part and find many more things. Those are not my skills, okay? So if you are like me, like I am, not skilled in that part, well, you have more than your eyes to cry. You can do something else still, is, well, you can hack, for instance, in the BLE communication. So there we can try and sniff the Bluetooth communication. There are basically two different tools that I know of. Both are really old. It's Ubertooth and Adafruit LE Sniffer. I think that Ubertooth was presented, I think, in 2011, so it's pretty old, more than 10 years old, but it's still maintained, and you can use it, like the other one, to sniff the Bluetooth communication. It works very well, and you get all the packets, which is a little bit more than we really need because in this particular case, we are only interested in one part, one specific layer of Bluetooth, which is at the at protocol. The other issue is that I'm not actually that much at ease with those sniffers. I know how to use them, but I tend to forget all the time how I have to set them up again. It's a little bit complicated. You've got to flash the firmware, then you've got to patch your wire shark, then, you know, all that stuff. It's doable, but I probably don't do it often enough to be really at ease with it. First two parts, well, it's not the easiest, in my humble opinion, or not for me, at least. Of course, it's the last one. I'm going to do everything from the smartphone. You're going to see that, actually, we can find lots of information from the smartphone, and it proves out sometimes to be extremely easy and handy to use that way. One of the first things you have to do when you are dealing with a BLE device is to list all the services and characteristics


chunk_text:
  packets, which is a little bit more than we really need because in this particular case, we are only interested in one part, one specific layer of Bluetooth, which is at the at protocol. The other issue is that I'm not actually that much at ease with those sniffers. I know how to use them, but I tend to forget all the time how I have to set them up again. It's a little bit complicated. You've got to flash the firmware, then you've got to patch your wire shark, then, you know, all that stuff. It's doable, but I probably don't do it often enough to be really at ease with it. First two parts, well, it's not the easiest, in my humble opinion, or not for me, at least. Of course, it's the last one. I'm going to do everything from the smartphone. You're going to see that, actually, we can find lots of information from the smartphone, and it proves out sometimes to be extremely easy and handy to use that way. One of the first things you have to do when you are dealing with a BLE device is to list all the services and characteristics of the device. That's the way BLE is organized. We're not going to get into the specifics, but basically, you've got services, and in there, you've got characteristics, which are kind of entry points you can read or write to. If you want to list out, you've got smartphone applications, like NRF Connect. You've got others, but they give very good results there. If you want to do it from your laptop, it also is possible. For instance, I'd recommend, like, GATTool, well, it's deprecated. It's been deprecated for years, but I know that some of us are still using it very much because it's really simple to use and very convenient. Its replacement is actually Bluetooth Control, which is also excellent as well, perhaps a little bit more verbose. It's a bit too talkative, let's say, but it works. You can get the lists of exactly this, which is all the services that you have on your device. On the smart coffee machine, you've got standard services, generic access, generic attributes, and then all the other ones are specific to the coffee machine. Here in this case, we can see that the developers really kind of organized the various


chunk_text:
  of the device. That's the way BLE is organized. We're not going to get into the specifics, but basically, you've got services, and in there, you've got characteristics, which are kind of entry points you can read or write to. If you want to list out, you've got smartphone applications, like NRF Connect. You've got others, but they give very good results there. If you want to do it from your laptop, it also is possible. For instance, I'd recommend, like, GATTool, well, it's deprecated. It's been deprecated for years, but I know that some of us are still using it very much because it's really simple to use and very convenient. Its replacement is actually Bluetooth Control, which is also excellent as well, perhaps a little bit more verbose. It's a bit too talkative, let's say, but it works. You can get the lists of exactly this, which is all the services that you have on your device. On the smart coffee machine, you've got standard services, generic access, generic attributes, and then all the other ones are specific to the coffee machine. Here in this case, we can see that the developers really kind of organized the various characteristics in a thoughtful way, like you've got the errors at some point, things that users can customize in another and things like that. I think we're going to discuss those a little bit more afterwards. Then what we want to do, of course, obviously, is to connect to the coffee machine. First thing that happens, you try to connect, and it spits out an error telling you, well, it requires authentication before read and write. So there you can go and have a look at how security modes are defined in BLE, and you'll see there is level one, two, and three. Basically, what you need is level three, which is authenticated encryption, and which is actually pairing. It's kind of the same. So if you want to get this, well, you use GATTool. GATTool, you've got to say that security level here is high, because that's what means actually level three. Moderate, I think, is two, and low is one, something like that. If you're using Bluetooth control, it's, I think, a little bit more intuitive there, because well, you just say that you want to pair to a given device, and you get the pairing. Then you


chunk_text:
  characteristics in a thoughtful way, like you've got the errors at some point, things that users can customize in another and things like that. I think we're going to discuss those a little bit more afterwards. Then what we want to do, of course, obviously, is to connect to the coffee machine. First thing that happens, you try to connect, and it spits out an error telling you, well, it requires authentication before read and write. So there you can go and have a look at how security modes are defined in BLE, and you'll see there is level one, two, and three. Basically, what you need is level three, which is authenticated encryption, and which is actually pairing. It's kind of the same. So if you want to get this, well, you use GATTool. GATTool, you've got to say that security level here is high, because that's what means actually level three. Moderate, I think, is two, and low is one, something like that. If you're using Bluetooth control, it's, I think, a little bit more intuitive there, because well, you just say that you want to pair to a given device, and you get the pairing. Then you try again to connect, and you think it's going to work, and no, not exactly. It tells you this time attribute requires authorization before read, write. So the first time I got the error, I read too quickly. I thought it was authentication, and I thought, damn, my pairing didn't work. It did. It's not that. It's different. Authentication, authorization, totally different. Now this is really rare in BLE devices. It was the first coffee machine, well, smart coffee machine, first BLE device actually in the end that I saw with authorization at all. So it was particularly interesting to me to deal with that, because I hadn't ever seen that. It's totally implemented by the device itself. This is not part of, well, the Bluetooth specs say that it's up to the device to implement the authorization the way they want. Sorry for this, but I'm going to move it a little bit, yeah. So how do I get authorized? So this is where I'm going to sniff the communication, but I'm not going to sniff using Ubertooth or something else. I'm going to sniff directly on the smartphone. If you've got a rooted device, well, you can actually


chunk_text:
  try again to connect, and you think it's going to work, and no, not exactly. It tells you this time attribute requires authorization before read, write. So the first time I got the error, I read too quickly. I thought it was authentication, and I thought, damn, my pairing didn't work. It did. It's not that. It's different. Authentication, authorization, totally different. Now this is really rare in BLE devices. It was the first coffee machine, well, smart coffee machine, first BLE device actually in the end that I saw with authorization at all. So it was particularly interesting to me to deal with that, because I hadn't ever seen that. It's totally implemented by the device itself. This is not part of, well, the Bluetooth specs say that it's up to the device to implement the authorization the way they want. Sorry for this, but I'm going to move it a little bit, yeah. So how do I get authorized? So this is where I'm going to sniff the communication, but I'm not going to sniff using Ubertooth or something else. I'm going to sniff directly on the smartphone. If you've got a rooted device, well, you can actually on Android pretty easily enable Bluetooth snooping. It's really not difficult to do. It's like you click on various menus, and it works. And then you get the PCAP on the smartphone directly. You transfer that, and you put it in Wireshark. And, well, I'm happy, okay? And you get that. So, well, maybe at the back you can't exactly read, but those are just a list of enumeration packets in there. So it's kind of enumerating all the services and all the characteristics, okay? Then you get a read request on handle 16, okay? Then you get a write request on handle 14. Now, if you want to get authorized, obviously, you're going to have to write something, okay? So I thought, okay, one way or another, the write request is going to be really interesting to me because possibly this is what is going to give the authorization code and prove that I am somebody to be trusted, okay? Or, well, that I am this authorized person. And indeed, it is that. So in the packet, in here, we have the authorization code to be sent to the smart coffee machine, okay? Now, it's useless just to take


chunk_text:
  on Android pretty easily enable Bluetooth snooping. It's really not difficult to do. It's like you click on various menus, and it works. And then you get the PCAP on the smartphone directly. You transfer that, and you put it in Wireshark. And, well, I'm happy, okay? And you get that. So, well, maybe at the back you can't exactly read, but those are just a list of enumeration packets in there. So it's kind of enumerating all the services and all the characteristics, okay? Then you get a read request on handle 16, okay? Then you get a write request on handle 14. Now, if you want to get authorized, obviously, you're going to have to write something, okay? So I thought, okay, one way or another, the write request is going to be really interesting to me because possibly this is what is going to give the authorization code and prove that I am somebody to be trusted, okay? Or, well, that I am this authorized person. And indeed, it is that. So in the packet, in here, we have the authorization code to be sent to the smart coffee machine, okay? Now, it's useless just to take a screenshot of that one because it is changing every time we are repairing to the device. So you've got to get this code by yourselves by sniffing the communication. Then you get it, and then you are authorized for the rest of the long, possibly long session. And by the way, normally, we'll have the smart coffee machine at Fortinet's booth today. So if you want to try and hack and get your coffee that way, well, you can. You're welcome to try and hack the machine. Then in phone, what happened is that one of the challenges was that we wanted the hackers to get a 90 milliliter cup, okay? Normally, ristretto is 25 milliliters, espresso is 40 milliliters. You see, I've learned quite a lot about coffee now, okay? And lungo is 110 milliliters, okay? So you can cheat, but you're not supposed to. You can do two ristrettos and one espresso, that will be also 90 milliliters, but you were supposed to get that in one cup, not in three cups, okay? So we're going to try and do this. So here we go in the code of the Android application, which is supposed to control


chunk_text:
  a screenshot of that one because it is changing every time we are repairing to the device. So you've got to get this code by yourselves by sniffing the communication. Then you get it, and then you are authorized for the rest of the long, possibly long session. And by the way, normally, we'll have the smart coffee machine at Fortinet's booth today. So if you want to try and hack and get your coffee that way, well, you can. You're welcome to try and hack the machine. Then in phone, what happened is that one of the challenges was that we wanted the hackers to get a 90 milliliter cup, okay? Normally, ristretto is 25 milliliters, espresso is 40 milliliters. You see, I've learned quite a lot about coffee now, okay? And lungo is 110 milliliters, okay? So you can cheat, but you're not supposed to. You can do two ristrettos and one espresso, that will be also 90 milliliters, but you were supposed to get that in one cup, not in three cups, okay? So we're going to try and do this. So here we go in the code of the Android application, which is supposed to control the coffee machine. And we see a class, which is named CupSizeVolume, and this looks like a good place to look into. And you see the different ranges, which are acceptable for ristretto, espresso, and lungo. So if we want 90 milliliters, well, it works for lungo. It won't work for ristretto and espresso, because it's not beyond the range, okay, cool. And now, how are we going to do to set this? Well, we have a look at another class, which is called CupSizeOperations. The name isn't obfuscated in the code, so this is handy. And you see that there's a service. The service is UserOptions, and then you've got two different characteristics, CupSize and CupVolume. So what we'll have to do is to specify we want to hack lungo, CupSize, and CupVolume for 90 milliliters. Now a small note there is that it's handy to work on handles, okay. But sometimes you have only the universal identifier, which is there. So if you want to make the matching and know what is the handle, well, actually, Bluetooth control gives you both. This is the UUID, and this is the handle in here, and this is the address of


chunk_text:
  the coffee machine. And we see a class, which is named CupSizeVolume, and this looks like a good place to look into. And you see the different ranges, which are acceptable for ristretto, espresso, and lungo. So if we want 90 milliliters, well, it works for lungo. It won't work for ristretto and espresso, because it's not beyond the range, okay, cool. And now, how are we going to do to set this? Well, we have a look at another class, which is called CupSizeOperations. The name isn't obfuscated in the code, so this is handy. And you see that there's a service. The service is UserOptions, and then you've got two different characteristics, CupSize and CupVolume. So what we'll have to do is to specify we want to hack lungo, CupSize, and CupVolume for 90 milliliters. Now a small note there is that it's handy to work on handles, okay. But sometimes you have only the universal identifier, which is there. So if you want to make the matching and know what is the handle, well, actually, Bluetooth control gives you both. This is the UUID, and this is the handle in here, and this is the address of the MAC address. So it's an easy way if you want to work with either, well, you have both information, which is cool. So CupSize, so it's a specific protocol, well, a specific packet format, so sorry, but it's really extremely easy. It's only two bytes. And for lungo, well, you just have to specify number two, and it will customize lungo. Cool. CupVolume, it's slightly more complicated, but it's still not very complicated. It's four bytes. Actually, the two first ones is the volume in milliliters, and the last two are fixed, always FFFF. Okay, so we know, sorry, I'll come back. We know how to specify the cup that we want to customize, and we know how to specify the number of milliliters. Now we've got to be able also to tell the coffee machine, okay, do me my coffee, okay? And here I'm skipping a little bit of parts because, well, we don't have like a two-hour session, but in the code, you see again that there's another command with a specific header, okay, which basically would tell the coffee machine to brew a coffee. And then you specify the delay. When do you want your coffee?


chunk_text:
  the MAC address. So it's an easy way if you want to work with either, well, you have both information, which is cool. So CupSize, so it's a specific protocol, well, a specific packet format, so sorry, but it's really extremely easy. It's only two bytes. And for lungo, well, you just have to specify number two, and it will customize lungo. Cool. CupVolume, it's slightly more complicated, but it's still not very complicated. It's four bytes. Actually, the two first ones is the volume in milliliters, and the last two are fixed, always FFFF. Okay, so we know, sorry, I'll come back. We know how to specify the cup that we want to customize, and we know how to specify the number of milliliters. Now we've got to be able also to tell the coffee machine, okay, do me my coffee, okay? And here I'm skipping a little bit of parts because, well, we don't have like a two-hour session, but in the code, you see again that there's another command with a specific header, okay, which basically would tell the coffee machine to brew a coffee. And then you specify the delay. When do you want your coffee? Do you want it tomorrow morning, or do you want it just now? And what type of coffee you want, well, what type of cup. So here, for instance, if we want our 90 milliliters cup of coffee, we'll say that we want it now, so the delay will be null, and the coffee type is going to be lungo, so it's going to be 0002. And you send this command, well, to this given service, which is here, and the characteristics to send it to are written there, so it's the brew key in here, handle 24. Now just a summary. So if we want to finally get our cup of coffee, we've got to pair, to authorize, to get, well, the authorization code, to customize the, say that we want to customize the lungo cup, customize the volume, 90 milliliters, and then tell it to brew the cup of coffee. And this is where I'm going to show you, well, actually a video because I didn't dare to bring the coffee machine, just here. So it's this one. So on the left-hand side, you've got the script, and on the other one, well, you've got the coffee machine.


