# MediaChunks

chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=hJD18w7UFoQ", "title": "How to Play Offlane like an IMMORTAL - Advanced Offlane Guide Dota 2", "description": "Immortal Dota 2 coach teaching you how to master the Offlane role and climb in your brackets easily using a student's progress that climbed from 2k to 3k MMR quickly by understanding fundamental concepts taught by the coach to him to perform like a 6k MMR Offlaner consistently as an example.\n\nEnjoy learning about Offlane from this video, thank you!\n\n-------------------------------------------------------------------------------\nBALLOONDOTA COACHING RATES \n-------------------------------------------------------------------------------\n(Short term coaching)\n50$ for 1 hour\n120$ for 3 hours (25% discount, 40$/hr)\n\n(Long term coaching) \n(recommended for cheaper rates)\n350$ for 10 hours (30% discount, 35$/hr)\n650$ for 20 hours (35% discount, 32.5$/hr)\n850$ for 30 hours (45% discount, 28$/hr)\n\n-------------------------------------------------------------------------------\nDOTA COACHING BY BALLOONDOTA\n-------------------------------------------------------------------------------\nFiverr coaching link: https://www.fiverr.com/yongy146/help-you-improve-in-dota-2-with-7400-mmr-coaching\nDiscord: BaLLooN#5243 \nDiscord Server: https://discord.com/invite/w4PWyXDV4n\nPaypal: siahcheonyisiahcheonyi@gmail.com\nPatreon: patreon.com/BalloonDota\n-------------------------------------------------------------------------------\n\n00:00 - Introduction\n00:42 - Starting Items\n1:01 - Bounty Rune Contest\n1:20 - Laning Phase \n2:34 - Laning Phase Power Spike\n3:29 - Lost Lane (Recover)\n3:57 - Cleanup Kills\n4:25 - Early Game Phase\n5:05 - Principles of DOTA\n6:19 - Early Game Phase Power Spike\n7:08 - Mid Game Phase\n7:35 - Closure of Games\n\n-------------------------------------------------------------------------------\n\nCinematic Rock Hip-Hop by Infraction - No Copyright Music\nMusic Link: https://www.youtube.com/watch?v=iuJKYervYPs\n\nAdventures by A Himitsu https://soundcloud.com/a-himitsu\nCreative Commons \u2014 Attribution 3.0 Unported\u2014 CC BY 3.0 \nFree Download / Stream: http://bit.ly/2Pj0MtT\nMusic released by Argofox https://www.youtube.com/watch?v=8BXNwnxaVQE&t=0s\nMusic promoted by Audio Library https://www.youtube.com/watch?v=MkNeIUgNPQ8\n\nArtist: tubebackr & MusicbyAden\nTrack: LOGISTICS\n@tubebackr music \n@MusicbyAden\nCreative Commons License. Attribution-NoDerivs 3.0 Unported (CC BY-ND 3.0)\nMusic Link: https://www.youtube.com/watch?v=SJVh_7lDf6w\n\nMusic from #Uppbeat (free for Creators!):\nhttps://uppbeat.io/t/fass/furious\nLicense code: JNBUADJFRTJIFFRA", "channel_url": "https://www.youtube.com/channel/UCYldE7tGQHjNwIVHQ7bDNoA", "duration": 526, "channel": "BalloonDota", "uploader": "BalloonDota", "upload_date": "20240503" } This text was transcribed using whisper model: large-v2 If you struggle to carry games from the offlane position, then this video is for you. In this video, I'll be teaching you to go from scores like this, to consistently hitting scores like this. Note that this progress is from my 2k MMR student that has climbed to 3k MMR quickly by following the tips in this offlane guide. If you also want to learn how to carry your games and think like the 1% offlaner, keep watching. But before that, I would like to quickly introduce to you Dota 2 Pro Tracker, the top Dota 2 website to get your resources from about up-to-date meta builds and hero picks. If you are not already using Dota 2 Pro Tracker to learn more about the game, be sure to check it out. With that said, let's get back to the video. First, let's take a look into


chunk_text:
  http://bit.ly/2Pj0MtT\nMusic released by Argofox https://www.youtube.com/watch?v=8BXNwnxaVQE&t=0s\nMusic promoted by Audio Library https://www.youtube.com/watch?v=MkNeIUgNPQ8\n\nArtist: tubebackr & MusicbyAden\nTrack: LOGISTICS\n@tubebackr music \n@MusicbyAden\nCreative Commons License. Attribution-NoDerivs 3.0 Unported (CC BY-ND 3.0)\nMusic Link: https://www.youtube.com/watch?v=SJVh_7lDf6w\n\nMusic from #Uppbeat (free for Creators!):\nhttps://uppbeat.io/t/fass/furious\nLicense code: JNBUADJFRTJIFFRA", "channel_url": "https://www.youtube.com/channel/UCYldE7tGQHjNwIVHQ7bDNoA", "duration": 526, "channel": "BalloonDota", "uploader": "BalloonDota", "upload_date": "20240503" } This text was transcribed using whisper model: large-v2 If you struggle to carry games from the offlane position, then this video is for you. In this video, I'll be teaching you to go from scores like this, to consistently hitting scores like this. Note that this progress is from my 2k MMR student that has climbed to 3k MMR quickly by following the tips in this offlane guide. If you also want to learn how to carry your games and think like the 1% offlaner, keep watching. But before that, I would like to quickly introduce to you Dota 2 Pro Tracker, the top Dota 2 website to get your resources from about up-to-date meta builds and hero picks. If you are not already using Dota 2 Pro Tracker to learn more about the game, be sure to check it out. With that said, let's get back to the video. First, let's take a look into the starting items. There are generally 2 alternative builds, which are the Stats build and the Magic Stick build. The Magic Stick build should be prioritised if playing into heroes that spam spells in lane with short to average cooldowns, such as Phantom Assassin and Leech. Otherwise, go with the Stats build. Next, you will be going to your lane and prepare by the river for the Bounty Rune contest. Note that what you do here is dependent on your teammates. If your teammates decide to invade and contest for runes, then you will follow. Otherwise, either ignore the Bounty Rune if it is dangerous, or pick it up and go back to block the lane creeps in your lane. Once the lane begins, the moment you have enough to afford a Bracer and Tango which is 300 gold, ship that out first as your first 2 items if you are going with the Stats build. Alternatively, on the Magic Stick build, send out the 1 upgrade and the Tango once you can afford it. The extra Tango sent from the first courier usage is a safety net just in case you run out of Tangos fast in lane and