chunk_text:
  Do you want it tomorrow morning, or do you want it just now? And what type of coffee you want, well, what type of cup. So here, for instance, if we want our 90 milliliters cup of coffee, we'll say that we want it now, so the delay will be null, and the coffee type is going to be lungo, so it's going to be 0002. And you send this command, well, to this given service, which is here, and the characteristics to send it to are written there, so it's the brew key in here, handle 24. Now just a summary. So if we want to finally get our cup of coffee, we've got to pair, to authorize, to get, well, the authorization code, to customize the, say that we want to customize the lungo cup, customize the volume, 90 milliliters, and then tell it to brew the cup of coffee. And this is where I'm going to show you, well, actually a video because I didn't dare to bring the coffee machine, just here. So it's this one. So on the left-hand side, you've got the script, and on the other one, well, you've got the coffee machine. And you see that on the cup of coffee, I've marked Ristresto R, E for espresso, and the higher one is lungo. And if I manage to get, so well, if we get to the 90 milliliters, it's going to stop just below those, the lungo, which is 110. So this is normally 90 milliliters approximately. And by the way, that's some, that's what some participants had to do to flag the challenge, so that was cool that some of them did. So resuming, you can do actually more, but that wasn't part of the CTF. I mean, this coffee machine is amazing, I love it. You can do actually a recipe. So you can say, I want a little bit of water, this volume, then I want a little bit of coffee, then I want, again, a little bit of water, and you can build up your recipe. You can tell the temperature you want it, and then you can create a recipe for that, give it an ID, and it will do it just the way you like it. Because that's another thing I've learned from my colleagues, is that nobody likes the same coffee. You can do


chunk_text:
  And you see that on the cup of coffee, I've marked Ristresto R, E for espresso, and the higher one is lungo. And if I manage to get, so well, if we get to the 90 milliliters, it's going to stop just below those, the lungo, which is 110. So this is normally 90 milliliters approximately. And by the way, that's some, that's what some participants had to do to flag the challenge, so that was cool that some of them did. So resuming, you can do actually more, but that wasn't part of the CTF. I mean, this coffee machine is amazing, I love it. You can do actually a recipe. So you can say, I want a little bit of water, this volume, then I want a little bit of coffee, then I want, again, a little bit of water, and you can build up your recipe. You can tell the temperature you want it, and then you can create a recipe for that, give it an ID, and it will do it just the way you like it. Because that's another thing I've learned from my colleagues, is that nobody likes the same coffee. You can do much more, and this is where, if you want to play afterwards with a coffee machine, I suggest that you take a screenshot of this one. Because you can do much more, you can get, for instance, the control. The coffee machine will tell you, for instance, if it's missing water. So you've got all the responses like that, and you can get that. You can also set up water hardness and say if it needs to be adjusted or not. There's even a BLE command if you want to do a factory reset. So plenty of other things that you can do. If you feel like it, well, you have some more technical information in that document. One of the issues I thought is that also, well, this coffee machine, it's a bit strange, but the designer only thought that one person would connect to it, because you can only be paired, well, it's only possible to pair one person at a given time. Which means that if, I don't know, colleague A is paired, well, colleague B is going to have to unpair colleague A, pair again, and talk to the machine. I mean, this is never going


chunk_text:
  much more, and this is where, if you want to play afterwards with a coffee machine, I suggest that you take a screenshot of this one. Because you can do much more, you can get, for instance, the control. The coffee machine will tell you, for instance, if it's missing water. So you've got all the responses like that, and you can get that. You can also set up water hardness and say if it needs to be adjusted or not. There's even a BLE command if you want to do a factory reset. So plenty of other things that you can do. If you feel like it, well, you have some more technical information in that document. One of the issues I thought is that also, well, this coffee machine, it's a bit strange, but the designer only thought that one person would connect to it, because you can only be paired, well, it's only possible to pair one person at a given time. Which means that if, I don't know, colleague A is paired, well, colleague B is going to have to unpair colleague A, pair again, and talk to the machine. I mean, this is never going to happen, and I'm sure you've all struggled with BLE pairing before. It's a nightmare. So really, this is not really very practical. So I thought, how can we make this available to all colleagues in a more efficient manner? Well, simple. You can just use a Raspberry Pi, and it will act as a BLE relay. So I connected it to the Bluetooth machine, and then I built, well, a basic web interface, which my colleagues would go to and say remotely, I would like my coffee. I would like it here, where's Pedro, and things like that. And that's also something I've got a short demo for. I don't have, though, the happy face of my colleagues there to show. But there, well, this is my web interface. It's not very nice, but I'm not very good at design that way. And there, you push a button, and you get your coffee. And I even implemented the error feedback. So if coffee is missing, it's going to complain and tell them, well, yeah, OK, you want coffee, but there's no coffee, OK? So that's the way it works. So this is available also on GitHub. If ever you've


chunk_text:
  to happen, and I'm sure you've all struggled with BLE pairing before. It's a nightmare. So really, this is not really very practical. So I thought, how can we make this available to all colleagues in a more efficient manner? Well, simple. You can just use a Raspberry Pi, and it will act as a BLE relay. So I connected it to the Bluetooth machine, and then I built, well, a basic web interface, which my colleagues would go to and say remotely, I would like my coffee. I would like it here, where's Pedro, and things like that. And that's also something I've got a short demo for. I don't have, though, the happy face of my colleagues there to show. But there, well, this is my web interface. It's not very nice, but I'm not very good at design that way. And there, you push a button, and you get your coffee. And I even implemented the error feedback. So if coffee is missing, it's going to complain and tell them, well, yeah, OK, you want coffee, but there's no coffee, OK? So that's the way it works. So this is available also on GitHub. If ever you've got the same or a matching coffee machine, you can get it from here. And happily, you will be able to get your coffee over Wi-Fi instead of BLE. We're done with the smart coffee machine. Now we're going to do a little bit of fitness with a jump rope. It's basically the same, because it's still a Bluetooth low-energy device. Just the same, well, as you can imagine, you can hack it on the hardware part or on the communication part. But you already know that I'm going to do everything here from the smartphone. So actually, that's something that Thomas mentioned at some point in one of his slides, is that, yeah, do not forget to have a look at the system logs of Android, because you can find sometimes really valuable information. And here, it turns out that actually the application is logging everything that you want on the Android system logs, including Bluetooth packets. So I'm going to show that. And this is going to be a live demo. So enjoy. Hopefully, I will enjoy it as much. It might not work, never know. So screen copy. I'm going to show you my smartphone. So there


chunk_text:
  got the same or a matching coffee machine, you can get it from here. And happily, you will be able to get your coffee over Wi-Fi instead of BLE. We're done with the smart coffee machine. Now we're going to do a little bit of fitness with a jump rope. It's basically the same, because it's still a Bluetooth low-energy device. Just the same, well, as you can imagine, you can hack it on the hardware part or on the communication part. But you already know that I'm going to do everything here from the smartphone. So actually, that's something that Thomas mentioned at some point in one of his slides, is that, yeah, do not forget to have a look at the system logs of Android, because you can find sometimes really valuable information. And here, it turns out that actually the application is logging everything that you want on the Android system logs, including Bluetooth packets. So I'm going to show that. And this is going to be a live demo. So enjoy. Hopefully, I will enjoy it as much. It might not work, never know. So screen copy. I'm going to show you my smartphone. So there we go. This is the smart. And now the logs and the logcat. So it's logging everything with the tag, with the section tag in there. OK. So I can stop this. I'm going to connect the smart jump. Oh, yeah, it's working, right? Yeah, I understood. There we go. There we go. And it was disconnected. So this is Bluetooth. There we go. OK, so this is all the logs that you get. I don't even need to jump, but I'll come do it. Because you'll see, actually, that you get more logs. Thank you. Yeah, sorry. So you get it here. So actually, if you have a look at in there, in the logs, well, we'll see some of them. But I'm looking for, by the way, this is each time I was jumping, it tells you lots of things. So that was probably the sixth jump. And battery is 100%, looks like. OK. Not sure. I'm looking for one specific log. Yeah, this one. Oops, where is this one? Here. This is exactly the raw packet, which is sent by Bluetooth. OK, so this is pretty interesting there, because it will help you afterwards understand how to


chunk_text:
  we go. This is the smart. And now the logs and the logcat. So it's logging everything with the tag, with the section tag in there. OK. So I can stop this. I'm going to connect the smart jump. Oh, yeah, it's working, right? Yeah, I understood. There we go. There we go. And it was disconnected. So this is Bluetooth. There we go. OK, so this is all the logs that you get. I don't even need to jump, but I'll come do it. Because you'll see, actually, that you get more logs. Thank you. Yeah, sorry. So you get it here. So actually, if you have a look at in there, in the logs, well, we'll see some of them. But I'm looking for, by the way, this is each time I was jumping, it tells you lots of things. So that was probably the sixth jump. And battery is 100%, looks like. OK. Not sure. I'm looking for one specific log. Yeah, this one. Oops, where is this one? Here. This is exactly the raw packet, which is sent by Bluetooth. OK, so this is pretty interesting there, because it will help you afterwards understand how to deal with and communicate with the jump rope. OK, so there you've got it. As you've seen, well, I don't know. Maybe you speak fluent Chinese, but I don't. But my main difficulty was there, that you just have to translate it. But once you translate it, it's OK. It's relatively clear. You've got, well, battery data here. The battery level, in that case, was 70 here. This exactly translates to, there is a buzzer. You'll see afterwards, but it has a buzzer, and it can make a little bit of noise. So it helps very much to continue the reverse engineering, because, well, you basically go in the code, and you're going to copy those Chinese characters to search them in the code. And for instance, well, here, I end up in a method, which is called updateBattery, and which was quite logical. It was saying something about battery level, so this is fine. And it tells me that, so probably BLE LiveData is a class I need to investigate. For the one with the Bluetooth row packet, so I copied the characters in here, and it ends up in a method, which is named parseCommand. This is also


chunk_text:
  deal with and communicate with the jump rope. OK, so there you've got it. As you've seen, well, I don't know. Maybe you speak fluent Chinese, but I don't. But my main difficulty was there, that you just have to translate it. But once you translate it, it's OK. It's relatively clear. You've got, well, battery data here. The battery level, in that case, was 70 here. This exactly translates to, there is a buzzer. You'll see afterwards, but it has a buzzer, and it can make a little bit of noise. So it helps very much to continue the reverse engineering, because, well, you basically go in the code, and you're going to copy those Chinese characters to search them in the code. And for instance, well, here, I end up in a method, which is called updateBattery, and which was quite logical. It was saying something about battery level, so this is fine. And it tells me that, so probably BLE LiveData is a class I need to investigate. For the one with the Bluetooth row packet, so I copied the characters in here, and it ends up in a method, which is named parseCommand. This is also something that hackers will love. Whenever you see parseCommand, you know, stars in the eyes, things like that. BlueLEService is another class which is probably interesting to look into. And while you look into that, it takes a little bit of time, but you will get the full picture, which is, understand how to discuss with the jump rope. Basically, there are three different modes with this jump rope. The number countdown mode, which means that you are going to say, I want to jump, I don't know, 500 times. The time countdown mode is, I want to jump five minutes. And then the free jump mode is, I don't know what I want to do, but just let me jump, okay? So, this is the way to send this command to the jump rope. So, in phone 2022, what people had to do was to try and initiate a command where they would do 1,337 jumps, okay? So, what they had to do is to connect to the device. Then the organization of the jump rope in terms of services and characteristics, it's much simpler than the smart coffee machine. There's basically only one or two important services. And


chunk_text:
  something that hackers will love. Whenever you see parseCommand, you know, stars in the eyes, things like that. BlueLEService is another class which is probably interesting to look into. And while you look into that, it takes a little bit of time, but you will get the full picture, which is, understand how to discuss with the jump rope. Basically, there are three different modes with this jump rope. The number countdown mode, which means that you are going to say, I want to jump, I don't know, 500 times. The time countdown mode is, I want to jump five minutes. And then the free jump mode is, I don't know what I want to do, but just let me jump, okay? So, this is the way to send this command to the jump rope. So, in phone 2022, what people had to do was to try and initiate a command where they would do 1,337 jumps, okay? So, what they had to do is to connect to the device. Then the organization of the jump rope in terms of services and characteristics, it's much simpler than the smart coffee machine. There's basically only one or two important services. And so, you get easily the characteristics you can write to, because I think there's only one, actually. So, there's not lots of choices. And then you send the command that I said over here, which is, well, some basic thing at the beginning. Then you say, oh, it's number countdown mode. So, I'm going to specify a number of jumps. Then in hex 539, well, that is the target number of jumps I want. And the last two are a CRC, a checksum. So, you just have to figure out that it's CRC 16 Modbus, but that's the only difficulty you have to do, okay? And yeah, I've got another demo. Yeah. So, we don't need a phone for this one. So, I'm going to show you how I communicate with the jump rope directly. Hey. Well, looks like my screen has frozen or what? Yeah. So, yeah, it's not clicking. Just trying. Okay. So, I'm rebooting. Sorry for this. So, I'm going to show you afterwards a program, which communicates by BLE to the jump rope. And we're going to send the commands there to start and jump and things like that. Okay. Rebooting. Don't worry. It's normal that


chunk_text:
  so, you get easily the characteristics you can write to, because I think there's only one, actually. So, there's not lots of choices. And then you send the command that I said over here, which is, well, some basic thing at the beginning. Then you say, oh, it's number countdown mode. So, I'm going to specify a number of jumps. Then in hex 539, well, that is the target number of jumps I want. And the last two are a CRC, a checksum. So, you just have to figure out that it's CRC 16 Modbus, but that's the only difficulty you have to do, okay? And yeah, I've got another demo. Yeah. So, we don't need a phone for this one. So, I'm going to show you how I communicate with the jump rope directly. Hey. Well, looks like my screen has frozen or what? Yeah. So, yeah, it's not clicking. Just trying. Okay. So, I'm rebooting. Sorry for this. So, I'm going to show you afterwards a program, which communicates by BLE to the jump rope. And we're going to send the commands there to start and jump and things like that. Okay. Rebooting. Don't worry. It's normal that you're not seeing anything because, well, I unplugged the HDMI cable. So, yeah, looks like this is fine. Well, unfortunately, I had set it up and I'll have to do it again. But so, we go in jump rope directory. And I'm going to try, oh, I need also to show you my camera. Okay. So, cheese. So, what happens is that there's a small LCD screen on the jump rope and that's what I want to show you. Yeah, not too bad. So, and I'll put this in there. Okay. So, I'm connected. We're going to do, how many jumps do you want? Okay, 800. It's not working. Okay, let's do it again. Okay, so I should put it the other way around so that you see that perhaps better. But you can normally approximately see that it says 800. Yeah, sorry for this. It's not really obvious. Now, I do not intend to do 800 jumps. So, we're going to cancel that. Canceling it. And then you can try a time jump and I'm going to jump for 400 seconds. And this is, you see exactly the number count down there. Then, you know, my colleagues were annoyed


chunk_text:
  you're not seeing anything because, well, I unplugged the HDMI cable. So, yeah, looks like this is fine. Well, unfortunately, I had set it up and I'll have to do it again. But so, we go in jump rope directory. And I'm going to try, oh, I need also to show you my camera. Okay. So, cheese. So, what happens is that there's a small LCD screen on the jump rope and that's what I want to show you. Yeah, not too bad. So, and I'll put this in there. Okay. So, I'm connected. We're going to do, how many jumps do you want? Okay, 800. It's not working. Okay, let's do it again. Okay, so I should put it the other way around so that you see that perhaps better. But you can normally approximately see that it says 800. Yeah, sorry for this. It's not really obvious. Now, I do not intend to do 800 jumps. So, we're going to cancel that. Canceling it. And then you can try a time jump and I'm going to jump for 400 seconds. And this is, you see exactly the number count down there. Then, you know, my colleagues were annoyed with the buzzer. So, I had to do something about the buzzer. So, this is buzzer off. And now, let's try it. And now, the free jump mode. No, sorry, I've got to cancel first the other one. So, it cancels. When it cancels, it tells me I've spent like 22 seconds doing nothing. Okay. And now, I'm going to try free jump mode. And there it tells me, well, okay, go on, but you've done nothing. Okay, I can cancel that. And then, because I liked noise, I'm going to put the buzzer back on. You've got the buzzer. Okay. Okay. So, let's go back to the slides. I'm happy nobody among the audience connected to the jump rope. Okay. So, I'm going back to my slides, and we'll finish up. Yeah, this is done. Now, this is not totally done for a CTF, because how are we going to validate the flag? We want basically the participants to know how to send the correct command, but in return, we've got to give them a flag. So, how are we going to validate that? There are various options. One of those is, well, to do the manual validation. They


chunk_text:
  with the buzzer. So, I had to do something about the buzzer. So, this is buzzer off. And now, let's try it. And now, the free jump mode. No, sorry, I've got to cancel first the other one. So, it cancels. When it cancels, it tells me I've spent like 22 seconds doing nothing. Okay. And now, I'm going to try free jump mode. And there it tells me, well, okay, go on, but you've done nothing. Okay, I can cancel that. And then, because I liked noise, I'm going to put the buzzer back on. You've got the buzzer. Okay. Okay. So, let's go back to the slides. I'm happy nobody among the audience connected to the jump rope. Okay. So, I'm going back to my slides, and we'll finish up. Yeah, this is done. Now, this is not totally done for a CTF, because how are we going to validate the flag? We want basically the participants to know how to send the correct command, but in return, we've got to give them a flag. So, how are we going to validate that? There are various options. One of those is, well, to do the manual validation. They come, they show us that they are able to trigger the number of jumps, and we give them a flag in return. It always works. That's something we can always try. Oops. We have also the possibility to have a web server. Okay. And then people would enter on the web server that they know how to do the number of jumps, but it's missing kind of the BLE interaction. So, I didn't really like that. The other thing was, well, we're going to modify the firmware on the jump rope, and we will display the flag. But unfortunately, as you might have seen, it's really only a four-digit LCD. So, I don't think it's possible to display the flag in there. Okay. It would have been really difficult. So, I ended up with the last solution is that I would like to build a fake jump rope, which behaves exactly the same from a BLE point of view, but just has no rope. Okay. So, I tried that. I tried that for weeks, perhaps even months. It was never working. There are plenty of different packages to deal with BLE. I don't think that maybe I was unlucky or