chunk_text:
  the starting items. There are generally 2 alternative builds, which are the Stats build and the Magic Stick build. The Magic Stick build should be prioritised if playing into heroes that spam spells in lane with short to average cooldowns, such as Phantom Assassin and Leech. Otherwise, go with the Stats build. Next, you will be going to your lane and prepare by the river for the Bounty Rune contest. Note that what you do here is dependent on your teammates. If your teammates decide to invade and contest for runes, then you will follow. Otherwise, either ignore the Bounty Rune if it is dangerous, or pick it up and go back to block the lane creeps in your lane. Once the lane begins, the moment you have enough to afford a Bracer and Tango which is 300 gold, ship that out first as your first 2 items if you are going with the Stats build. Alternatively, on the Magic Stick build, send out the 1 upgrade and the Tango once you can afford it. The extra Tango sent from the first courier usage is a safety net just in case you run out of Tangos fast in lane and need to wait for the courier to come again later on with low health in lane. Now, the laning phase for an offlaner revolves heavily around keeping the lane frozen near your tower by good creep aggroing fundamentals and sustain. You will be constantly holding the lane close to your tower and punishing the enemy hero with your support anytime you see favorable trades. Favorable trades are defined as 2v1 fights early on with good positioning, higher health and level advantage. Of course, you need to communicate with your position 4 support through pings, text or voice whenever a good trade is identified. This is paired with constant sustaining through regen consumables and building up items over time. You will basically be repeating this process of holding the lane near the tower, punishing enemy heroes and recovering with sustain until the point where you will become strong enough to kill the enemy safelaner and support under their tower. Once you identify that you are able to do that, you will then start pushing the lane into the enemy heroes to attempt to kick them out of lane and break their safelane tower as early as possible. This will usually happen


chunk_text:
  need to wait for the courier to come again later on with low health in lane. Now, the laning phase for an offlaner revolves heavily around keeping the lane frozen near your tower by good creep aggroing fundamentals and sustain. You will be constantly holding the lane close to your tower and punishing the enemy hero with your support anytime you see favorable trades. Favorable trades are defined as 2v1 fights early on with good positioning, higher health and level advantage. Of course, you need to communicate with your position 4 support through pings, text or voice whenever a good trade is identified. This is paired with constant sustaining through regen consumables and building up items over time. You will basically be repeating this process of holding the lane near the tower, punishing enemy heroes and recovering with sustain until the point where you will become strong enough to kill the enemy safelaner and support under their tower. Once you identify that you are able to do that, you will then start pushing the lane into the enemy heroes to attempt to kick them out of lane and break their safelane tower as early as possible. This will usually happen within the 5-10 minutes mark of the game where you will hit a power spike on your hero such as the level 6 for ultimate upgrades or key items that allow you to tank and dive towers. Example of key items are such as Vanguard on tanky strength heroes or Veil of Discord as an alternative on certain heroes like Death Prophet and Sand King for extra stats and kill potential. Another opening towards ending the laning phase for the offlaner are ganks from your teammates to help set up the push in your lane. In cases where you feel like you need extra assistance to pressure the enemy's safelane tower and kick them out of lane, be sure to communicate to your teammates about this. You need to let your teammates know that you have hit your power spike for them to start moving towards your lane through gates or teleports. On the other hand, if you happen to lose your lane and are unable to push into the enemy safelane and break their tower pre-10 minutes, then just retreat to the jungle camps around the lane such as to the big camps or ancients if you are a


chunk_text:
  within the 5-10 minutes mark of the game where you will hit a power spike on your hero such as the level 6 for ultimate upgrades or key items that allow you to tank and dive towers. Example of key items are such as Vanguard on tanky strength heroes or Veil of Discord as an alternative on certain heroes like Death Prophet and Sand King for extra stats and kill potential. Another opening towards ending the laning phase for the offlaner are ganks from your teammates to help set up the push in your lane. In cases where you feel like you need extra assistance to pressure the enemy's safelane tower and kick them out of lane, be sure to communicate to your teammates about this. You need to let your teammates know that you have hit your power spike for them to start moving towards your lane through gates or teleports. On the other hand, if you happen to lose your lane and are unable to push into the enemy safelane and break their tower pre-10 minutes, then just retreat to the jungle camps around the lane such as to the big camps or ancients if you are a hero like Tidehunter or Axe that can do ancients early on. Also, constantly pull the big camp at your lane for the lane to push back to your side to get safe farm. Keep sticking to the recovery route of farming in a losing lane until you are able to push forwards into their tower again. While farming, ensure that you are looking around the map for potential cleanup kills and good fights to take. Hey guys, before we continue with this video, I'd like to just take a quick moment to ask that you like, comment, share and subscribe to my videos and YouTube channel. Your support will really help me grow my channel. Also, you can check out my favour page on Patreon if you are interested to work with me to improve your gameplay. Thank you! Majority of the time, you should be able to successfully break the enemy's safelane tower. Once this happens, you will then transition into the early game phase where heavy emphasis is placed on the concept of area control. This part of the game is where 90% or I would dare say 99% of offlaners, especially those in the lower ranks of


chunk_text:
  hero like Tidehunter or Axe that can do ancients early on. Also, constantly pull the big camp at your lane for the lane to push back to your side to get safe farm. Keep sticking to the recovery route of farming in a losing lane until you are able to push forwards into their tower again. While farming, ensure that you are looking around the map for potential cleanup kills and good fights to take. Hey guys, before we continue with this video, I'd like to just take a quick moment to ask that you like, comment, share and subscribe to my videos and YouTube channel. Your support will really help me grow my channel. Also, you can check out my favour page on Patreon if you are interested to work with me to improve your gameplay. Thank you! Majority of the time, you should be able to successfully break the enemy's safelane tower. Once this happens, you will then transition into the early game phase where heavy emphasis is placed on the concept of area control. This part of the game is where 90% or I would dare say 99% of offlaners, especially those in the lower ranks of below 5k MMR, always get wrong about. They will always think that once they have successfully taken one tier 1 tower down, it's time to focus on pushing another lane to move onto the next tier 1 tower and the next tower after that. I am here to clarify that this is a misconception because it defeats the core principle of what makes up Dota, which is map control, pressure, lead in terms of XP and net worth, understanding power spikes and overall information of teammates and enemies around the map. In order to positively impact these core principles, you will need to constantly keep the enemy safelane pushed in by killing the lane creeps. This is followed by planting wards all over the lane and enemy jungle in order to take away their resources and make plays happen where you have vision while still being safe all the time. Think of your job as someone that is there to bully the enemy safelaner and constantly starve them of their own resources, which are their own jungle camps, and also mess with them if you are able to when the lane pushes back into them. You will be basically doing


chunk_text:
  below 5k MMR, always get wrong about. They will always think that once they have successfully taken one tier 1 tower down, it's time to focus on pushing another lane to move onto the next tier 1 tower and the next tower after that. I am here to clarify that this is a misconception because it defeats the core principle of what makes up Dota, which is map control, pressure, lead in terms of XP and net worth, understanding power spikes and overall information of teammates and enemies around the map. In order to positively impact these core principles, you will need to constantly keep the enemy safelane pushed in by killing the lane creeps. This is followed by planting wards all over the lane and enemy jungle in order to take away their resources and make plays happen where you have vision while still being safe all the time. Think of your job as someone that is there to bully the enemy safelaner and constantly starve them of their own resources, which are their own jungle camps, and also mess with them if you are able to when the lane pushes back into them. You will be basically doing this over and over again by exhausting all resources in your area of control until a good fight happens nearby where you can connect to, such as through the enemy jungle into the mid lane, or a potential play or clean up happens at another lane where you will teleport to. Once you have executed a clean up or a good play, immediately look towards returning to the enemy safelane again to keep the pressure up and not let the enemy safelaner come back into the game. In cases where you have another core holding the enemy safelane, then you can pick another lane that is open and hold that lane to keep it pushed in instead. Repeat this movement and farming pattern until you hit a key item timing that gives your hero a big power spike, such as a blink dagger or a black king bar, normally within the first 15-20 minutes of the game. That is when you will start playing more around the team whenever your team groups up to make plays happen around the map. However, do not forgo the concept of keeping lanes pushed. Ideally you would still want to keep the lanes pushed


chunk_text:
  this over and over again by exhausting all resources in your area of control until a good fight happens nearby where you can connect to, such as through the enemy jungle into the mid lane, or a potential play or clean up happens at another lane where you will teleport to. Once you have executed a clean up or a good play, immediately look towards returning to the enemy safelane again to keep the pressure up and not let the enemy safelaner come back into the game. In cases where you have another core holding the enemy safelane, then you can pick another lane that is open and hold that lane to keep it pushed in instead. Repeat this movement and farming pattern until you hit a key item timing that gives your hero a big power spike, such as a blink dagger or a black king bar, normally within the first 15-20 minutes of the game. That is when you will start playing more around the team whenever your team groups up to make plays happen around the map. However, do not forgo the concept of keeping lanes pushed. Ideally you would still want to keep the lanes pushed into the enemy's side before grouping up in order to make the enemies react to your actions by showing themselves to defend lanes. This is another common mistake whereby offlaners tend to give up the control they had set up early on by running all around the map looking for kills, but in turn giving up the pressure of pushing lanes and worst of all, dying in fights and falling off. As a result, they start throwing away the lead they had created early on and the game now becomes harder to recover from. So once you have your items, your actions will keep revolving around keeping the enemy lanes pushed in and grouping with the team because now it is no longer about getting farm and speeding up item timings, but rather about starting fights and contributing much more to overall map pressure and presence. Do not go back to your own jungle camps and play backwards if your teammates are already playing forwards. This will just result in you playing as an AFK farming player rather than someone that contributes when strong. Alright, so you need to keep repeating the pattern of grouping to team, pushing lanes in,


chunk_text:
  into the enemy's side before grouping up in order to make the enemies react to your actions by showing themselves to defend lanes. This is another common mistake whereby offlaners tend to give up the control they had set up early on by running all around the map looking for kills, but in turn giving up the pressure of pushing lanes and worst of all, dying in fights and falling off. As a result, they start throwing away the lead they had created early on and the game now becomes harder to recover from. So once you have your items, your actions will keep revolving around keeping the enemy lanes pushed in and grouping with the team because now it is no longer about getting farm and speeding up item timings, but rather about starting fights and contributing much more to overall map pressure and presence. Do not go back to your own jungle camps and play backwards if your teammates are already playing forwards. This will just result in you playing as an AFK farming player rather than someone that contributes when strong. Alright, so you need to keep repeating the pattern of grouping to team, pushing lanes in, repeatedly moving forwards with your team where a successful fight or high ground push is attempted to close the game. In summary, the offlaner's heaviest emphasis lies on playing the lane well and occupying the enemy's safe lane and jungle after the laning phase ends. You would then need to hold your fort and stand your ground until you hit your item timing that gives your hero a huge power spike, which will enable you to contribute much more to fights. If you can nail the laning phase and early game phase down consistently, I am confident that you will find yourself climbing the ranks really really quickly on the offlane role. I hope this video has been helpful for you offlaners and also to those of you that are looking into understanding the offlane role more. Thank you for watching, see you guys in the next one.