chunk_text:
  come, they show us that they are able to trigger the number of jumps, and we give them a flag in return. It always works. That's something we can always try. Oops. We have also the possibility to have a web server. Okay. And then people would enter on the web server that they know how to do the number of jumps, but it's missing kind of the BLE interaction. So, I didn't really like that. The other thing was, well, we're going to modify the firmware on the jump rope, and we will display the flag. But unfortunately, as you might have seen, it's really only a four-digit LCD. So, I don't think it's possible to display the flag in there. Okay. It would have been really difficult. So, I ended up with the last solution is that I would like to build a fake jump rope, which behaves exactly the same from a BLE point of view, but just has no rope. Okay. So, I tried that. I tried that for weeks, perhaps even months. It was never working. There are plenty of different packages to deal with BLE. I don't think that maybe I was unlucky or else, but it was never working totally. Sometimes the packages were extremely old. So, I even could not install them any longer. Some other times, well, it was working to some points, but then it was bugging. Then probably I added my own bugs also on top of it. So, I was like, you know, thinking that maybe I would abandon that. And then I went to another CTF I participated to, which is hardware.io. And they were featuring a very nice BLE challenge. And I'm not going to ruin their challenge. But I thought, yeah, that's exactly what I should be using. They had kind of a server, which was like a small Arduino-like board, which was acting as the BLE peripheral. So, I asked them for the code after the CTF they shared, which was really cool of them. And I had a look, and I don't know why I hadn't thought about that, but it was really easy and straightforward. Just use the BLE from, well, Arduino ESP32. So, I bought like three different ESP32 boards and started designing the fake jump rope. So, I reused exactly the same services, the same characteristics as the real board,


chunk_text:
  else, but it was never working totally. Sometimes the packages were extremely old. So, I even could not install them any longer. Some other times, well, it was working to some points, but then it was bugging. Then probably I added my own bugs also on top of it. So, I was like, you know, thinking that maybe I would abandon that. And then I went to another CTF I participated to, which is hardware.io. And they were featuring a very nice BLE challenge. And I'm not going to ruin their challenge. But I thought, yeah, that's exactly what I should be using. They had kind of a server, which was like a small Arduino-like board, which was acting as the BLE peripheral. So, I asked them for the code after the CTF they shared, which was really cool of them. And I had a look, and I don't know why I hadn't thought about that, but it was really easy and straightforward. Just use the BLE from, well, Arduino ESP32. So, I bought like three different ESP32 boards and started designing the fake jump rope. So, I reused exactly the same services, the same characteristics as the real board, so that it really would look like the real one. Except that, for instance, on the jump rope, there is an over-the-air service for firmware update. Well, obviously, I have no idea how to implement that on the fake jump rope, and it's useless. So, I just left it, but it wouldn't do anything on the fake one. And I added a specific CTF service, which was pretty much recognizable with a very strange UID, dead beef, in here, and only one characteristic with the flag. Okay, now, if one of the team manages to know how to do the number, the requested number of jumps, I don't want, they will get the flag, but I don't want the next team to come in and see the flag without having to do anything. So, to prevent that, the solution is, of course, to erase the flag between all teams. And what we implemented was a solution where only one team would be able to connect at a given time, and when they were connecting or disconnecting, I would remove and erase the flag. It worked very well. We implemented three different fake BLE jump rope servers just to make sure


chunk_text:
  so that it really would look like the real one. Except that, for instance, on the jump rope, there is an over-the-air service for firmware update. Well, obviously, I have no idea how to implement that on the fake jump rope, and it's useless. So, I just left it, but it wouldn't do anything on the fake one. And I added a specific CTF service, which was pretty much recognizable with a very strange UID, dead beef, in here, and only one characteristic with the flag. Okay, now, if one of the team manages to know how to do the number, the requested number of jumps, I don't want, they will get the flag, but I don't want the next team to come in and see the flag without having to do anything. So, to prevent that, the solution is, of course, to erase the flag between all teams. And what we implemented was a solution where only one team would be able to connect at a given time, and when they were connecting or disconnecting, I would remove and erase the flag. It worked very well. We implemented three different fake BLE jump rope servers just to make sure that, you know, well, BLE is BLE, I'll talk a little bit about that. We sometimes have bad surprises, so it's always good to have three different items in case it is needed. So, a little bit of advice and takeaways from different perspectives. Hackers, well, don't forget to inspect Android logs. From a developer point of view, I'm not saying that you should remove all logs, because some are just very useful, but if it's debug logs, then you should think about removing them. Normally, if you're in, like, you know, a company which is used to producing code, this is really standard, and there are procedures to make sure that the logs are removed. But here, we're talking about connected objects, and I have the feeling that it's like, you know, a poor intern who was affected to developing the stuff in overnight, and sometimes the development is a little bit crappy. BLE connection is always painful. That's, I don't know, always the case. I haven't experienced too many issues with the Smart Coffee machine except for pairing, but with the jump rope here, sometimes I get unwanted disconnections. I don't know why, but this probably means, from


chunk_text:
  that, you know, well, BLE is BLE, I'll talk a little bit about that. We sometimes have bad surprises, so it's always good to have three different items in case it is needed. So, a little bit of advice and takeaways from different perspectives. Hackers, well, don't forget to inspect Android logs. From a developer point of view, I'm not saying that you should remove all logs, because some are just very useful, but if it's debug logs, then you should think about removing them. Normally, if you're in, like, you know, a company which is used to producing code, this is really standard, and there are procedures to make sure that the logs are removed. But here, we're talking about connected objects, and I have the feeling that it's like, you know, a poor intern who was affected to developing the stuff in overnight, and sometimes the development is a little bit crappy. BLE connection is always painful. That's, I don't know, always the case. I haven't experienced too many issues with the Smart Coffee machine except for pairing, but with the jump rope here, sometimes I get unwanted disconnections. I don't know why, but this probably means, from a developer point of view, that the quality of the BLE chip is not the same at both ends, okay? Or the way it is manufactured in the device is probably different. As much as possible, if you're a developer, I would recommend not to use pairing, because pairing, I managed to do it, but there's no way that my father would be able to do it. I mean, it's really complicated. Okay. BLE notifications is also something I haven't discussed, but it was really useful, especially for the Smart Coffee machine. Activate all notifications that you can. You will get much more messages, and it's helpful to see the status of what is happening. BLE encryption, that's also another part. I have hacked quite a few of different BLE devices. None of them have ever used BLE encryption. It exists, but nobody uses it. So, well, if you want to communicate secrets, that's a way to do, at least. Manuals, manuals, well, yeah, they are really useful, especially to get the reset procedure. So, and you can also get some hints on the hardware, and from the developer's point of view, well, if you want to go green, and


chunk_text:
  a developer point of view, that the quality of the BLE chip is not the same at both ends, okay? Or the way it is manufactured in the device is probably different. As much as possible, if you're a developer, I would recommend not to use pairing, because pairing, I managed to do it, but there's no way that my father would be able to do it. I mean, it's really complicated. Okay. BLE notifications is also something I haven't discussed, but it was really useful, especially for the Smart Coffee machine. Activate all notifications that you can. You will get much more messages, and it's helpful to see the status of what is happening. BLE encryption, that's also another part. I have hacked quite a few of different BLE devices. None of them have ever used BLE encryption. It exists, but nobody uses it. So, well, if you want to communicate secrets, that's a way to do, at least. Manuals, manuals, well, yeah, they are really useful, especially to get the reset procedure. So, and you can also get some hints on the hardware, and from the developer's point of view, well, if you want to go green, and you claim you want to go green, well, the really good thing to do is to give some opportunity to people to repair the device that you are giving them. Okay. So, I don't know, give good manuals, service manuals, that is really good. Different parts, where to find and repair parts. If you can't, well, maybe 3D designs of the parts that you would like, that would be helpful to repair. That's good. Hacking, so how, now, let's suppose that you want to hack a new device after this. Where should you start? Well, it really depends what you are good at. If you master the hardware part, go and start from there. If you don't, and you rather are good at Android hacking and things like that, like me, well, it's obviously rather in the Android parts that you should do some reverse engineering. The other thing also, which I think is interesting to point out for developers, is that hackers are not your enemies. Hackers are not attackers all the time. And especially in all the hacks that we've seen so far, well, they were all positive hacks. I mean, I'm not breaking anything, okay? I'm actually


chunk_text:
  you claim you want to go green, well, the really good thing to do is to give some opportunity to people to repair the device that you are giving them. Okay. So, I don't know, give good manuals, service manuals, that is really good. Different parts, where to find and repair parts. If you can't, well, maybe 3D designs of the parts that you would like, that would be helpful to repair. That's good. Hacking, so how, now, let's suppose that you want to hack a new device after this. Where should you start? Well, it really depends what you are good at. If you master the hardware part, go and start from there. If you don't, and you rather are good at Android hacking and things like that, like me, well, it's obviously rather in the Android parts that you should do some reverse engineering. The other thing also, which I think is interesting to point out for developers, is that hackers are not your enemies. Hackers are not attackers all the time. And especially in all the hacks that we've seen so far, well, they were all positive hacks. I mean, I'm not breaking anything, okay? I'm actually making the coffee machine more usable because it's now usable over the Wi-Fi, and I can get my famous 90 milliliter cup. Okay, it's maybe useless, but it's fun. Okay. But yeah, it's a good thing. It's fun, okay? But yeah, it's useful. And we only hack things that we like, to be honest. Otherwise, it's not, or that we find funny. Otherwise, we wouldn't be doing it. Now, this is a little bit more part of my job. I thought of, well, is it possible to infect either of these devices? Fortunately, in that case, it is not. Because there is nothing where we can really substantially store a malware. It doesn't need lots of space. A malware, a few bytes, or at least one kilobyte would be sufficient. But we don't even have that. They are really limited there. So this is good. But if you are designing a connected device, which is connected to internet and has storage, even a little bit of storage, really pay attention to this. Because they might get compromised and serve to compromise other hosts afterwards. So this, you need really to pay attention to. And that's all. Thank you very much


chunk_text:
  making the coffee machine more usable because it's now usable over the Wi-Fi, and I can get my famous 90 milliliter cup. Okay, it's maybe useless, but it's fun. Okay. But yeah, it's a good thing. It's fun, okay? But yeah, it's useful. And we only hack things that we like, to be honest. Otherwise, it's not, or that we find funny. Otherwise, we wouldn't be doing it. Now, this is a little bit more part of my job. I thought of, well, is it possible to infect either of these devices? Fortunately, in that case, it is not. Because there is nothing where we can really substantially store a malware. It doesn't need lots of space. A malware, a few bytes, or at least one kilobyte would be sufficient. But we don't even have that. They are really limited there. So this is good. But if you are designing a connected device, which is connected to internet and has storage, even a little bit of storage, really pay attention to this. Because they might get compromised and serve to compromise other hosts afterwards. So this, you need really to pay attention to. And that's all. Thank you very much for your attention. Okay, so do we have questions? We have a few minutes at the moment. Coffees are being prepared in the main room. And I think it's a good idea to keep you here, to not let you go to the coffee machines right there. So let's start there. Wait for the microphone. I haven't sent it to Nespresso in that case. Because it wasn't a vulnerability, right? Okay, so I thought that they wouldn't really be interested. However, if they want, for instance, to implement on their app the possibility to customize the volume, well, they are more than capable to do it. So it would be possible. They can go and get it. I mean, it's public also for them. But yeah, so the answer is no, because I thought it was not a vulnerability. Any other question? Same for the jump rope, by the way. I didn't disclose because, well, it's just using it another way. But it's not really vulnerable. Okay, thank you, Axel.


chunk_text:
  for your attention. Okay, so do we have questions? We have a few minutes at the moment. Coffees are being prepared in the main room. And I think it's a good idea to keep you here, to not let you go to the coffee machines right there. So let's start there. Wait for the microphone. I haven't sent it to Nespresso in that case. Because it wasn't a vulnerability, right? Okay, so I thought that they wouldn't really be interested. However, if they want, for instance, to implement on their app the possibility to customize the volume, well, they are more than capable to do it. So it would be possible. They can go and get it. I mean, it's public also for them. But yeah, so the answer is no, because I thought it was not a vulnerability. Any other question? Same for the jump rope, by the way. I didn't disclose because, well, it's just using it another way. But it's not really vulnerable. Okay, thank you, Axel.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=x5IyXJthNo0", "title": "The Latest Startups In Cybersecurity & How To Become A Cyber Entrepreneur? by Trust Valley Startups", "description": "", "channel_url": "https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA", "duration": 3245, "channel": "scrt.insomnihack", "uploader": "scrt.insomnihack", "upload_date": "20230411" } This text was transcribed using whisper model: large-v2 Ladies and gentlemen, we are very pleased to be with you today. I'm Lénique Pedron, the director of the Trust Valley, and I am with Olivier Crochat, the executive director of the C4DT, come from EPFL. We are very honored to be with you with two parts of this slot with you. The first part will be a pitch of our start-up, and the second part will be a discussion how to become a cyber entrepreneur, and we will have three start-ups with us, three entrepreneurs, and one serial entrepreneur too, and they will speak about how you can find a way to create your own company in cyber. First, some words about the Trust Valley, and I just want to say to you that we are not alone. You have seen we have some people here. It's because we have the Jury des Assises de Monaco, the start-up. They are with us since this morning, and they will follow the pitch of our start-up. The Trust Valley is a private-public partnership for digital trust and cybersecurity on mission to foster trust, innovation, and collaboration in the economy. We were founded by the state of the Republic of Geneva and the state of Vaud. We work a lot with the NCS, so the Confederation, and all the part of some other governments, so thank you to the Luxembourg to be with us, the government part of the Luxembourg. Thank you to be with us today too. We have as a funder six academics, such as EPFL is one of our funders. Thank you for the support. And also a lot of private sector, such as SMB, SME, that you know as ACRT, is a sponsor of the Trust Valley too, but also is an expert solution on one to the other. We have also Koudelski and all the names that you hear, I am sure you know. The Trust Valley mission is really we do some referencing, promotion, network, hub, talent is for that. It's really important for us to be with you today also. And we create some projects. The first project program was created before the COVID.


chunk_text:
  follow the pitch of our start-up. The Trust Valley is a private-public partnership for digital trust and cybersecurity on mission to foster trust, innovation, and collaboration in the economy. We were founded by the state of the Republic of Geneva and the state of Vaud. We work a lot with the NCS, so the Confederation, and all the part of some other governments, so thank you to the Luxembourg to be with us, the government part of the Luxembourg. Thank you to be with us today too. We have as a funder six academics, such as EPFL is one of our funders. Thank you for the support. And also a lot of private sector, such as SMB, SME, that you know as ACRT, is a sponsor of the Trust Valley too, but also is an expert solution on one to the other. We have also Koudelski and all the names that you hear, I am sure you know. The Trust Valley mission is really we do some referencing, promotion, network, hub, talent is for that. It's really important for us to be with you today also. And we create some projects. The first project program was created before the COVID. It was, the name is Tech Fortress, this is a booster for startup. So if you have a project, if you want to create your project because we have an idea, just come to us and we can discuss to go to the market. Because what we have seen in this region is that there is a lot of many, many very strong and very good community with a lot of expertise, technical expertise, but sometimes they need to have the go-to market. So it's what we have done with our startup and we want to share that to you. We work also with SMEs, so you will see some of our startup are now involved in our program dedicated to SMB, SMEs. So it's for that we open for them some possibility, some business opportunities to work with SMEs and also with corporate. Next, with KeyFuture of this huge program, it was really a pilot the first year. We thought that it was very difficult to find 10 startup and we found 15 startup for the first edition. And now this is the fourth edition and we have more than 100 startup supported and it's nearly 50% come from


chunk_text:
  It was, the name is Tech Fortress, this is a booster for startup. So if you have a project, if you want to create your project because we have an idea, just come to us and we can discuss to go to the market. Because what we have seen in this region is that there is a lot of many, many very strong and very good community with a lot of expertise, technical expertise, but sometimes they need to have the go-to market. So it's what we have done with our startup and we want to share that to you. We work also with SMEs, so you will see some of our startup are now involved in our program dedicated to SMB, SMEs. So it's for that we open for them some possibility, some business opportunities to work with SMEs and also with corporate. Next, with KeyFuture of this huge program, it was really a pilot the first year. We thought that it was very difficult to find 10 startup and we found 15 startup for the first edition. And now this is the fourth edition and we have more than 100 startup supported and it's nearly 50% come from Switzerland, all the canton. And Zurich, Bern, Vaud for sure, and Geneva. And also we have now a lot of startup come from foreign country, it's 40% also. More than 50 partners and more than 200 million raised by our portfolio. So what we have seen since the beginning of the journey with the Tech Fortress, it's really, at the beginning it was really difficult for a cyber funder to raise funds, to fund a fund, to fund a good investor. The market is really time-riding now, so I think it's really a huge opportunity for you also to go in this cyber entrepreneurship. The value offered by the program is nearly 100k on the budget. Best-in-class cyber security startup, so we scout, all the year we scout with the help of EPFL, but also with private sector, and also with the canton, and also with the army. We work with armistice. Some of you maybe know the cyber defense campus, they help us to have good scouting. And we scout this kind of expertise, I will not read all the word, but I'm sure that you have seen this kind of what we are looking for. We opened this