chunk_text:
  repeatedly moving forwards with your team where a successful fight or high ground push is attempted to close the game. In summary, the offlaner's heaviest emphasis lies on playing the lane well and occupying the enemy's safe lane and jungle after the laning phase ends. You would then need to hold your fort and stand your ground until you hit your item timing that gives your hero a huge power spike, which will enable you to contribute much more to fights. If you can nail the laning phase and early game phase down consistently, I am confident that you will find yourself climbing the ranks really really quickly on the offlane role. I hope this video has been helpful for you offlaners and also to those of you that are looking into understanding the offlane role more. Thank you for watching, see you guys in the next one.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=erzkTPc9SYI", "title": "Closing Ceremony - Fish_ and Cherry & Stef", "description": "", "channel_url": "https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA", "duration": 1137, "channel": "OrangeCon", "uploader": "OrangeCon", "upload_date": "20240909" } This text was transcribed using whisper model: large-v2 What a day, what a day, what a day, what a day. Did you guys have a little bit of fun today or what? It has been quite a year. What a year, what a year, what a year and about a year ago the three of us, we came actually with an idea, you know, we need to continue and do something nice on the community. You can put the slide on, by the way, because it's about, it's not that long ago. A year went by and now we are over here together with approximately 300 persons who are having the passion to talk about the subject we are talking about. We didn't just start at that, you know, I still remember when Sherry invited us to Amsterdam and she said, hey, come on, let's have a beer and we walked around, it was quite warm, it was good weather, we had some alcohol free beers because I don't drink much alcohol anymore and we started actually brainstorming on your balcony and thinking about, hey, what can we do because we lost something that year but it actually was something we started actually at that moment and it didn't take about an hour and we came up with the idea. First we were thinking about the other one conference, it was a little bit lookalike but yeah, it wasn't our thing. So and then we came up, what do we want to be? And we said, you know, we want to be Dutch in a way, mainly because we are Dutch and what's the most Dutch thing we can recognize and we celebrate every year? Well, cheese or whatever, yeah, yeah, yeah, but it's the color of orange, yeah. So it didn't take very long before we find out we wanted to do something with orange and so it was actually the name of Orange Corn Born. Next we had the idea to do this, yeah, let's do a conference in March. We were talking about, I think it was June or something like that, you know, nine months will be enough, you can make a baby in the time, yeah, why you can't make


chunk_text:
  started actually brainstorming on your balcony and thinking about, hey, what can we do because we lost something that year but it actually was something we started actually at that moment and it didn't take about an hour and we came up with the idea. First we were thinking about the other one conference, it was a little bit lookalike but yeah, it wasn't our thing. So and then we came up, what do we want to be? And we said, you know, we want to be Dutch in a way, mainly because we are Dutch and what's the most Dutch thing we can recognize and we celebrate every year? Well, cheese or whatever, yeah, yeah, yeah, but it's the color of orange, yeah. So it didn't take very long before we find out we wanted to do something with orange and so it was actually the name of Orange Corn Born. Next we had the idea to do this, yeah, let's do a conference in March. We were talking about, I think it was June or something like that, you know, nine months will be enough, you can make a baby in the time, yeah, why you can't make a conference in about nine months. Finally we decided actually somewhere, I think January to move it over to somewhere nine months later because you can make a baby in nine months. From the beginning, when we were sitting at this balcony, actually something happened you don't have often, who is having a partner over here, yeah, and who does feel very connected in a way that you think that if you're going home that, you know, your partner made food or something like for you, it's good, it's a really good feeling. Well, if you want to make a baby, like Orange Corn, you don't need two persons, you actually need three persons and when Stef made actually the batch to, when Stef made actually the batch of the opening, he made one batch with three names on it, Fizz, Cherry and Stef and actually this says something for me because this said we were a team actually from the beginning to make this orange baby the baby we have right now. So enough babies right now and enough past, but me personally I'm very proud on what we gained and we learned a lot, we can say that,


chunk_text:
  a conference in about nine months. Finally we decided actually somewhere, I think January to move it over to somewhere nine months later because you can make a baby in nine months. From the beginning, when we were sitting at this balcony, actually something happened you don't have often, who is having a partner over here, yeah, and who does feel very connected in a way that you think that if you're going home that, you know, your partner made food or something like for you, it's good, it's a really good feeling. Well, if you want to make a baby, like Orange Corn, you don't need two persons, you actually need three persons and when Stef made actually the batch to, when Stef made actually the batch of the opening, he made one batch with three names on it, Fizz, Cherry and Stef and actually this says something for me because this said we were a team actually from the beginning to make this orange baby the baby we have right now. So enough babies right now and enough past, but me personally I'm very proud on what we gained and we learned a lot, we can say that, and we had some good stuff going on but we also had some oopsies. Want to talk about the oopsies? Yeah, let's do it. This one I'm going to give to Stef. One of the oopsies wasn't really ours per se, but we decided on this CFP platform called Pretalks, which is an open source project by a German developer who at a very affordable rate offers people a platform to run a CFP. Usually when you're running a security conference you have a certain type of person who are submitting talks or workshops in this case and at some point I got a message from somebody who gave the CTF hacking workshop like, I might have found an issue here. And the funny part is he obviously responsibly disclosed it to the developer, but we looked at it a little bit and the stored content scripting that he found would have allowed him to submit a talk and have me automatically accept it, which was not the way it should be going on the CFP. We had much more oopsies. Two weeks ago I spoke to Meervaard and Meervaard is a fantastic place I have to say. We have


chunk_text:
  and we had some good stuff going on but we also had some oopsies. Want to talk about the oopsies? Yeah, let's do it. This one I'm going to give to Stef. One of the oopsies wasn't really ours per se, but we decided on this CFP platform called Pretalks, which is an open source project by a German developer who at a very affordable rate offers people a platform to run a CFP. Usually when you're running a security conference you have a certain type of person who are submitting talks or workshops in this case and at some point I got a message from somebody who gave the CTF hacking workshop like, I might have found an issue here. And the funny part is he obviously responsibly disclosed it to the developer, but we looked at it a little bit and the stored content scripting that he found would have allowed him to submit a talk and have me automatically accept it, which was not the way it should be going on the CFP. We had much more oopsies. Two weeks ago I spoke to Meervaard and Meervaard is a fantastic place I have to say. We have found a real good home for our baby, sorry. But after the holiday I had a call, hey listen, are you sitting down? So I sit down, yeah. We had a fire at this place. So it was like my heart rate went to 180 or something like that and I was like what happened, what happened? Yeah, yeah, we had a fire at the entrance and we can't put up your banner. That was luckily, I was really happy and they expected a little bit that we're going to be angry or something like that, so they were really happy how we responded because we found a really good partner in Meervaard over here and I think it's a really nice place we were able to win down. Luckily the fire was quite small, it's at the entrance and yeah, we were missing the banner so we just ordered some beach flags. You can still see the scarred parts. If you go outside and you look on the right side of the entrance, there's a little bit of scarred wood there. The other one is for you because everybody's a cherry. So this is an interesting one. I would


chunk_text:
  found a real good home for our baby, sorry. But after the holiday I had a call, hey listen, are you sitting down? So I sit down, yeah. We had a fire at this place. So it was like my heart rate went to 180 or something like that and I was like what happened, what happened? Yeah, yeah, we had a fire at the entrance and we can't put up your banner. That was luckily, I was really happy and they expected a little bit that we're going to be angry or something like that, so they were really happy how we responded because we found a really good partner in Meervaard over here and I think it's a really nice place we were able to win down. Luckily the fire was quite small, it's at the entrance and yeah, we were missing the banner so we just ordered some beach flags. You can still see the scarred parts. If you go outside and you look on the right side of the entrance, there's a little bit of scarred wood there. The other one is for you because everybody's a cherry. So this is an interesting one. I would like you all to take a look at your badge. Take a very good look at your badge and see if you can spot, yeah, there's two stickers and underneath those stickers on all of your badges is my name, Charita van den Bent. Unfortunately, the printer decided that my name was very pretty and they wanted to print the example badge on all of your badges. So now you're all also cherries. Oh, you can take this one too. Oh yeah, I can take this one too. Also if you take another look at your badge, you will find this nice QR code here. I thought it was a very good idea to put a QR code there that linked to the schedules. You would always have the schedule within reach. Well, I used a very nice company that allowed me to put on a tiny logo which said schedule and I tested it. I scanned it with my own phone and it worked just fine. Yesterday someone came to me and was like, hey, you already gave me my volunteer badge, but did you test the QR code on it? And apparently at that point my 14 day


chunk_text:
  like you all to take a look at your badge. Take a very good look at your badge and see if you can spot, yeah, there's two stickers and underneath those stickers on all of your badges is my name, Charita van den Bent. Unfortunately, the printer decided that my name was very pretty and they wanted to print the example badge on all of your badges. So now you're all also cherries. Oh, you can take this one too. Oh yeah, I can take this one too. Also if you take another look at your badge, you will find this nice QR code here. I thought it was a very good idea to put a QR code there that linked to the schedules. You would always have the schedule within reach. Well, I used a very nice company that allowed me to put on a tiny logo which said schedule and I tested it. I scanned it with my own phone and it worked just fine. Yesterday someone came to me and was like, hey, you already gave me my volunteer badge, but did you test the QR code on it? And apparently at that point my 14 day free trial had run out. So I thought, okay, well this is going to be an easy fix, right? I just have to pay money to get this sorted. So I looked at it and said, okay, $4.50 a month. Okay, like $4.50 is not much, right? You can only sign up annually. So we now have an annual subscription to a QR. So if you want any QR codes, come to us. This one's for Steph. Yeah, let's do that. One other thing happened. At some point the wrong version of a GitHub was pushed to our website, which happened while the main web developer was actually on holiday in the UK. And we noticed that we published all the trainings which we hadn't fully agreed upon yet with the trainers. We scrambled, manually removed what we thought was all the links to all the trainings that were not published yet. And then somebody on Twitter sent us a message like, hey, just so you know, if you go to the OSINT training, the links are still there. So we had our first responsible disclosure as well. Yeah, and this one particularly is special for me, actually it's special


chunk_text:
  free trial had run out. So I thought, okay, well this is going to be an easy fix, right? I just have to pay money to get this sorted. So I looked at it and said, okay, $4.50 a month. Okay, like $4.50 is not much, right? You can only sign up annually. So we now have an annual subscription to a QR. So if you want any QR codes, come to us. This one's for Steph. Yeah, let's do that. One other thing happened. At some point the wrong version of a GitHub was pushed to our website, which happened while the main web developer was actually on holiday in the UK. And we noticed that we published all the trainings which we hadn't fully agreed upon yet with the trainers. We scrambled, manually removed what we thought was all the links to all the trainings that were not published yet. And then somebody on Twitter sent us a message like, hey, just so you know, if you go to the OSINT training, the links are still there. So we had our first responsible disclosure as well. Yeah, and this one particularly is special for me, actually it's special for Steph. It's a funny thing because actually Steph hate the color orange. And that's good. That's fine. We all have the possibility to not like a color or whatever. And today Steph came to me and he said, you know, I'm only going to wear the shirt during the closing and the opening. I said, yeah, of course, you know, it's your color and it's nice to set the tone on the beginning. And then during the day something happened. Steph was wearing the orange shirt because it was that easy to find us. So we came up with the idea also that it was easy to find him. So thank you very much, Steph, actually for wearing something you don't like. Thank you very much. Maybe you guys haven't heard it yet, but we as OrangeCon, we are a foundation. We are Stichting Ocon. And the main reason why we made it a foundation is because we think it's very important for everybody to have some openness also on what we do and what is our purpose, et cetera. So that's the reason why we didn't have an entity like a BeVe or whatever, but it's mainly a