chunk_text:
  Switzerland, all the canton. And Zurich, Bern, Vaud for sure, and Geneva. And also we have now a lot of startup come from foreign country, it's 40% also. More than 50 partners and more than 200 million raised by our portfolio. So what we have seen since the beginning of the journey with the Tech Fortress, it's really, at the beginning it was really difficult for a cyber funder to raise funds, to fund a fund, to fund a good investor. The market is really time-riding now, so I think it's really a huge opportunity for you also to go in this cyber entrepreneurship. The value offered by the program is nearly 100k on the budget. Best-in-class cyber security startup, so we scout, all the year we scout with the help of EPFL, but also with private sector, and also with the canton, and also with the army. We work with armistice. Some of you maybe know the cyber defense campus, they help us to have good scouting. And we scout this kind of expertise, I will not read all the word, but I'm sure that you have seen this kind of what we are looking for. We opened this year two new vertical, relative to digital governance, and P-STEC. Why? Because we have now one incubator, just opened at the end of last year, in a new campus named Unlimit Trust, dedicated to economy of trust and cyber security, just close to SIGPA company. And we will open also a new trust village in the same mood, in Geneva, in April or June. And we will scout about P-STEC, because we think that it's really a market to open with that. And also about canton. At this time, what we have seen with the startup come from canton, it was, yes, I think we can raise the number of the startup in canton. In the field, we work a lot with space, smart cities, agri-tech, agri-food, health, and the other. So moderation with Olivier Crochat, and right now, I call Cognitech, our first startupper, so Gilles Rosset, CIO at Cognitech. Thank you, Lenny. First security incidents have one thing in common, and I'm talking about intrusion, sabotage, fraud, data leakage, and so on. They were made possible because sometime in the past, something changed in the information system, and the impact of this change was not assessed or completely


chunk_text:
  year two new vertical, relative to digital governance, and P-STEC. Why? Because we have now one incubator, just opened at the end of last year, in a new campus named Unlimit Trust, dedicated to economy of trust and cyber security, just close to SIGPA company. And we will open also a new trust village in the same mood, in Geneva, in April or June. And we will scout about P-STEC, because we think that it's really a market to open with that. And also about canton. At this time, what we have seen with the startup come from canton, it was, yes, I think we can raise the number of the startup in canton. In the field, we work a lot with space, smart cities, agri-tech, agri-food, health, and the other. So moderation with Olivier Crochat, and right now, I call Cognitech, our first startupper, so Gilles Rosset, CIO at Cognitech. Thank you, Lenny. First security incidents have one thing in common, and I'm talking about intrusion, sabotage, fraud, data leakage, and so on. They were made possible because sometime in the past, something changed in the information system, and the impact of this change was not assessed or completely understood. A new service was exposed, but the configuration of your vulnerability scanner or IDS has not been adapted. A person moved within the organization and started accumulating toxic combination of access rights. A new version of the email client has been deployed on the workstations, and you don't have the right controls on the DLP agent or the endpoint protection system. Those things happen in real life. Whatever your level of maturity in terms of cybersecurity, whatever the budget, the tools, the people, the process is in place. That's the real life. So what can you do about it? Can you perform a complete, in-depth risk assessment for every single change? Obviously, it's not economically viable. My name is Gilles Rosset, and I'm the CEO and founder of Cognitech, where we provide a technological solution to this issue. Our platform will monitor and watch and detect the pertinent changes in your information system and assess its impact in terms of risk and compliance to your policies. So that we immediately detect whenever you're in a situation where the risk is higher or whenever there's a violation of one of your policies. And as we are able to do that,


chunk_text:
  understood. A new service was exposed, but the configuration of your vulnerability scanner or IDS has not been adapted. A person moved within the organization and started accumulating toxic combination of access rights. A new version of the email client has been deployed on the workstations, and you don't have the right controls on the DLP agent or the endpoint protection system. Those things happen in real life. Whatever your level of maturity in terms of cybersecurity, whatever the budget, the tools, the people, the process is in place. That's the real life. So what can you do about it? Can you perform a complete, in-depth risk assessment for every single change? Obviously, it's not economically viable. My name is Gilles Rosset, and I'm the CEO and founder of Cognitech, where we provide a technological solution to this issue. Our platform will monitor and watch and detect the pertinent changes in your information system and assess its impact in terms of risk and compliance to your policies. So that we immediately detect whenever you're in a situation where the risk is higher or whenever there's a violation of one of your policies. And as we are able to do that, we are also able to simulate the impact of a change that you plan to do. This is how we help our clients to achieve truly agile risk management and continuous compliance without slowing down innovation. Thank you. Thank you. Thank you. Thank you so much, Gilles. Do we have some questions coming from the Assis de Monaco? No, not yet. Oh, not yet? Adieu. Okay, so Gilles, what are your USPs? Well, the USP is really the real-time aspect, because we are really monitoring all the information continuously. And the fact that we make it super user-friendly to the end user that we target. We are not dedicated to technical engineers. We are really targeting a population of risk managers, senior managers that want to use and have a vision on the situation and be able to use it without having a training or without having some complicated stuff to do or develop code or whatever. And is it more for large companies, or is it depending on the level of security of data that you need to have, or what? It's from the SMEs to the biggest companies, because obviously, to have that kind of system in place,


chunk_text:
  we are also able to simulate the impact of a change that you plan to do. This is how we help our clients to achieve truly agile risk management and continuous compliance without slowing down innovation. Thank you. Thank you. Thank you. Thank you so much, Gilles. Do we have some questions coming from the Assis de Monaco? No, not yet. Oh, not yet? Adieu. Okay, so Gilles, what are your USPs? Well, the USP is really the real-time aspect, because we are really monitoring all the information continuously. And the fact that we make it super user-friendly to the end user that we target. We are not dedicated to technical engineers. We are really targeting a population of risk managers, senior managers that want to use and have a vision on the situation and be able to use it without having a training or without having some complicated stuff to do or develop code or whatever. And is it more for large companies, or is it depending on the level of security of data that you need to have, or what? It's from the SMEs to the biggest companies, because obviously, to have that kind of system in place, you have to have a certain level of maturity in terms of data. So that addresses SMEs and more. So it could be also SMEs then? Yeah. Okay. No question? Okay, so thank you so much. Thank you. Thank you. Okay. Now, our next startupper, Stefano Zamuna, software developer and machine learning specialist at ClearSky. Thank you. Can you hear me? Yes. Yes. Have you ever considered how easy it is for hackers to clone your voice? It takes them just a sample of three seconds to build your vocal avatar and make you say whatever they want. Now imagine what they can do by stealing hours of recordings from board meetings or medical consultations. Confidential conversations need more secure solutions, and this is where ClearSky comes in. Our product, ClearMind, will transform your conversations into digital and structured documents, locally, without the need for an internet connection. With ClearMind, you don't have to worry about taking notes anymore. You can focus on the conversation you're having, and our technology will take care about extracting and summarizing key information for you, saving you time and all this without compromising your privacy. We already tested our solution in several clinics around


chunk_text:
  you have to have a certain level of maturity in terms of data. So that addresses SMEs and more. So it could be also SMEs then? Yeah. Okay. No question? Okay, so thank you so much. Thank you. Thank you. Okay. Now, our next startupper, Stefano Zamuna, software developer and machine learning specialist at ClearSky. Thank you. Can you hear me? Yes. Yes. Have you ever considered how easy it is for hackers to clone your voice? It takes them just a sample of three seconds to build your vocal avatar and make you say whatever they want. Now imagine what they can do by stealing hours of recordings from board meetings or medical consultations. Confidential conversations need more secure solutions, and this is where ClearSky comes in. Our product, ClearMind, will transform your conversations into digital and structured documents, locally, without the need for an internet connection. With ClearMind, you don't have to worry about taking notes anymore. You can focus on the conversation you're having, and our technology will take care about extracting and summarizing key information for you, saving you time and all this without compromising your privacy. We already tested our solution in several clinics around Switzerland. Doctors are reporting an improved focus on their patients and up to 40% of their time saved by using our technology. But ClearMind is not just for doctors. We are testing it in the legal domain, and our team will be more than happy to help you augment and automatize your private conversations as well. So if you are interested in this kind of solution, please meet us at our booth and sign up for a demo. I'm Stefan Zamonaris, CTO of ClearSky. Thank you for your attention. Thank you. Thank you so much. Just maybe one question. I have the feeling that what you said is that it's processing conversation to extract useful information. Yes. What's the link with the protecting the audio from fake redoing your voice? So our solution is limiting the surface of attacks that you can have by being completely isolated from the internet. So if someone wants to steal your data, they have to have physical access to them. But in any case, we are, of course, having encryption solutions on the device. So this is our solution. OK, thank you. Some questions come from Monaco. And so maybe while we're waiting for


chunk_text:
  Switzerland. Doctors are reporting an improved focus on their patients and up to 40% of their time saved by using our technology. But ClearMind is not just for doctors. We are testing it in the legal domain, and our team will be more than happy to help you augment and automatize your private conversations as well. So if you are interested in this kind of solution, please meet us at our booth and sign up for a demo. I'm Stefan Zamonaris, CTO of ClearSky. Thank you for your attention. Thank you. Thank you so much. Just maybe one question. I have the feeling that what you said is that it's processing conversation to extract useful information. Yes. What's the link with the protecting the audio from fake redoing your voice? So our solution is limiting the surface of attacks that you can have by being completely isolated from the internet. So if someone wants to steal your data, they have to have physical access to them. But in any case, we are, of course, having encryption solutions on the device. So this is our solution. OK, thank you. Some questions come from Monaco. And so maybe while we're waiting for the questions from Monaco, you said that, of course, medical information is interesting. And you talk about the legal one. Any other domains or sectors where it could be interesting? So there is the law enforcement, where we have depositions, where people can go to the law enforcement units. Boot meetings is another segment we are investigating at the moment. So this kind of solution. Thank you. OK. Thank you so much. Thank you. OK. Thank you. Next startup, Dejan Milenovic, CIO of Autena. Thank you. Autena makes the world more connected, transparent, and authentic place by providing instantaneous verifiable trust across multiple value chains. Our technology at the moment is in more than 70 countries and used in different verticals like pharma, food and beverage, luxury, and sport. Contrafitting creates losses in the range of hundreds of billions of dollars per year and impacts societies and individuals and companies in multiple ways, but most importantly, it endangers human life. And in the recent years, we have noticed a rapid increase in contrafitting, partially due to the pandemic and the increase in online trade, and also with the emergence of digital technologies, multiverse, and blockchain, we have the contrafitting appearing


chunk_text:
  the questions from Monaco, you said that, of course, medical information is interesting. And you talk about the legal one. Any other domains or sectors where it could be interesting? So there is the law enforcement, where we have depositions, where people can go to the law enforcement units. Boot meetings is another segment we are investigating at the moment. So this kind of solution. Thank you. OK. Thank you so much. Thank you. OK. Thank you. Next startup, Dejan Milenovic, CIO of Autena. Thank you. Autena makes the world more connected, transparent, and authentic place by providing instantaneous verifiable trust across multiple value chains. Our technology at the moment is in more than 70 countries and used in different verticals like pharma, food and beverage, luxury, and sport. Contrafitting creates losses in the range of hundreds of billions of dollars per year and impacts societies and individuals and companies in multiple ways, but most importantly, it endangers human life. And in the recent years, we have noticed a rapid increase in contrafitting, partially due to the pandemic and the increase in online trade, and also with the emergence of digital technologies, multiverse, and blockchain, we have the contrafitting appearing as well and growing in the digital world. My name is Dejan Milenovic, I'm CTO of Autena, and together with my colleagues in Autena, we are trying to solve this, and we are working hard to solve this problem of contrafitted products and traceability in the supply chain. With more than 11 international patents combining IoT technology and blockchain, we provide traceability and authenticity platform as a service, and this also infrastructure-free. So our technology provides a possibility to track products on the single product level, to collect interaction from end-users of the products, to make a bridge between physical and digital products, and also to provide the real-time monitoring of location and environmental conditions of monitored products. And I am very proud to say that we are the first Swiss company who, this year on the World Mobile Congress, won the Global Mobile Award for this technology that provides bridge between physical and digital products. Thank you. I am at the Tech Trust booth later, if somebody is interested to meet and talk, I will be there. Thanks a lot. So maybe one question concerning the, it seems quite a huge infrastructure you need for that, so any proof


chunk_text:
  as well and growing in the digital world. My name is Dejan Milenovic, I'm CTO of Autena, and together with my colleagues in Autena, we are trying to solve this, and we are working hard to solve this problem of contrafitted products and traceability in the supply chain. With more than 11 international patents combining IoT technology and blockchain, we provide traceability and authenticity platform as a service, and this also infrastructure-free. So our technology provides a possibility to track products on the single product level, to collect interaction from end-users of the products, to make a bridge between physical and digital products, and also to provide the real-time monitoring of location and environmental conditions of monitored products. And I am very proud to say that we are the first Swiss company who, this year on the World Mobile Congress, won the Global Mobile Award for this technology that provides bridge between physical and digital products. Thank you. I am at the Tech Trust booth later, if somebody is interested to meet and talk, I will be there. Thanks a lot. So maybe one question concerning the, it seems quite a huge infrastructure you need for that, so any proof of concept or already customers using the solution right now? Yes, we have multiple customers, as I mentioned, in several industries, in pharmaceuticals, in the luxury sector, perfumes, in food and beverage, wine production, and in sports as well. Okay, good. Okay. I have a question for you. What solution are you projecting to focus on? Like single-time usage? A solution also that could weigh the life cycle of the product, the product that could be stored for a very long time and then be sold to somebody else and not anyone? Well, that's a very good question. Thanks for that. We have actually multiple, let's say, parts or devices which can do both, can follow, let's say, the products with the fast life cycles, so to say, but also longer life cycle products and also reusable traceability solutions. When you talk about the life cycle management, this bridge between the physical and digital products becomes interesting because then you can have these smart contracts in the digital world which follow uniquely a physical product and can sort of facilitate management of its transformation through the life cycle. Okay, thank you. Thank you very much. Another question? No? It's okay?


chunk_text:
  of concept or already customers using the solution right now? Yes, we have multiple customers, as I mentioned, in several industries, in pharmaceuticals, in the luxury sector, perfumes, in food and beverage, wine production, and in sports as well. Okay, good. Okay. I have a question for you. What solution are you projecting to focus on? Like single-time usage? A solution also that could weigh the life cycle of the product, the product that could be stored for a very long time and then be sold to somebody else and not anyone? Well, that's a very good question. Thanks for that. We have actually multiple, let's say, parts or devices which can do both, can follow, let's say, the products with the fast life cycles, so to say, but also longer life cycle products and also reusable traceability solutions. When you talk about the life cycle management, this bridge between the physical and digital products becomes interesting because then you can have these smart contracts in the digital world which follow uniquely a physical product and can sort of facilitate management of its transformation through the life cycle. Okay, thank you. Thank you very much. Another question? No? It's okay? Okay, thank you very much, Athena. Okay, next one. Arnaud Gardin, Director, Client Solutions and Partnerships, to Another Way, so Arnaud. Let's imagine that you're a hacker. You are in the dark side of cyber. You do it for a living. So you need to be efficient. You need to be productive. What will you do first to attack a company or an organization? No idea? If I am a hacker, the first thing I will do is I will look at the statistics. 80% of attacks will leverage human vulnerabilities right from the start of an attack. These human vulnerabilities, what are they? They are all the private information of collaborators, of VIPs, of a company, of an organization. So you just have to have a look at the social networks, at the forum of hackers on the deep and dark net, and you will find, you will be able to find a lot of information to create social engineering, phishing attack, et cetera, et cetera. What we do at Another Way is we change the game. We want to prevent this initial step. So we have created a dashboard in order to assess the risk for everyone in


chunk_text:
  Okay, thank you very much, Athena. Okay, next one. Arnaud Gardin, Director, Client Solutions and Partnerships, to Another Way, so Arnaud. Let's imagine that you're a hacker. You are in the dark side of cyber. You do it for a living. So you need to be efficient. You need to be productive. What will you do first to attack a company or an organization? No idea? If I am a hacker, the first thing I will do is I will look at the statistics. 80% of attacks will leverage human vulnerabilities right from the start of an attack. These human vulnerabilities, what are they? They are all the private information of collaborators, of VIPs, of a company, of an organization. So you just have to have a look at the social networks, at the forum of hackers on the deep and dark net, and you will find, you will be able to find a lot of information to create social engineering, phishing attack, et cetera, et cetera. What we do at Another Way is we change the game. We want to prevent this initial step. So we have created a dashboard in order to assess the risk for everyone in a specific organization. So we have an entry point, the email address, for instance, and we will gather a lot of information about their risk so that we can have a scoring about their risk. In a second step, for the people at risk, we will provide an individual web app for anyone to have a look at his own exposure. So with this web app, you will know exactly your exposure, your level of risk. You will be able to add your personal data to know if you have a leak on your Gmail address or if your phone number is exposed, and then you will be able to remediate that. We will give you some advice. We will give you some correction in order for you to remediate these vulnerabilities. So basically, we change the way we approach cybersecurity prevention. We address the human factor in a different way. So we change this approach. Thank you. Thank you. I'm Arnaud Gardin, and I'm happy to receive your questions. You mentioned the market, or let's say the customer base. Is it more companies, or it could be directly individuals interested in knowing more about their attack surface? So today,


chunk_text:
  a specific organization. So we have an entry point, the email address, for instance, and we will gather a lot of information about their risk so that we can have a scoring about their risk. In a second step, for the people at risk, we will provide an individual web app for anyone to have a look at his own exposure. So with this web app, you will know exactly your exposure, your level of risk. You will be able to add your personal data to know if you have a leak on your Gmail address or if your phone number is exposed, and then you will be able to remediate that. We will give you some advice. We will give you some correction in order for you to remediate these vulnerabilities. So basically, we change the way we approach cybersecurity prevention. We address the human factor in a different way. So we change this approach. Thank you. Thank you. I'm Arnaud Gardin, and I'm happy to receive your questions. You mentioned the market, or let's say the customer base. Is it more companies, or it could be directly individuals interested in knowing more about their attack surface? So today, we work with enterprise, with companies, but we've seen that, for instance, in the US and Canada, we are starting expansion there. Whenever there is a leak in a company, the company, to avoid class actions, will propose various tools, so antivirus and so on and so forth, and potentially an R application for their employees. So at a certain step, we will go to the B2C market. Today, it's B2B, and we can work as well with B2Gov for certain specific environment and protection. We won the Forum Internationale de la Cybersecurité Prize this year, and we are starting to work for the Jeux Olympiques 2024 in Paris with the Ministry of Interior. Okay. Thank you. Thank you so much. Thank you. One question from Monaco. Yes. Jerome? Yes? Yes. I agree. I have a question about the situation of the factory environment, the internet. Do you get your own information, do you have to take it to a delivery company? So good question. So basically we supervise data leakage, data leaks, for instance, on the dark web. And whenever we have customers, we are GDPR compliant. So we do this when we have customers. We do look at


chunk_text:
  we work with enterprise, with companies, but we've seen that, for instance, in the US and Canada, we are starting expansion there. Whenever there is a leak in a company, the company, to avoid class actions, will propose various tools, so antivirus and so on and so forth, and potentially an R application for their employees. So at a certain step, we will go to the B2C market. Today, it's B2B, and we can work as well with B2Gov for certain specific environment and protection. We won the Forum Internationale de la Cybersecurité Prize this year, and we are starting to work for the Jeux Olympiques 2024 in Paris with the Ministry of Interior. Okay. Thank you. Thank you so much. Thank you. One question from Monaco. Yes. Jerome? Yes? Yes. I agree. I have a question about the situation of the factory environment, the internet. Do you get your own information, do you have to take it to a delivery company? So good question. So basically we supervise data leakage, data leaks, for instance, on the dark web. And whenever we have customers, we are GDPR compliant. So we do this when we have customers. We do look at their social networks on demand, based on their action, on their own action. So it's real time. We gather information from the various leaks, from the various social networks. Okay, second question from Monaco, I think. Is that right? Yes. Thierry? Yes, sorry. But in fact, I have my own solution. So if you take your own data driver on the dark web, I actually work for a company like that. Indeed, yes. Okay. Okay, so thank you so much. Thank you. Thank you, and as always. Thank you. Thank you. Thank you very much. Thank you. Thank you very much. Thank you. Okay. Okay, next startup, Philippe Huguet, CIO of Alchemia. Welcome on stage. Thank you. Thank you. Thank you. One billion of events per day. This is the average number of events we are collecting for a mid-sized company of, let's say, 1,000 workstations to get a unified vision of cybersecurity and observability. We speak about 12,000 events per second to collect in real time, to ingest, to store, and to transform into actionable insights. Real-time data is becoming the fuel of cybersecurity, but it's also becoming a main issue because it's growing exponentially. This is the main


chunk_text:
  their social networks on demand, based on their action, on their own action. So it's real time. We gather information from the various leaks, from the various social networks. Okay, second question from Monaco, I think. Is that right? Yes. Thierry? Yes, sorry. But in fact, I have my own solution. So if you take your own data driver on the dark web, I actually work for a company like that. Indeed, yes. Okay. Okay, so thank you so much. Thank you. Thank you, and as always. Thank you. Thank you. Thank you very much. Thank you. Thank you very much. Thank you. Okay. Okay, next startup, Philippe Huguet, CIO of Alchemia. Welcome on stage. Thank you. Thank you. Thank you. One billion of events per day. This is the average number of events we are collecting for a mid-sized company of, let's say, 1,000 workstations to get a unified vision of cybersecurity and observability. We speak about 12,000 events per second to collect in real time, to ingest, to store, and to transform into actionable insights. Real-time data is becoming the fuel of cybersecurity, but it's also becoming a main issue because it's growing exponentially. This is the main reason why so many historical SIEM solutions are no more able to do the job, and also why the most powerful solutions are becoming so crazy expensive. This is exactly the reason why a leader like CrowdStrike, two years ago, decided to get rid of very famous solutions to buy a company called Umeo, because Umeo was one of the very few companies that built its own data processing technology. The good news is that you don't need to buy a company anymore because we are coming with a disruptive solution. So Alchemia, we are a Swiss company, and we are very proud to develop the first AI-powered data factory that is breaking the complexity and the cost of real-time data analytics. To do this, our platform is able to be connected to any kind of data source, and at the same time, in real time, the data is prepared for an immediate usage. What was so complex and so expensive is done now, 10 times faster, and with 10 times less resources. I'm Philippe Huguet, CEO of Alchemia, and I'm very happy to be able to make your cyber data science dreams come true. Thank you, Philippe. So you


chunk_text:
  reason why so many historical SIEM solutions are no more able to do the job, and also why the most powerful solutions are becoming so crazy expensive. This is exactly the reason why a leader like CrowdStrike, two years ago, decided to get rid of very famous solutions to buy a company called Umeo, because Umeo was one of the very few companies that built its own data processing technology. The good news is that you don't need to buy a company anymore because we are coming with a disruptive solution. So Alchemia, we are a Swiss company, and we are very proud to develop the first AI-powered data factory that is breaking the complexity and the cost of real-time data analytics. To do this, our platform is able to be connected to any kind of data source, and at the same time, in real time, the data is prepared for an immediate usage. What was so complex and so expensive is done now, 10 times faster, and with 10 times less resources. I'm Philippe Huguet, CEO of Alchemia, and I'm very happy to be able to make your cyber data science dreams come true. Thank you, Philippe. So you talk about, let's say, data connectors. So you talk about, let's say, data connectors. So it's mainly for IoT or workstation, or what type of devices? When I said that we can be connected to absolutely any kind of data source, it's the case. Structured or unstructured data, IoT, sensors, everything you want. And you spoke about USP. We are very proud about our universal connector because it seems to be a first worldwide invention, and the efficiency of our universal connector is just amazing. I'm sure. Thank you. Okay, maybe some questions. Sorry. Come from Monaco? No question? Okay, so we will go to the next part of... Thank you very much. And thank you so much, Philippe. And just to let you know, you have seen some different state of maturity of startups. So some startup are at the very beginning part of their journey. So business concept, and some of them are more like a trainer at a Serie A, what we call Serie A. So they've proceeded, they have two or three round of seed to be in Serie A or Serie B. Now I will call on stage. It's my big pleasure to have on


chunk_text:
  talk about, let's say, data connectors. So you talk about, let's say, data connectors. So it's mainly for IoT or workstation, or what type of devices? When I said that we can be connected to absolutely any kind of data source, it's the case. Structured or unstructured data, IoT, sensors, everything you want. And you spoke about USP. We are very proud about our universal connector because it seems to be a first worldwide invention, and the efficiency of our universal connector is just amazing. I'm sure. Thank you. Okay, maybe some questions. Sorry. Come from Monaco? No question? Okay, so we will go to the next part of... Thank you very much. And thank you so much, Philippe. And just to let you know, you have seen some different state of maturity of startups. So some startup are at the very beginning part of their journey. So business concept, and some of them are more like a trainer at a Serie A, what we call Serie A. So they've proceeded, they have two or three round of seed to be in Serie A or Serie B. Now I will call on stage. It's my big pleasure to have on stage with us to speak about how to become a cyber entrepreneur. Three startup who come from our acceleration program. The Tech Fortress, they are now alumni. So they are the high brother of the startup that we have in our cohort. So I'm pleased to call Laurent Balmeli. Laurent Balmeli come from Strong Network, and I think we need to have some share. Yeah, please. We can help if it's needed. And Laurent, you won last year the FIC. The prize of the FIC, yes. And I call also the team of Sapporo. We have two founder of Sapporo with us today. So, and you're two Serie A entrepreneur, as you Laurent, we call that a Cyber, Serie A Cyber Entrepreneur, because it's not the first exit of this entrepreneur. And I call the last one, Aurelien come from Rumia. Thank you, thank you very much for being with us. So, Olivier, maybe we can begin with some question for our startupper, yes? So we have everybody on stage now? Yeah. Okay, perfect. Thank you. Yeah, we've heard about the, let's say the other startup, or they presented themselves just before. You've went through this stage. So you were


chunk_text:
  stage with us to speak about how to become a cyber entrepreneur. Three startup who come from our acceleration program. The Tech Fortress, they are now alumni. So they are the high brother of the startup that we have in our cohort. So I'm pleased to call Laurent Balmeli. Laurent Balmeli come from Strong Network, and I think we need to have some share. Yeah, please. We can help if it's needed. And Laurent, you won last year the FIC. The prize of the FIC, yes. And I call also the team of Sapporo. We have two founder of Sapporo with us today. So, and you're two Serie A entrepreneur, as you Laurent, we call that a Cyber, Serie A Cyber Entrepreneur, because it's not the first exit of this entrepreneur. And I call the last one, Aurelien come from Rumia. Thank you, thank you very much for being with us. So, Olivier, maybe we can begin with some question for our startupper, yes? So we have everybody on stage now? Yeah. Okay, perfect. Thank you. Yeah, we've heard about the, let's say the other startup, or they presented themselves just before. You've went through this stage. So you were a few, let's say, steps further. How does it feel? Oh, you mean like the, sorry again, the next stage? Yeah, the next stage. It was like more doing the, running through the accelerator program from Trust Valley, and now you were, that is done. Oh, okay, it's a follow up, yeah. Okay, first of all, I'm really amazed that there's so many people, because thanks a lot for coming first. I was not thinking that we were gonna have so many people. So thanks a lot. Don't go, because there are people actually leaving now. Come a little closer. Okay. Yeah, I think, you know, it's been like, I mean, like everybody who's doing a startup knows it's a wild ride, right? It's gonna be a lot of things. I think being part of a program is essential. For a startup, if you do a startup, I think it perhaps is the best way to start. You get yourself into a program, get some coaches, mentors, get into the, I mean, the network. That's gonna give you some boost. I mean, not all programs, obviously, are worth your time. This is a good one. But also, like, for instance,


chunk_text:
  a few, let's say, steps further. How does it feel? Oh, you mean like the, sorry again, the next stage? Yeah, the next stage. It was like more doing the, running through the accelerator program from Trust Valley, and now you were, that is done. Oh, okay, it's a follow up, yeah. Okay, first of all, I'm really amazed that there's so many people, because thanks a lot for coming first. I was not thinking that we were gonna have so many people. So thanks a lot. Don't go, because there are people actually leaving now. Come a little closer. Okay. Yeah, I think, you know, it's been like, I mean, like everybody who's doing a startup knows it's a wild ride, right? It's gonna be a lot of things. I think being part of a program is essential. For a startup, if you do a startup, I think it perhaps is the best way to start. You get yourself into a program, get some coaches, mentors, get into the, I mean, the network. That's gonna give you some boost. I mean, not all programs, obviously, are worth your time. This is a good one. But also, like, for instance, like we are like a part of a program like in New York, and after half the time, we decided, ah, this is really a waste of time. And also, it was something with NYU Sterns. We think, oh, that may be good. But then we're part of the one in the FinTech Lab in Accenture in London, which is unbelievable. So you have to pick your bottles, not bottles. And yeah, I think this is a good way to move forward, yeah. Maybe a question for you, Philippe. We are very pleased to have you on stage. You are a serial entrepreneur, but also a papa, because we don't have Olivier on stage, but this is a startup at the beginning of also Olivier Arias, your son. And your two sons are involved, I think, in the startup. Could you give you more information about that, or how to become a serial entrepreneur? Sure, sure. Yeah, for me, I have created a lot of companies so far. Nine, to be exact, in my life. It's 35 years, so no merit, okay? So, and the last one, because I'm here to speak on behalf of Sapporo, it's the most extraordinary


chunk_text:
  like we are like a part of a program like in New York, and after half the time, we decided, ah, this is really a waste of time. And also, it was something with NYU Sterns. We think, oh, that may be good. But then we're part of the one in the FinTech Lab in Accenture in London, which is unbelievable. So you have to pick your bottles, not bottles. And yeah, I think this is a good way to move forward, yeah. Maybe a question for you, Philippe. We are very pleased to have you on stage. You are a serial entrepreneur, but also a papa, because we don't have Olivier on stage, but this is a startup at the beginning of also Olivier Arias, your son. And your two sons are involved, I think, in the startup. Could you give you more information about that, or how to become a serial entrepreneur? Sure, sure. Yeah, for me, I have created a lot of companies so far. Nine, to be exact, in my life. It's 35 years, so no merit, okay? So, and the last one, because I'm here to speak on behalf of Sapporo, it's the most extraordinary for me, because I did it with my two sons. So you can imagine what that means. So I'm very proud of that, for sure. At the same time, I have educated my son to become an entrepreneur one day or another. And this is what was happening in reality, not just for Sapporo, because for the two sons, it's not their first one. It's for the older one, the third, and for the younger, the second. So yes, it's something which is very important. And how, because what we need to speak is how to become a cyber entrepreneur. So you can become a cyber entrepreneur by family usage, with my example. For example, I mean, and also by chance, by opportunity, but whatever. In order to succeed, you need to have step-by-step an environment that will make you successful. The first one is to have the good idea. I heard the question from the audience. What is your unique selling proposition? It's not easy to respond to that question, right? But it's based on an innovative idea first, for sure. You need to consider what exists already, what doesn't exist, why you can do better. You need to


chunk_text:
  for me, because I did it with my two sons. So you can imagine what that means. So I'm very proud of that, for sure. At the same time, I have educated my son to become an entrepreneur one day or another. And this is what was happening in reality, not just for Sapporo, because for the two sons, it's not their first one. It's for the older one, the third, and for the younger, the second. So yes, it's something which is very important. And how, because what we need to speak is how to become a cyber entrepreneur. So you can become a cyber entrepreneur by family usage, with my example. For example, I mean, and also by chance, by opportunity, but whatever. In order to succeed, you need to have step-by-step an environment that will make you successful. The first one is to have the good idea. I heard the question from the audience. What is your unique selling proposition? It's not easy to respond to that question, right? But it's based on an innovative idea first, for sure. You need to consider what exists already, what doesn't exist, why you can do better. You need to be confident in yourself, but it's not enough. After, you need to build the first prototype and then build a little team, a small team, at the early stage, with people you trust. And then you need people like them around, not just Tech Fortress, but also Innovo and many other things that DataDovo can bring on the table. Because this is where you can acquire the visibility. If you consider Sapporo, for example, we have been very proud to win the first prize last year. For sure, that increased the visibility of the company to be chosen as the best cybersecurity solution. But then, it's not just enough. And after, you need to have the funding to success. I know that not all the companies here need funds, but most of the time, you will need funding, so you need to use the visibility that brings Tech Fortress to get the right funding. This is exactly what Sapporo did. And after that, you need also to get customers, which is the last thing and not the easiest thing to get. So, that's just me. Maybe, I just want to add, you talked about customers, it's interesting, and also about