chunk_text:
  for Steph. It's a funny thing because actually Steph hate the color orange. And that's good. That's fine. We all have the possibility to not like a color or whatever. And today Steph came to me and he said, you know, I'm only going to wear the shirt during the closing and the opening. I said, yeah, of course, you know, it's your color and it's nice to set the tone on the beginning. And then during the day something happened. Steph was wearing the orange shirt because it was that easy to find us. So we came up with the idea also that it was easy to find him. So thank you very much, Steph, actually for wearing something you don't like. Thank you very much. Maybe you guys haven't heard it yet, but we as OrangeCon, we are a foundation. We are Stichting Ocon. And the main reason why we made it a foundation is because we think it's very important for everybody to have some openness also on what we do and what is our purpose, et cetera. So that's the reason why we didn't have an entity like a BeVe or whatever, but it's mainly a reason that we founded the Stichting. And we also have some very strict rules what we want to gain with that. And one of the most important things is knowledge sharing for the Dutch community by the Dutch community, for example. And it also means that we want to be open on a lot of things. We want to create a transparency report, for example, and to tell you, you know, what is the cost of a conference like this? Well, I can tell you the total average cost we are spending in the past days and today is about 95,000 euros ex-tax. That was quite a number, because, yeah, we grew to, sorry? I hope I can get it off the VAT or something like that. The revenue of the conference is about 110K if we have everything. So we're making a small plus. And I think this small plus is very well, because in the beginning of when we founded Orangecon, we started with zero euros on the bank. It was even worse. The Rabobank even already took our money before we even had access to the conference. They're asking the monthly subscription costs. So I said, you


chunk_text:
  reason that we founded the Stichting. And we also have some very strict rules what we want to gain with that. And one of the most important things is knowledge sharing for the Dutch community by the Dutch community, for example. And it also means that we want to be open on a lot of things. We want to create a transparency report, for example, and to tell you, you know, what is the cost of a conference like this? Well, I can tell you the total average cost we are spending in the past days and today is about 95,000 euros ex-tax. That was quite a number, because, yeah, we grew to, sorry? I hope I can get it off the VAT or something like that. The revenue of the conference is about 110K if we have everything. So we're making a small plus. And I think this small plus is very well, because in the beginning of when we founded Orangecon, we started with zero euros on the bank. It was even worse. The Rabobank even already took our money before we even had access to the conference. They're asking the monthly subscription costs. So I said, you know, I don't have access and I'm already in the minus. What the fuck? But that doesn't matter. The main thing is that we wanted to say that we are, yeah, we're making about 10K or something like that, but we need this money also already for next year, because we decided not to make it a one-off. We decided to make it for next year. The total entities is approximately 300. I say approximately because, yeah, can you count the speakers and the crew or whatever? It's the maximum we can gain at this room. What will happen in the future, we'll talk about that later. Very important. Maybe you can take this one, Sherry. So as Buddy mentioned, Orangecon is our baby. And a baby, you don't raise a baby just with the parents. As every parent will know, it takes a village. So we would like to ask you, our village, to help us raise our baby. Please give us all the feedback that you can. Good feedback, bad feedback. We prefer constructive feedback, but you do you. You can just email us at feedback at orangecon.nl. If you would like to remain anonymous, just create an


chunk_text:
  know, I don't have access and I'm already in the minus. What the fuck? But that doesn't matter. The main thing is that we wanted to say that we are, yeah, we're making about 10K or something like that, but we need this money also already for next year, because we decided not to make it a one-off. We decided to make it for next year. The total entities is approximately 300. I say approximately because, yeah, can you count the speakers and the crew or whatever? It's the maximum we can gain at this room. What will happen in the future, we'll talk about that later. Very important. Maybe you can take this one, Sherry. So as Buddy mentioned, Orangecon is our baby. And a baby, you don't raise a baby just with the parents. As every parent will know, it takes a village. So we would like to ask you, our village, to help us raise our baby. Please give us all the feedback that you can. Good feedback, bad feedback. We prefer constructive feedback, but you do you. You can just email us at feedback at orangecon.nl. If you would like to remain anonymous, just create an anonymous email address. I'm sure all of you know how it works. Then we're coming to the big thank you list. And I'm not going to mention them all, but there are some very important things we do. It wasn't possible to organize this con with, for example, our sponsors. The tactics behind our sponsors. Also in the transparency, we're going to tell you a little bit about how we are using the sponsorship. We built the conference in a bare-bone construction, which means that we were able to pay the bill with the tickets of the training and your tickets. All the sponsors made it, for example, possible that we would have a nice giveaway to our speakers, for example. The sponsors made it possible that we had something at the first coffee break, for example. And the sponsors made it possible to do some extra things around it. So the tactics behind it was, you know, the sponsor made OrangeCon even more shiny than we were able to do it only if we did it bare-bone. So I think this is really nice that we have our sponsors. Thanks, sponsors. We are making this a community conference with


chunk_text:
  anonymous email address. I'm sure all of you know how it works. Then we're coming to the big thank you list. And I'm not going to mention them all, but there are some very important things we do. It wasn't possible to organize this con with, for example, our sponsors. The tactics behind our sponsors. Also in the transparency, we're going to tell you a little bit about how we are using the sponsorship. We built the conference in a bare-bone construction, which means that we were able to pay the bill with the tickets of the training and your tickets. All the sponsors made it, for example, possible that we would have a nice giveaway to our speakers, for example. The sponsors made it possible that we had something at the first coffee break, for example. And the sponsors made it possible to do some extra things around it. So the tactics behind it was, you know, the sponsor made OrangeCon even more shiny than we were able to do it only if we did it bare-bone. So I think this is really nice that we have our sponsors. Thanks, sponsors. We are making this a community conference with the community. And there are just a few logos on, but a lot of other communities did help us out. And I think they also need a very big applause, because a lot of people from these communities are walking around. Thank you, community guys. And we also have a giveaway. I don't know. Who did the giveaway? And I want to ask one of the Tanium guys to come over here. Yeah, yeah. Oh, he's here. Because this is the big box, and you might be able to hand it over to. It's the D&D version of LEGO. I loved it. At first, I was actually doubted to say, you know, the box didn't arrive. It did arrive. Yeah, yeah. Thank you very much. And we have a kind of funny thing going on, because we needed to do a lucky draw. But we had quite some people actually signing up. So we're going to do a lucky draw. And I already asked Inge to come up with a number below 29. And what's the number? Because you're the notary right now. 27. That sounds very good. So I'm going to show the slides with all the names on.