chunk_text:
  be confident in yourself, but it's not enough. After, you need to build the first prototype and then build a little team, a small team, at the early stage, with people you trust. And then you need people like them around, not just Tech Fortress, but also Innovo and many other things that DataDovo can bring on the table. Because this is where you can acquire the visibility. If you consider Sapporo, for example, we have been very proud to win the first prize last year. For sure, that increased the visibility of the company to be chosen as the best cybersecurity solution. But then, it's not just enough. And after, you need to have the funding to success. I know that not all the companies here need funds, but most of the time, you will need funding, so you need to use the visibility that brings Tech Fortress to get the right funding. This is exactly what Sapporo did. And after that, you need also to get customers, which is the last thing and not the easiest thing to get. So, that's just me. Maybe, I just want to add, you talked about customers, it's interesting, and also about the fact that you've had quite a lot of successful startups. So, what is the difference, maybe, I'm almost sure, over 35 years, that the previous ones were not cyber startups. So, do you see any difference between a traditional startup or a cyber one, or what needs to be done there? No, there is a big difference. There is a big difference. The cybersecurity segment is crowded. Hundreds or thousands, I've not counted, that exactly exist on the market. So, you can hear every day, including today, customers visiting you, they say, we have so many, so many solutions. So, the net is, because we don't have too much time, and I don't want to keep the speech too much, is, okay, if you want to acquire a new, innovative solution, you need to keep out a solution that you already bought in the past, because that's the rule today for all the customers. I don't buy if I don't stop the subscription of order, or other... Or it could be a new demon, no? Yeah, but... So, maybe, Aurelien, have you seen, also, that type of, like, overcrowded potential customers market, or with competition, or? Yeah, I mean,


chunk_text:
  the fact that you've had quite a lot of successful startups. So, what is the difference, maybe, I'm almost sure, over 35 years, that the previous ones were not cyber startups. So, do you see any difference between a traditional startup or a cyber one, or what needs to be done there? No, there is a big difference. There is a big difference. The cybersecurity segment is crowded. Hundreds or thousands, I've not counted, that exactly exist on the market. So, you can hear every day, including today, customers visiting you, they say, we have so many, so many solutions. So, the net is, because we don't have too much time, and I don't want to keep the speech too much, is, okay, if you want to acquire a new, innovative solution, you need to keep out a solution that you already bought in the past, because that's the rule today for all the customers. I don't buy if I don't stop the subscription of order, or other... Or it could be a new demon, no? Yeah, but... So, maybe, Aurelien, have you seen, also, that type of, like, overcrowded potential customers market, or with competition, or? Yeah, I mean, it depends. On your side, we are more on the data protection parts, especially about regulation. We work a lot with GDPR regulation with European companies, and in Switzerland, we work with the new LPD regulation, and in Switzerland, we don't have so much competitors on these specific regulations issues. So, for me, it's a little bit different, but in Europe, yeah, there are a lot of companies doing that. But, generally, in the tech and the cyber security, we can see a lot of companies working on different subjects, and, yeah, I mean, I can understand it's quite hard to be visible on the right way. You talk about your product around GDPR, or things like that, so why Switzerland, and not being based in Europe? So, what is more interesting? Why is it more interesting to be around here? Well, first of all, because I'm living here, and just to explain a little bit about myself and my background, I was working in a company here in Switzerland, near Geneva, in a startup, but inside a big IT company, and I left this company five years ago to build my own startup. Thanks to my clients, they pushed


chunk_text:
  it depends. On your side, we are more on the data protection parts, especially about regulation. We work a lot with GDPR regulation with European companies, and in Switzerland, we work with the new LPD regulation, and in Switzerland, we don't have so much competitors on these specific regulations issues. So, for me, it's a little bit different, but in Europe, yeah, there are a lot of companies doing that. But, generally, in the tech and the cyber security, we can see a lot of companies working on different subjects, and, yeah, I mean, I can understand it's quite hard to be visible on the right way. You talk about your product around GDPR, or things like that, so why Switzerland, and not being based in Europe? So, what is more interesting? Why is it more interesting to be around here? Well, first of all, because I'm living here, and just to explain a little bit about myself and my background, I was working in a company here in Switzerland, near Geneva, in a startup, but inside a big IT company, and I left this company five years ago to build my own startup. Thanks to my clients, they pushed me in this way, and when I found my company, I already have clients, so it was a big chance for us, and that's why, I mean, our market here is so important for us, because we are already a network, and the trust of our clients, I mean, it's the most valuable thing in our company. We can create tech, we can create program, but at the end of the day, what matters is the trust that your client gives to you. Okay. I know, Laurent, you don't like that I told about this story, but I will do, because we are in Antwerp-Nyack, so I hack your slot. And I just want to talk about how it's possible to find funds and to find a good investor, and could you tell more about your story with Wigman and what happened with them? Okay. Yeah, obviously, finding money is the first thing, right? And also, I think you need to take money when you create a company, because you're not, I mean, like startup, because you're not creating like an SME. You're creating a company that needs to be fast, so that's why you need to raise money, more


chunk_text:
  me in this way, and when I found my company, I already have clients, so it was a big chance for us, and that's why, I mean, our market here is so important for us, because we are already a network, and the trust of our clients, I mean, it's the most valuable thing in our company. We can create tech, we can create program, but at the end of the day, what matters is the trust that your client gives to you. Okay. I know, Laurent, you don't like that I told about this story, but I will do, because we are in Antwerp-Nyack, so I hack your slot. And I just want to talk about how it's possible to find funds and to find a good investor, and could you tell more about your story with Wigman and what happened with them? Okay. Yeah, obviously, finding money is the first thing, right? And also, I think you need to take money when you create a company, because you're not, I mean, like startup, because you're not creating like an SME. You're creating a company that needs to be fast, so that's why you need to raise money, more money that you can make with customers so you can grow faster. And the main point for that is because you're doing something innovative. So if you wait too long, and you're trying to grow like moms and pops, or like nothing against SMEs, but it's a different just business model. So I think it's very important that you keep in mind that the time to market is critical, especially when you want to raise money. So my experience is that I was fortunate enough that it was my second startup, and I sold my first startup to Snapchat in 2016. So then I have an earn-out period. And then- But in Switzerland, in Iberdon. Yeah, in Iberdon. All places. Well, actually, they asked us to, oh, I guess you moved to LA. I said, well, no way. I have two kids, a wife, a house. And I lived in the US for 10 years. I lived in New York, and then I did Japan. So I was like, okay, that's enough for me. I want to raise my kids in Switzerland. So I said like, okay. So I'm gonna, and eventually, so they bought us, and that was a


chunk_text:
  money that you can make with customers so you can grow faster. And the main point for that is because you're doing something innovative. So if you wait too long, and you're trying to grow like moms and pops, or like nothing against SMEs, but it's a different just business model. So I think it's very important that you keep in mind that the time to market is critical, especially when you want to raise money. So my experience is that I was fortunate enough that it was my second startup, and I sold my first startup to Snapchat in 2016. So then I have an earn-out period. And then- But in Switzerland, in Iberdon. Yeah, in Iberdon. All places. Well, actually, they asked us to, oh, I guess you moved to LA. I said, well, no way. I have two kids, a wife, a house. And I lived in the US for 10 years. I lived in New York, and then I did Japan. So I was like, okay, that's enough for me. I want to raise my kids in Switzerland. So I said like, okay. So I'm gonna, and eventually, so they bought us, and that was a good experience, obviously, for the, you know, when you look for funding. For the next time you go to CVCs, if you have an exit, wow, that's kind of a gold card entry. So obviously, it makes things way easier, right? I need to be recognized that if I didn't have an exit, I didn't have to go. Because I basically went to see only one investor. It was Ring of Adventure. And so we raised 600,000, no customer, just an MVP that I coded with my partner, and a guy who left a snapshot to come with me. And so we raised that money, and then we, this is something else. Don't expect yourself to pay much, to pay yourself much, right? Expect to live on a shoestring, for the next two years, right? We literally, I mean, I think if you do a startup, if you want to have more than 5,000 a month, it's not for you. So this is kind of a rule of thumb. Everybody's gonna be paid about 5,000 a month, which is, I think, okay in Switzerland to live, right? Obviously, you're not gonna go on vacation very often, right, especially if you


chunk_text:
  good experience, obviously, for the, you know, when you look for funding. For the next time you go to CVCs, if you have an exit, wow, that's kind of a gold card entry. So obviously, it makes things way easier, right? I need to be recognized that if I didn't have an exit, I didn't have to go. Because I basically went to see only one investor. It was Ring of Adventure. And so we raised 600,000, no customer, just an MVP that I coded with my partner, and a guy who left a snapshot to come with me. And so we raised that money, and then we, this is something else. Don't expect yourself to pay much, to pay yourself much, right? Expect to live on a shoestring, for the next two years, right? We literally, I mean, I think if you do a startup, if you want to have more than 5,000 a month, it's not for you. So this is kind of a rule of thumb. Everybody's gonna be paid about 5,000 a month, which is, I think, okay in Switzerland to live, right? Obviously, you're not gonna go on vacation very often, right, especially if you have two kids and a wife. But this is just life, right? But I think you're in for the adventure. So you have to find also people that are minded, that they agree on that. It could be perceived as a sacrifice, but to me, I just think it's a great experience, because building this team is one of the crux of creating a startup. And then, so we lived on that shoestring for about a year, and it's changed. And then I could sell the platform to Broadcom, which is a global customer in San Jose. And then we raised, then we seen this investor, and we raised 5.2 million last year. But one thing that I learned, because I didn't know this with my previous startup, is that getting the VC is like, every time you have a step, is the brand that you put on your startup. So it's really strategic. I was not ever aware of this. I say, well, money's money. So, but actually, there's money that is actually better than other money. And you need to put kind of the bright stamp of which VC, because if you want to go next with the


chunk_text:
  have two kids and a wife. But this is just life, right? But I think you're in for the adventure. So you have to find also people that are minded, that they agree on that. It could be perceived as a sacrifice, but to me, I just think it's a great experience, because building this team is one of the crux of creating a startup. And then, so we lived on that shoestring for about a year, and it's changed. And then I could sell the platform to Broadcom, which is a global customer in San Jose. And then we raised, then we seen this investor, and we raised 5.2 million last year. But one thing that I learned, because I didn't know this with my previous startup, is that getting the VC is like, every time you have a step, is the brand that you put on your startup. So it's really strategic. I was not ever aware of this. I say, well, money's money. So, but actually, there's money that is actually better than other money. And you need to put kind of the bright stamp of which VC, because if you want to go next with the benchmark of the world, or this kind of investors, they need to have good VC. So be very careful when you take money from people. You have to be very careful where it comes from, and also make sure that it's not something that's gonna impede your growth. It's really interesting, and just another question. We talked about cyber entrepreneur, and back also to the question. Have you seen any change in the market between your first startup that was also about security and now different? You've changed, in terms of money, right? Yeah, you've changed, absolutely. Like for instance, our pre-seed VCs, they have a fund that is basically just for EPFL student that have an idea, which is fantastic, right? They can get like 20K, and they can just realize that idea, and which didn't exist before, right? And also like Wingman Venture, the pre-seed, it's very new. Pre-seed funding in Switzerland, it's really something that for the last two, three years, when I did my first startup, there was no such thing. So if you need like half a million, which seems to be a lot, right? But when you put like a team, and you try


chunk_text:
  benchmark of the world, or this kind of investors, they need to have good VC. So be very careful when you take money from people. You have to be very careful where it comes from, and also make sure that it's not something that's gonna impede your growth. It's really interesting, and just another question. We talked about cyber entrepreneur, and back also to the question. Have you seen any change in the market between your first startup that was also about security and now different? You've changed, in terms of money, right? Yeah, you've changed, absolutely. Like for instance, our pre-seed VCs, they have a fund that is basically just for EPFL student that have an idea, which is fantastic, right? They can get like 20K, and they can just realize that idea, and which didn't exist before, right? And also like Wingman Venture, the pre-seed, it's very new. Pre-seed funding in Switzerland, it's really something that for the last two, three years, when I did my first startup, there was no such thing. So if you need like half a million, which seems to be a lot, right? But when you put like a team, and you try to, again, it's not gonna be a lot, right? To create a product, especially if you do something that is complex in infrastructure. But money's there, and if you have a good idea, if you're really motivated, I mean, it's really possible to do that. You ask 200K to Wingman, and they say to you, no. Yeah, we went with my partner, we said like, okay, well, let's ask 200K, because I think we have no customer, we have no, and we have no product, we just have the MVP. And literally, we went to see these guys, and they said like, well, actually, we wanted that money in October, it was July. And this guy said, well, no, you need the money now, you need 600K. And I said, oh, okay, for SIM dilution? Yes, okay, then let's go for it. So, but again, so I think what, but the message is that there's money to be allocated to good projects, so you have a good idea, I mean, it's definitely possible. And maybe about the Switzerland and the change in the market, Sappo, is it, are you, were you based already in Switzerland for the previous companies, or


chunk_text:
  to, again, it's not gonna be a lot, right? To create a product, especially if you do something that is complex in infrastructure. But money's there, and if you have a good idea, if you're really motivated, I mean, it's really possible to do that. You ask 200K to Wingman, and they say to you, no. Yeah, we went with my partner, we said like, okay, well, let's ask 200K, because I think we have no customer, we have no, and we have no product, we just have the MVP. And literally, we went to see these guys, and they said like, well, actually, we wanted that money in October, it was July. And this guy said, well, no, you need the money now, you need 600K. And I said, oh, okay, for SIM dilution? Yes, okay, then let's go for it. So, but again, so I think what, but the message is that there's money to be allocated to good projects, so you have a good idea, I mean, it's definitely possible. And maybe about the Switzerland and the change in the market, Sappo, is it, are you, were you based already in Switzerland for the previous companies, or are you based outside of Switzerland? The two last ones before Sappo was Swiss-based. Okay. So, NexSync was the first one. You said it changed a lot. I don't agree that much, on my experience, for example, for NexSync, I remember we had no product, a prototype, even if we can call that a prototype, but I'm kind, so you call that a prototype. And then we met Venture Incubator, at the time, which was based in the PFL, and then you go, that everybody knows, obviously, and we discussed, and I said, we have nothing, we have no people, we are just four people in the company, two developers and two in charge of the business development, and they say, yeah, I agree, but do you have a customer interested? I say, yes, we have one. And is it really to pay something, whatever it is, to work with you? You say, yes, but it's a little, a very few amount of money. Say, that's fine, it's a reference. So I say, yes, it's a reference, and they say, okay, you can have 1.6 million, which was for a pre-seed round, you see? So, yes, it changed, and at


chunk_text:
  are you based outside of Switzerland? The two last ones before Sappo was Swiss-based. Okay. So, NexSync was the first one. You said it changed a lot. I don't agree that much, on my experience, for example, for NexSync, I remember we had no product, a prototype, even if we can call that a prototype, but I'm kind, so you call that a prototype. And then we met Venture Incubator, at the time, which was based in the PFL, and then you go, that everybody knows, obviously, and we discussed, and I said, we have nothing, we have no people, we are just four people in the company, two developers and two in charge of the business development, and they say, yeah, I agree, but do you have a customer interested? I say, yes, we have one. And is it really to pay something, whatever it is, to work with you? You say, yes, but it's a little, a very few amount of money. Say, that's fine, it's a reference. So I say, yes, it's a reference, and they say, okay, you can have 1.6 million, which was for a pre-seed round, you see? So, yes, it changed, and at the same time, you have also opportunities, at the same time that today, there is big money on the market, but you can cry for 600, but between us, what you can do with 600? Not that much, as you said, right? So, it changed, and at the same time, it's always the same story. You say, you need to, you need to choose the right one, because a dollar is not a dollar. I disagree on that. I say, for me, a dollar is a dollar. I met hundreds of VC in my life, in my nine companies. Do I consider one better than another? No. What you can wait from VC, they say, they claim, we'll help you, we'll help you on the sales side, on the business development. No. So, there is some disagreement there. On the other hand, you talked about having a customer, or a potential customer helping. Have you seen that, Aurelien? You mentioned the fact that you were, let's say, pushed to entrepreneurship by your clients, or actual clients, so you had already the potential customer when you started there. Is it, does it make a difference? Did it make a difference for