chunk_text:
  the community. And there are just a few logos on, but a lot of other communities did help us out. And I think they also need a very big applause, because a lot of people from these communities are walking around. Thank you, community guys. And we also have a giveaway. I don't know. Who did the giveaway? And I want to ask one of the Tanium guys to come over here. Yeah, yeah. Oh, he's here. Because this is the big box, and you might be able to hand it over to. It's the D&D version of LEGO. I loved it. At first, I was actually doubted to say, you know, the box didn't arrive. It did arrive. Yeah, yeah. Thank you very much. And we have a kind of funny thing going on, because we needed to do a lucky draw. But we had quite some people actually signing up. So we're going to do a lucky draw. And I already asked Inge to come up with a number below 29. And what's the number? Because you're the notary right now. 27. That sounds very good. So I'm going to show the slides with all the names on. And we're going to take a look at number 27, which is somebody from Ajin, Stanislav. And I'm not going to pronounce your last name, but I will probably say it wrong. Yeah. Stanislav, is he around? Come over here and get your prize. Have a lot of fun with it. Yeah, thanks everybody for attending today. We're here actually not just to sponsor, but also to be part of a community. And that's really been a great day for us to see you guys. But also to thank the organization OrangeCon. And we hope to be here next year again. And for myself, I see quite some familiar faces from the community. And I hope to see you guys soon again. And that's actually it. I didn't copy anything. So as you guys said, we're going to invest in the future. And if you guys are interested, the foundation is a little bit making profit on t-shirts and the merch, et cetera. We sent up a merch shop because we didn't want to handle cash over here. And it's much easier to have it at your doorsteps around. It's a printing on the month server. So if you'd like


chunk_text:
  And we're going to take a look at number 27, which is somebody from Ajin, Stanislav. And I'm not going to pronounce your last name, but I will probably say it wrong. Yeah. Stanislav, is he around? Come over here and get your prize. Have a lot of fun with it. Yeah, thanks everybody for attending today. We're here actually not just to sponsor, but also to be part of a community. And that's really been a great day for us to see you guys. But also to thank the organization OrangeCon. And we hope to be here next year again. And for myself, I see quite some familiar faces from the community. And I hope to see you guys soon again. And that's actually it. I didn't copy anything. So as you guys said, we're going to invest in the future. And if you guys are interested, the foundation is a little bit making profit on t-shirts and the merch, et cetera. We sent up a merch shop because we didn't want to handle cash over here. And it's much easier to have it at your doorsteps around. It's a printing on the month server. So if you'd like something to order, you will probably help us at least to organize the next conference again. So if you are interested in the shirt, please take a look on it. So yeah, let's talk about the future. And it's already there. So now we have to do it. Well, you want to talk about the future? OK. OK. Well, let's talk a little bit about the future. When we started this, as I said, we don't want to do this as a one-off. We want to continue this. And we have the 5th of September today. And we came up actually Thursday is a very nice day. But Friday should be better. But they were already booked on Friday. So yeah. So we decided actually to go to 5th of September 2025. There is still a lot of discussion if we're going to make it one or two days or make more or less trains. It is going to be set probably after a month of rest. Then we're going to fill in the gaps and the blanks and see what's going to happen there. So put it in your agenda. 5th of September 2025. Yeah, this one is especially


chunk_text:
  something to order, you will probably help us at least to organize the next conference again. So if you are interested in the shirt, please take a look on it. So yeah, let's talk about the future. And it's already there. So now we have to do it. Well, you want to talk about the future? OK. OK. Well, let's talk a little bit about the future. When we started this, as I said, we don't want to do this as a one-off. We want to continue this. And we have the 5th of September today. And we came up actually Thursday is a very nice day. But Friday should be better. But they were already booked on Friday. So yeah. So we decided actually to go to 5th of September 2025. There is still a lot of discussion if we're going to make it one or two days or make more or less trains. It is going to be set probably after a month of rest. Then we're going to fill in the gaps and the blanks and see what's going to happen there. So put it in your agenda. 5th of September 2025. Yeah, this one is especially you. So I would take a small moment to thank our fantastic crew who all of us who are all volunteers who volunteered their time, not just today, not just the past few days, but also in the weeks before to help us build this event. Orangecon would simply not exist if not for them. So thank you very much. So, okay. Thanks. Who wants a beer? Thank you all. See you next year.


chunk_text:
  you. So I would take a small moment to thank our fantastic crew who all of us who are all volunteers who volunteered their time, not just today, not just the past few days, but also in the weeks before to help us build this event. Orangecon would simply not exist if not for them. So thank you very much. So, okay. Thanks. Who wants a beer? Thank you all. See you next year.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=rPZx1zbKJnI", "title": "TROOPERS24: 10 Years of Windows Privilege Escalation with \"Potatoes\"", "description": "Talk by Andrea Pierini - June 26th, 2024 at TROOPERS24 IT security conference in Heidelberg, Germany hosted by @ERNW_ITSec\n\n#TROOPERS24 #ITsecurity \nhttps://troopers.de/troopers24/talks/cyzbj3/\n\nMore impressions:\nhttps://twitter.com/WEareTROOPERS\nhttps://twitter.com/ERNW_ITSec\nhttps://infosec.exchange/@WEareTROOPERS\nhttps://infosec.exchange/@ERNW https://ernw.de", "channel_url": "https://www.youtube.com/channel/UCPY5aUREHmbDO4PtR6AYLfQ", "duration": 3272, "channel": "TROOPERS IT Security Conference", "uploader": "TROOPERS IT Security Conference", "upload_date": "20240902" } This text was transcribed using whisper model: large-v2 Hello, and first of all, thank you for joining my talk, which will be about the wonderful world of the Windows privilege escalations using potatoes. First of all, you see two names here, myself and Antonio, my friend and partner in crime, because most of the researches that I will discuss today, we did them together. And part of this talk was presented by him last November in Seoul. But I have some news, so it's not the same talk. Oh, why doesn't it work? It worked. Oh, good, yeah. Two words about me. I am Andrea Pirini. I am Italian, but I think that's an easy guess just listening to my bad English. I work for Semperis in the bridge preparedness and incident response team as a senior security consultant, senior because I'm old, because I'm not that expert. But OK, keep on. During my spare time when I'm not cycling or doing other fun stuff, I like diving into the world of the mysterious world of offensive security. And, of course, I am a potato lover. These are my handles. If you want to get in contact with me or read my blog post, here you have it. Why this talk? In very, very short, we wanted to share our journey in trying to find new potatoes technique. This is what we did. And we spent a lot of time, endless times, endless nights. And we used crazy ideas to find always new vulnerabilities in order to exploit what we call the potato technique. So this talk will not go too much in the details, because one, it is boring, and two, it will take too much time. So I will keep it, I hope, interesting and just more simple explanations and not going too much deep in the technical details. The agenda, after a brief introduction on what is considered by Microsoft a privileged escalation, so what is a security boundary violation and not, we will delve into the RPC Decom trigger, which is the