chunk_text:
  the same time, you have also opportunities, at the same time that today, there is big money on the market, but you can cry for 600, but between us, what you can do with 600? Not that much, as you said, right? So, it changed, and at the same time, it's always the same story. You say, you need to, you need to choose the right one, because a dollar is not a dollar. I disagree on that. I say, for me, a dollar is a dollar. I met hundreds of VC in my life, in my nine companies. Do I consider one better than another? No. What you can wait from VC, they say, they claim, we'll help you, we'll help you on the sales side, on the business development. No. So, there is some disagreement there. On the other hand, you talked about having a customer, or a potential customer helping. Have you seen that, Aurelien? You mentioned the fact that you were, let's say, pushed to entrepreneurship by your clients, or actual clients, so you had already the potential customer when you started there. Is it, does it make a difference? Did it make a difference for you? Yes, our client was really important at the beginning of the company, because they trust us, they can make the fact that we can pay ourself, and because we also have family, so, yeah, we need to be paid for the work, and, I mean, money is a part, they pay for the service, but also the network opportunities they open to us was really important, so, on this point, it's very important for us to rely on the clients, and it's also really important to rely on specific organism, like Trust Valley, for example, or Innosuisse, et cetera. We are alumni for Tech Fortress season two, and we gain a lot to be part of it, to be honest. We learn a lot of things, we create a strong network. And we also gain a large amount of credibility on the market, and, yeah, I mean, all these points are really important. Alone, it's not sufficient, it's not enough, but when you put all this thing, yeah, you can take some value from that. Okay, one last question. Please. Oh, I don't know. Yes, it's such a big pleasure for me to have you all here. It's one


chunk_text:
  you? Yes, our client was really important at the beginning of the company, because they trust us, they can make the fact that we can pay ourself, and because we also have family, so, yeah, we need to be paid for the work, and, I mean, money is a part, they pay for the service, but also the network opportunities they open to us was really important, so, on this point, it's very important for us to rely on the clients, and it's also really important to rely on specific organism, like Trust Valley, for example, or Innosuisse, et cetera. We are alumni for Tech Fortress season two, and we gain a lot to be part of it, to be honest. We learn a lot of things, we create a strong network. And we also gain a large amount of credibility on the market, and, yeah, I mean, all these points are really important. Alone, it's not sufficient, it's not enough, but when you put all this thing, yeah, you can take some value from that. Okay, one last question. Please. Oh, I don't know. Yes, it's such a big pleasure for me to have you all here. It's one hour share with you on the other startupper. It's an extract of what we are doing in the Trust Valley. We created this ecosystem in the region, but we work also with other ecosystem at international level. We will go in RSA conference in San Francisco next month, and yes, we work also with the north of Europe. And maybe, do you have one advice, one thing to do to someone who want to become a cyber entrepreneur? First, maybe you have the mic, so let's go. Just go one step ahead, try it. I mean, it's worth it, and it's not so complicated, but don't be shy. Talk with other entrepreneur. Open doors, Trust Valley, Genium, Innovo, InnoSwiss. You have a lot of opportunities to create, but you have to create it by yourself. Yeah. Yeah, I think the only thing I can say is that you need to be, I mean, like a team builder. It's all about the team, right? It's not gonna be you. It's find the right people to work with. I mean, this is the thing. Also, when you go to VCs, they look at the team. That's the first thing they look at.


chunk_text:
  hour share with you on the other startupper. It's an extract of what we are doing in the Trust Valley. We created this ecosystem in the region, but we work also with other ecosystem at international level. We will go in RSA conference in San Francisco next month, and yes, we work also with the north of Europe. And maybe, do you have one advice, one thing to do to someone who want to become a cyber entrepreneur? First, maybe you have the mic, so let's go. Just go one step ahead, try it. I mean, it's worth it, and it's not so complicated, but don't be shy. Talk with other entrepreneur. Open doors, Trust Valley, Genium, Innovo, InnoSwiss. You have a lot of opportunities to create, but you have to create it by yourself. Yeah. Yeah, I think the only thing I can say is that you need to be, I mean, like a team builder. It's all about the team, right? It's not gonna be you. It's find the right people to work with. I mean, this is the thing. Also, when you go to VCs, they look at the team. That's the first thing they look at. They look at who's basically partnering, right? One-man show never works. I don't know any VC that invest in one-man shows. Three, four people, sometimes it'd be more difficult, because it's like, a couple is ideal. So find a good partner, find somebody who complements your skills. I think this is the first step, really, to create a company. Yeah. Thank you, Laurent. And Philippe? I will be very short, because I completely agree with Laurent. Most important thing are people. The people you are working with, which include your customers, that you need to build a trust. Take for trust, the name is not for nothing. A lot of trust. Trust is the key of the cyber security startup. The trust. The trust between people inside, and transmitting this trust outside. So that's the most important thing, people. Thank you very much. Thank you, thank you to you all, and see you for the next level of your startup, and continue the adventure, the journey I wish you. Thank you.


chunk_text:
  They look at who's basically partnering, right? One-man show never works. I don't know any VC that invest in one-man shows. Three, four people, sometimes it'd be more difficult, because it's like, a couple is ideal. So find a good partner, find somebody who complements your skills. I think this is the first step, really, to create a company. Yeah. Thank you, Laurent. And Philippe? I will be very short, because I completely agree with Laurent. Most important thing are people. The people you are working with, which include your customers, that you need to build a trust. Take for trust, the name is not for nothing. A lot of trust. Trust is the key of the cyber security startup. The trust. The trust between people inside, and transmitting this trust outside. So that's the most important thing, people. Thank you very much. Thank you, thank you to you all, and see you for the next level of your startup, and continue the adventure, the journey I wish you. Thank you.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=MsLwY9XbB4o", "title": "How To Have Visibility And Security OF CICD Ecosystem by Pramod Rana", "description": "", "channel_url": "https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA", "duration": 1901, "channel": "scrt.insomnihack", "uploader": "scrt.insomnihack", "upload_date": "20230411" } This text was transcribed using whisper model: large-v2 Hello everyone and welcome to the talk. Today I'm going to talk about how to have visibility and security of CI-CD ecosystem. From the agenda perspective, first I'm going to set the context that why I'm having this talk at the first place. I'm going to touch upon the attack surface around the technology part and what could be the possible methodology we can have to address the challenge. And then I'm going to introduce an open source project, CI-CD Guard, around the similar solution. And then we are going to deep dive into the architecture and the workflow, how the different components of that solution works. And we'll have a demo and then I'm going to close out with the future roadmap around the talk. A bit about myself, I'm Pramod Rana, working as an application security manager with the NetScope. For those who don't know us, please visit it. We are at Insomniac. And I'm primarily in two domains, security testing and DevSecOps. I'm author of three open source projects, Omniscient, ViewPrioritizer, and SecDependent Editor, which I have presented in different talks, BlackHat, DefCon, NullCon, last month OS Global AppSec. I'm also OSPune chapter lead and an OSCP. First about the context. So let me start with the oversimplified version of the CI-CD ecosystem. So for any software in the world, we have a certain code base, that code base is stored in a central location in terms of organization. And then we have a solution which converts that code base into deployable entity, which is again stored in a central location. And then we have a solution which deploys that deployable entity into the different infrastructure or the environment. And that environment could be anything. As a DevSecOps advocate, I highly recommend to have the security integration with each phases of the SDLC, which we call it security in CI-CD, as we all know it. It's a great topic, but this talk is not about that. This talk is about securing the building blocks of the CI-CD ecosystem, which is security of CI-CD. In any kind of ecosystem, I'm using the word ecosystem very precisely here simply because no component


chunk_text:
  and DevSecOps. I'm author of three open source projects, Omniscient, ViewPrioritizer, and SecDependent Editor, which I have presented in different talks, BlackHat, DefCon, NullCon, last month OS Global AppSec. I'm also OSPune chapter lead and an OSCP. First about the context. So let me start with the oversimplified version of the CI-CD ecosystem. So for any software in the world, we have a certain code base, that code base is stored in a central location in terms of organization. And then we have a solution which converts that code base into deployable entity, which is again stored in a central location. And then we have a solution which deploys that deployable entity into the different infrastructure or the environment. And that environment could be anything. As a DevSecOps advocate, I highly recommend to have the security integration with each phases of the SDLC, which we call it security in CI-CD, as we all know it. It's a great topic, but this talk is not about that. This talk is about securing the building blocks of the CI-CD ecosystem, which is security of CI-CD. In any kind of ecosystem, I'm using the word ecosystem very precisely here simply because no component or no technology in the overall CI-CD platform is independent. All of the things are related to each other. Because end of the day, as a software provider, we are delivering a software to our customer. And in any ecosystem, in nature as well, if we have a compromise of one component, it eventually impacts the entire ecosystem. And that is the need where we need to look at each component separately, but at the same time building the overall relationship between them. That is the part of problem. The first is the visibility part. And when I say visibility, what I mean by that is in a medium to large size of organization, as a security professional, I might be aware I have, let's say, thousand repositories. But do we have the visibility that how many third party GitHub actions we are using across those thousand repositories? And even in best case scenario, let's say we have that visibility, but are we aware that which version of the third party GitHub actions we are using across the entire organization? And that just one example of that. Another example could be, I might be aware that I have, let's say,


chunk_text:
  or no technology in the overall CI-CD platform is independent. All of the things are related to each other. Because end of the day, as a software provider, we are delivering a software to our customer. And in any ecosystem, in nature as well, if we have a compromise of one component, it eventually impacts the entire ecosystem. And that is the need where we need to look at each component separately, but at the same time building the overall relationship between them. That is the part of problem. The first is the visibility part. And when I say visibility, what I mean by that is in a medium to large size of organization, as a security professional, I might be aware I have, let's say, thousand repositories. But do we have the visibility that how many third party GitHub actions we are using across those thousand repositories? And even in best case scenario, let's say we have that visibility, but are we aware that which version of the third party GitHub actions we are using across the entire organization? And that just one example of that. Another example could be, I might be aware that I have, let's say, 50 Jenkins server in my environment. But do I know that how many jobs are running on those hundred Jenkins servers? And if yes, that how many nodes I have across those are different Jenkins infrastructure. So that comes the visibility part of the entire ecosystem. The other part is the relationship. Like I said, there is no independent entity when it comes to the CI-CD pipeline. All of those things are related. But how do we know the relationship between the different components which is flowing from A to B at any given point of time? And that we will touch upon the attack surface part as well. So let's say we have a Jenkins server which is running a job, you know, building the binary solution which we are deploying at our customer site. And in that Jenkins server, let's say we have a very trivial vulnerability, default or weak credentials. So at first point, it might look like a very trivial vulnerability. But if you look at the overall picture, and that's where the relationship part comes into the overall system. From a very trivial vulnerability, which is a default and weak credentials, we will be impacting


chunk_text:
  50 Jenkins server in my environment. But do I know that how many jobs are running on those hundred Jenkins servers? And if yes, that how many nodes I have across those are different Jenkins infrastructure. So that comes the visibility part of the entire ecosystem. The other part is the relationship. Like I said, there is no independent entity when it comes to the CI-CD pipeline. All of those things are related. But how do we know the relationship between the different components which is flowing from A to B at any given point of time? And that we will touch upon the attack surface part as well. So let's say we have a Jenkins server which is running a job, you know, building the binary solution which we are deploying at our customer site. And in that Jenkins server, let's say we have a very trivial vulnerability, default or weak credentials. So at first point, it might look like a very trivial vulnerability. But if you look at the overall picture, and that's where the relationship part comes into the overall system. From a very trivial vulnerability, which is a default and weak credentials, we will be impacting our binary, which we again is deploying into all of our customer infrastructure. And if you look at it from the business perspective, that's a, I'll say one of the worst areas we could be in, in terms of security. Another area could be, let's say, in a GitHub action, we are running self-hosted runners. And that self-hosted runners is running a vulnerable or malicious third-party action. So what's going to happen is, I was looking at one of the talks where the presenter explained that how the mining or the cryptocurrency solution runs from these kinds of scenarios where they will be using the organizational self-hosted runner in order to run the malicious third-party into the environment. And I think that connects to the overall software supply chain security part. Another example of could be, as we all know that in the organizational level, we run on the SSO mode where the one user is presented across the different technology. And if by any means the user is compromised in one of the technology, it's eventually going to impact the other technologies as well. And let's say our GitHub as an enterprise doesn't support, it doesn't impose the MFA


chunk_text:
  our binary, which we again is deploying into all of our customer infrastructure. And if you look at it from the business perspective, that's a, I'll say one of the worst areas we could be in, in terms of security. Another area could be, let's say, in a GitHub action, we are running self-hosted runners. And that self-hosted runners is running a vulnerable or malicious third-party action. So what's going to happen is, I was looking at one of the talks where the presenter explained that how the mining or the cryptocurrency solution runs from these kinds of scenarios where they will be using the organizational self-hosted runner in order to run the malicious third-party into the environment. And I think that connects to the overall software supply chain security part. Another example of could be, as we all know that in the organizational level, we run on the SSO mode where the one user is presented across the different technology. And if by any means the user is compromised in one of the technology, it's eventually going to impact the other technologies as well. And let's say our GitHub as an enterprise doesn't support, it doesn't impose the MFA challenge. And then another scenario could be that we were able, the attacker were able to compromise the GitHub accounts with the social engineering. And if the GitHub account is compromised of the developer, it can further propagate to other scenarios as well. So this is the attack surface when it comes to the overall CI-CD ecosystem of the solution. And if we look at the methodology part, I think there are three parts to it when we are building a methodology. First is focusing on making the software secure and robust by default. And what I mean by that is in any software, there are two phases. The one is of the software provider, and the other one is the software consumer. As a software provider, I think industry is doing a reasonably good job because of security in CI-CD, again, looping back. But I think everyone has a responsibility as a software consumer as well. Whenever we are consuming a software, it's our kind of obligation to make sure that we are doing a basic security checks on that software. It could be open source software, let's say a very simple library you are using for a very


chunk_text:
  challenge. And then another scenario could be that we were able, the attacker were able to compromise the GitHub accounts with the social engineering. And if the GitHub account is compromised of the developer, it can further propagate to other scenarios as well. So this is the attack surface when it comes to the overall CI-CD ecosystem of the solution. And if we look at the methodology part, I think there are three parts to it when we are building a methodology. First is focusing on making the software secure and robust by default. And what I mean by that is in any software, there are two phases. The one is of the software provider, and the other one is the software consumer. As a software provider, I think industry is doing a reasonably good job because of security in CI-CD, again, looping back. But I think everyone has a responsibility as a software consumer as well. Whenever we are consuming a software, it's our kind of obligation to make sure that we are doing a basic security checks on that software. It could be open source software, let's say a very simple library you are using for a very specific job in your software, or it could be an enterprise product, which is getting used by all the employees in your organization. And for that, what could be done is that having a vetting process, as simple as that, having a vetting process on an organizational level that whenever you are using a certain software component, which is not developed by you, are you making sure that you're looking at from the security perspective? At the same time, when we find something in someone else's software, are we making sure that we are considering it on a whole community level, working proactively with the provider to fix that part? If we combine these two steps where we are working to making sure that we as a software provider, we are doing our best job to provide the software. But at the same time, as a consumer, we are sharing the responsibility of making that software secure. The second aspect or the second part of the methodology is how well we are implementing it into our environment. And that will vary as per the organization because no software is secure with misconfiguration. Any software which is secure by default, if


chunk_text:
  specific job in your software, or it could be an enterprise product, which is getting used by all the employees in your organization. And for that, what could be done is that having a vetting process, as simple as that, having a vetting process on an organizational level that whenever you are using a certain software component, which is not developed by you, are you making sure that you're looking at from the security perspective? At the same time, when we find something in someone else's software, are we making sure that we are considering it on a whole community level, working proactively with the provider to fix that part? If we combine these two steps where we are working to making sure that we as a software provider, we are doing our best job to provide the software. But at the same time, as a consumer, we are sharing the responsibility of making that software secure. The second aspect or the second part of the methodology is how well we are implementing it into our environment. And that will vary as per the organization because no software is secure with misconfiguration. Any software which is secure by default, if you implement it in a insecure way, it's eventually going to be insecure software. It could be as small as default settings disabled, MFA enabled, up-to-date plugins, apps, actions. Any enterprise level software as of today supports customization one way or another. For example, for Jenkins, it is plugins, for GitHub, it is actions. If you are using those third party components within your organization, then you have to make sure that the security of those components, those custom components is also considered. Third part of it is the monitoring or the continuous monitoring part where first we are monitoring whether anything bad happened, are we able to detect it, second, can we respond effectively if something bad happens? So these are the three aspects when we need to look at when we are building a methodology for the CICD, securing of the CICD ecosystem in the organization. First, making sure we are taking a share responsibility to make the software secure. Second, when we are using it, we are using it with the, I'll say, adequate security controls. Third is, we are monitoring continuously and have the ability to respond to anything bad happens. Now, this is where the


chunk_text:
  you implement it in a insecure way, it's eventually going to be insecure software. It could be as small as default settings disabled, MFA enabled, up-to-date plugins, apps, actions. Any enterprise level software as of today supports customization one way or another. For example, for Jenkins, it is plugins, for GitHub, it is actions. If you are using those third party components within your organization, then you have to make sure that the security of those components, those custom components is also considered. Third part of it is the monitoring or the continuous monitoring part where first we are monitoring whether anything bad happened, are we able to detect it, second, can we respond effectively if something bad happens? So these are the three aspects when we need to look at when we are building a methodology for the CICD, securing of the CICD ecosystem in the organization. First, making sure we are taking a share responsibility to make the software secure. Second, when we are using it, we are using it with the, I'll say, adequate security controls. Third is, we are monitoring continuously and have the ability to respond to anything bad happens. Now, this is where the open source software, the open source project comes to the picture CICDguard. It does, first, it represents all the components into the graph forms. And what I mean by that is that all the different components of the technology will be breakdown into the node level and the relationship, the edges between the nodes will show the relationship how the different component is connected. What it helps is, it helps to get the visibility part correct. For example, it will just not show that you have 10 Jenkins server, it will even break down to the level of the jobs, it will say you have five jobs, so basically you will have five nodes and then in which node those jobs are running. So you will have a relationship between the node of type job to the node of the type node. So that's how the overall graph picture is built. Why I used graph? Because personally, I think it's more intuitive when building the relationship database, relationship schema for the different technologies. And second thing is, it goes to the granular level of breaking down the technology. Second thing it does, the security aspect, obviously, it tries to identify


chunk_text:
  open source software, the open source project comes to the picture CICDguard. It does, first, it represents all the components into the graph forms. And what I mean by that is that all the different components of the technology will be breakdown into the node level and the relationship, the edges between the nodes will show the relationship how the different component is connected. What it helps is, it helps to get the visibility part correct. For example, it will just not show that you have 10 Jenkins server, it will even break down to the level of the jobs, it will say you have five jobs, so basically you will have five nodes and then in which node those jobs are running. So you will have a relationship between the node of type job to the node of the type node. So that's how the overall graph picture is built. Why I used graph? Because personally, I think it's more intuitive when building the relationship database, relationship schema for the different technologies. And second thing is, it goes to the granular level of breaking down the technology. Second thing it does, the security aspect, obviously, it tries to identify the misconfiguration into the different technologies, whatever it is finding at that moment, and provides the possible recommendation for that. Third thing, which is most important in my opinion, it tries to identify the relationship between the different components. Like I said, one of the challenges is finding the visibility and the relationship. So it handles that part by building the relationship and that is the primary reason of using the graph theory because graph theory is more intuitive for the relationship part. For example, if there is a certain change in a certain repository, how eventually it is going to trigger the certain build process in a different technology. So from the visualization perspective, how it's going to work out is that you have a node of type repository and there is a change, certain commit, it eventually will go to the ascertain Jenkins job and that job will eventually create a certain binary in a different artifactory. So all of that relationship is going to flow through the graph in the solution. And another aspect could be like I touched upon for the GitHub action part, for example, in the organization as per the process, we might say


chunk_text:
  the misconfiguration into the different technologies, whatever it is finding at that moment, and provides the possible recommendation for that. Third thing, which is most important in my opinion, it tries to identify the relationship between the different components. Like I said, one of the challenges is finding the visibility and the relationship. So it handles that part by building the relationship and that is the primary reason of using the graph theory because graph theory is more intuitive for the relationship part. For example, if there is a certain change in a certain repository, how eventually it is going to trigger the certain build process in a different technology. So from the visualization perspective, how it's going to work out is that you have a node of type repository and there is a change, certain commit, it eventually will go to the ascertain Jenkins job and that job will eventually create a certain binary in a different artifactory. So all of that relationship is going to flow through the graph in the solution. And another aspect could be like I touched upon for the GitHub action part, for example, in the organization as per the process, we might say that whenever we are using a third party GitHub action, we are going to have a security review of that. And depending on the security review, we are going to, you know, approve a certain version of the third party library, which we will say at that point of time that it is the most secure to be used in a security professional opinion. What it will help to identify is that in the organization, in the overall organization, what are the different version of any particular third party GitHub actions you are using? And then we can map it to the back to the approved version and we can identify any deviation we might have. So, for example, at any given point of time for the GitHub action A, we are saying use the version one, but in the organization, we are identifying the deviation of version one, two, three, then from these project, from the solution, we can identify, OK, these are the deviations, let's action on them. And do we have common users between the different technologies, so on and so forth. So first, the visibility part converts everything into the graph with the node and the


chunk_text:
  that whenever we are using a third party GitHub action, we are going to have a security review of that. And depending on the security review, we are going to, you know, approve a certain version of the third party library, which we will say at that point of time that it is the most secure to be used in a security professional opinion. What it will help to identify is that in the organization, in the overall organization, what are the different version of any particular third party GitHub actions you are using? And then we can map it to the back to the approved version and we can identify any deviation we might have. So, for example, at any given point of time for the GitHub action A, we are saying use the version one, but in the organization, we are identifying the deviation of version one, two, three, then from these project, from the solution, we can identify, OK, these are the deviations, let's action on them. And do we have common users between the different technologies, so on and so forth. So first, the visibility part converts everything into the graph with the node and the edge will represent the relationship, then identifies the industry security misconfiguration in the technologies. And on top of that, it identifies the relationship between the different components. This is the node database schema. As you can see, I have break it down into the granular level possible, for example, for the GitHub action, it would be workflow, job, step, command, runner, action, so on and so forth. And interesting part, this I identified after building the solution is that once you have a node of if you have a node with a similar schema already, then rather than creating a separate node, it eventually will make back a circular relationship to the node. So what happens with that is that, for example, if you have five runners in your organization, you can find the reverse relationship as well that how many jobs are running in my each of the runners. So for example, if at any point of time you feel that this particular runner is having too much load, then this tool can help you to identify that thing as well. So this is what the overall architecture looks like. It has, I'll say four parts. First is the


chunk_text:
  edge will represent the relationship, then identifies the industry security misconfiguration in the technologies. And on top of that, it identifies the relationship between the different components. This is the node database schema. As you can see, I have break it down into the granular level possible, for example, for the GitHub action, it would be workflow, job, step, command, runner, action, so on and so forth. And interesting part, this I identified after building the solution is that once you have a node of if you have a node with a similar schema already, then rather than creating a separate node, it eventually will make back a circular relationship to the node. So what happens with that is that, for example, if you have five runners in your organization, you can find the reverse relationship as well that how many jobs are running in my each of the runners. So for example, if at any point of time you feel that this particular runner is having too much load, then this tool can help you to identify that thing as well. So this is what the overall architecture looks like. It has, I'll say four parts. First is the scan engine part, which runs independently. What this scan engine is, it's a collection of independent scripts in Python and each script is designed to perform the security scan on a particular technology. At this point of time, it supports four technology and you can use it independently. But at the same time, you can use it in a collaboration with the relationship as well. That is the scan engine part. The next part is the analysis engine, in which it tries to identify the relationship between the scanned technology. How it's going to work is, for example, you might run the script of Jenkins and then you might run the script for GitHub. If you run the analysis engine on top of that, it's going to scan all the nodes for those two technology and try to identify the relationship. The more technology you are going to scan, the more comprehensive relationship analysis is going to be. And you can just keep going on that process again and again. From the output perspective, to build the analysis, all the database, all the information gets feeded back to the Neo4j, Neo4j is the database. And you also have a JSON


chunk_text:
  scan engine part, which runs independently. What this scan engine is, it's a collection of independent scripts in Python and each script is designed to perform the security scan on a particular technology. At this point of time, it supports four technology and you can use it independently. But at the same time, you can use it in a collaboration with the relationship as well. That is the scan engine part. The next part is the analysis engine, in which it tries to identify the relationship between the scanned technology. How it's going to work is, for example, you might run the script of Jenkins and then you might run the script for GitHub. If you run the analysis engine on top of that, it's going to scan all the nodes for those two technology and try to identify the relationship. The more technology you are going to scan, the more comprehensive relationship analysis is going to be. And you can just keep going on that process again and again. From the output perspective, to build the analysis, all the database, all the information gets feeded back to the Neo4j, Neo4j is the database. And you also have a JSON format, in which case you want to, let's say, feed it back to the other technology, for example, Elasticsearch and all. In that case, what you can do is you can simply run the script, feed it back the JSON output into your choice of analysis engine you want. It also has a very basic web UI in order to visualize all the data and put some custom filtering on that. And all of this can be accessed by the user at any different point of time. In order to run the scan engine, there are two ways you can provide the inputs. The one is the environmental variables. You just set it there if you don't want to pass it into the command line, because all of this information will be secrets. And then other option is obviously the command line. And from the, what kind of input it needs is the authentication detail to the respective technology you want to target. And obviously it will vary technology to technology, which kind of authentication information you will be providing. For example, in case of GitHub, you need the personal access token and all that. Depending on the privileges you


chunk_text:
  format, in which case you want to, let's say, feed it back to the other technology, for example, Elasticsearch and all. In that case, what you can do is you can simply run the script, feed it back the JSON output into your choice of analysis engine you want. It also has a very basic web UI in order to visualize all the data and put some custom filtering on that. And all of this can be accessed by the user at any different point of time. In order to run the scan engine, there are two ways you can provide the inputs. The one is the environmental variables. You just set it there if you don't want to pass it into the command line, because all of this information will be secrets. And then other option is obviously the command line. And from the, what kind of input it needs is the authentication detail to the respective technology you want to target. And obviously it will vary technology to technology, which kind of authentication information you will be providing. For example, in case of GitHub, you need the personal access token and all that. Depending on the privileges you are providing, it will be able to read more and more information. In generally, since we will be accessing every, the script will be accessing everything, you will need to provide the admin access personal token in that. Any question before we go to the demo? I recorded demo for two, for one very specific purposes, because in this demo, we have some information which I simply cannot show. So I have redacted it. That's why I have recorded this demo, but our tool is, so as you can see, there are four technologies in a certain directory and you can run it independently. For the demo purposes, I'm using the environmental variable in order to provide the authentication detail and no further information, no further input is required for in case of action. You can simply run it. Once it starts running, it provides the basic information in the command line about the running and all. So this you can run independent of the tool. You can simply go to the GitHub, do the clone and start running. It's as simple as that and every vulnerability, every security misconfiguration identified by the tool will have a certain identifier and


chunk_text:
  are providing, it will be able to read more and more information. In generally, since we will be accessing every, the script will be accessing everything, you will need to provide the admin access personal token in that. Any question before we go to the demo? I recorded demo for two, for one very specific purposes, because in this demo, we have some information which I simply cannot show. So I have redacted it. That's why I have recorded this demo, but our tool is, so as you can see, there are four technologies in a certain directory and you can run it independently. For the demo purposes, I'm using the environmental variable in order to provide the authentication detail and no further information, no further input is required for in case of action. You can simply run it. Once it starts running, it provides the basic information in the command line about the running and all. So this you can run independent of the tool. You can simply go to the GitHub, do the clone and start running. It's as simple as that and every vulnerability, every security misconfiguration identified by the tool will have a certain identifier and depending on the technology, as you can see, all of the output is in the JSON so that it is readable by other analysis tools as well. This I ran for the GitHub action. So this is what the feeding part of the solution is, where you are running independent scripts again. Now we are going to run the Jenkins, same process, you need to provide the authentication detail. It will build the connection. We'll try to fetch the information. It takes time, sometime depending on the network access and all. So as you can see, for example, JNK 003, it's a identifier for the vulnerability, it identified at that point of time for that. So all the information displayed in a square bracket is the rejected one, when you will be providing this information in the actual life, it will be displayed in that way. So as I told, it goes to the level of job and then in the job, it identifies the node. It also identifies the plugins, what is the version of the plugins you are using, how those plugins are connected to the other Jenkins, other technology, it identifies the users, it identifies the groups,


chunk_text:
  depending on the technology, as you can see, all of the output is in the JSON so that it is readable by other analysis tools as well. This I ran for the GitHub action. So this is what the feeding part of the solution is, where you are running independent scripts again. Now we are going to run the Jenkins, same process, you need to provide the authentication detail. It will build the connection. We'll try to fetch the information. It takes time, sometime depending on the network access and all. So as you can see, for example, JNK 003, it's a identifier for the vulnerability, it identified at that point of time for that. So all the information displayed in a square bracket is the rejected one, when you will be providing this information in the actual life, it will be displayed in that way. So as I told, it goes to the level of job and then in the job, it identifies the node. It also identifies the plugins, what is the version of the plugins you are using, how those plugins are connected to the other Jenkins, other technology, it identifies the users, it identifies the groups, so on and so forth. I did not want to fast forward it intentionally because I wanted to give the actual feel of how the script is going to run out when in the actual life, again, all the output is in JSON format in the command line and then you can change it as per your need. So this is what the UI part looks like. You know, like I said, it's a very lightweight web UI at this point of time, we have different node colors in order to identify for the different technology. And as you can see, there are relationship, there are there are edges between the different technologies as well if you so because I have in my demo, I have scanned almost four, all four are technology supported by the scripts. And because of that, there are a lot of data processed by that, that's the reason I have a filter where you can simply select the plugins part and in the in the UI, it will display the details about the UI, the red represents that the security vulnerabilities has been identified for that particular node, the relationship of the filter is OR,


chunk_text:
  so on and so forth. I did not want to fast forward it intentionally because I wanted to give the actual feel of how the script is going to run out when in the actual life, again, all the output is in JSON format in the command line and then you can change it as per your need. So this is what the UI part looks like. You know, like I said, it's a very lightweight web UI at this point of time, we have different node colors in order to identify for the different technology. And as you can see, there are relationship, there are there are edges between the different technologies as well if you so because I have in my demo, I have scanned almost four, all four are technology supported by the scripts. And because of that, there are a lot of data processed by that, that's the reason I have a filter where you can simply select the plugins part and in the in the UI, it will display the details about the UI, the red represents that the security vulnerabilities has been identified for that particular node, the relationship of the filter is OR, so basically it will says that select the node with the type plugin or type build, you can add and remove. One important part I wanted to make a visibility point here is that so this this light bluish color is the Jenkins build node, and it is getting connected to the repository within the GitHub environment. As you can see, this node is the type repository, and this node is of type build, what it implies that is this particular build is getting triggered by this particular repository. And if there is any change in the repository, it eventually is going to impact that build. So this is what I meant when I said the relationship between the different technologies, and it identified two different variations of that when I ran the scan in the in the demo environment. So this is the GitHub repositories, and this is what the Jenkins build is built. So if we are able to work on the so as as part of the next step, I am working on building a overall path at this point of time, it's a one-to-one relationship between the repositories and the build, for example, but from a


chunk_text:
  so basically it will says that select the node with the type plugin or type build, you can add and remove. One important part I wanted to make a visibility point here is that so this this light bluish color is the Jenkins build node, and it is getting connected to the repository within the GitHub environment. As you can see, this node is the type repository, and this node is of type build, what it implies that is this particular build is getting triggered by this particular repository. And if there is any change in the repository, it eventually is going to impact that build. So this is what I meant when I said the relationship between the different technologies, and it identified two different variations of that when I ran the scan in the in the demo environment. So this is the GitHub repositories, and this is what the Jenkins build is built. So if we are able to work on the so as as part of the next step, I am working on building a overall path at this point of time, it's a one-to-one relationship between the repositories and the build, for example, but from a visualization perspective, if we make the filter correctly, what we can do is we can make a connection back to the let's say user A made this commit on repository B and repository B eventually triggered the build C and that build C like I said goes back to the artifactory artifact A. So that's how we can build the relationship at this point of time from a filtering perspective, it just displays the one particular path. So going forward, obviously, the first part is the expansion on the technologies more. Like I said, the more technology solution will cover the better relationship it will be able to build. These are the few I have in pipeline. If you have any feedback, feel free to open up an issue or the pull request into the into the repository and then we can take it from there. I think but my personal focus is on the analysis part. The more technology we build, the more type of nodes we will have. And what I mean by that is that more analysis we have to build. The primary reason of making this project was to build on the analysis engine more, which