chunk_text:
  that expert. But OK, keep on. During my spare time when I'm not cycling or doing other fun stuff, I like diving into the world of the mysterious world of offensive security. And, of course, I am a potato lover. These are my handles. If you want to get in contact with me or read my blog post, here you have it. Why this talk? In very, very short, we wanted to share our journey in trying to find new potatoes technique. This is what we did. And we spent a lot of time, endless times, endless nights. And we used crazy ideas to find always new vulnerabilities in order to exploit what we call the potato technique. So this talk will not go too much in the details, because one, it is boring, and two, it will take too much time. So I will keep it, I hope, interesting and just more simple explanations and not going too much deep in the technical details. The agenda, after a brief introduction on what is considered by Microsoft a privileged escalation, so what is a security boundary violation and not, we will delve into the RPC Decom trigger, which is the trigger which permitted us to find a lot of vulnerabilities via the potato techniques. And after this, we will analyze how it was possible to break the boundaries, the safety boundaries and the security boundaries, local and then also from remote. You see here three asterisks. These are the new findings. This is a total new entry. So I will, the first time, talk about this in this session. So I hope you will enjoy it. And then, obviously, at the end, the conclusions. So let's start with what is a privileged escalation. Well, I can say what is not a privileged escalation from Microsoft's point of view. It's not a privileged escalation from admin to kernel or user account control bypass. And it is not a privileged escalation when you abuse a service account or you bypass the Windows service account hardening. This is considered a safety boundary and it is not considered a security violation. Alias, the behavior is by default or the behavior is as expected. And then sometimes they silently fix, but it's up to them. What is a security boundary violation? Of course, from standard user to admin and the various sandboxes bypasses. So this


chunk_text:
  trigger which permitted us to find a lot of vulnerabilities via the potato techniques. And after this, we will analyze how it was possible to break the boundaries, the safety boundaries and the security boundaries, local and then also from remote. You see here three asterisks. These are the new findings. This is a total new entry. So I will, the first time, talk about this in this session. So I hope you will enjoy it. And then, obviously, at the end, the conclusions. So let's start with what is a privileged escalation. Well, I can say what is not a privileged escalation from Microsoft's point of view. It's not a privileged escalation from admin to kernel or user account control bypass. And it is not a privileged escalation when you abuse a service account or you bypass the Windows service account hardening. This is considered a safety boundary and it is not considered a security violation. Alias, the behavior is by default or the behavior is as expected. And then sometimes they silently fix, but it's up to them. What is a security boundary violation? Of course, from standard user to admin and the various sandboxes bypasses. So this is my personal consideration. I still don't understand the bounty politics of Microsoft. But probably I'm an old-seasoned legacy on-prem guy. So it's difficult for me to understand this decision. I don't know what you think about it. But yeah, that's my personal opinion. And I wanted to share it with you. Okay, where it all began. It began 10 years ago. Therefore, 10 years of potatoes exportations with James Forshaw. You will hear his name several times because he did a lot of fantastic researches. And which helped us very much in our researches too. So we hear his name very, very often. And it started with the local NTLM reflection attack reported in 2014 and fixed in 2015. This was the very, very first, let's say, potato technique. Because then the name potato came after. But this is the very, very first potato technique. So how does this work? I try to keep it very, very simple. So we have a malicious COM object. Okay, I have the screen here. Perfect. We have this malicious COM object, COM client, which tries to trigger a privileged COM server service. And how does it trigger? Using a special call, a


chunk_text:
  is my personal consideration. I still don't understand the bounty politics of Microsoft. But probably I'm an old-seasoned legacy on-prem guy. So it's difficult for me to understand this decision. I don't know what you think about it. But yeah, that's my personal opinion. And I wanted to share it with you. Okay, where it all began. It began 10 years ago. Therefore, 10 years of potatoes exportations with James Forshaw. You will hear his name several times because he did a lot of fantastic researches. And which helped us very much in our researches too. So we hear his name very, very often. And it started with the local NTLM reflection attack reported in 2014 and fixed in 2015. This was the very, very first, let's say, potato technique. Because then the name potato came after. But this is the very, very first potato technique. So how does this work? I try to keep it very, very simple. So we have a malicious COM object. Okay, I have the screen here. Perfect. We have this malicious COM object, COM client, which tries to trigger a privileged COM server service. And how does it trigger? Using a special call, a DCOM call. It's COGET instance from my storage, blah, blah, blah. With a class ID. By triggering this COM server service, what happens is that the client crafts a controlled Marshall object. Standard REF Marshall object. And this object contains some important information. The auxit resolver address he should connect to. The auxit resolver port. And this can be controlled by the malicious user. And this is very, very important. Because auxit resolution is needed for locating, for the COM server, to locating the binding information on where to contact the COM server. So think about it as a DNS for DCOM. And the other funny thing is that this call is authenticated. So when we trigger this COM server, what happens is that the privileged COM server will perform a resolve auxit 2 call. And it is an authenticated call. So we, as a malicious user, can intercept the authentication. And then use it. But we can go further. We can also send to the privileged COM server service a string binding containing the information about a fake RPC server under our control. And the COM server, which happily contacts us via the IRAM unknown interface, unknown 2 interface


chunk_text:
  DCOM call. It's COGET instance from my storage, blah, blah, blah. With a class ID. By triggering this COM server service, what happens is that the client crafts a controlled Marshall object. Standard REF Marshall object. And this object contains some important information. The auxit resolver address he should connect to. The auxit resolver port. And this can be controlled by the malicious user. And this is very, very important. Because auxit resolution is needed for locating, for the COM server, to locating the binding information on where to contact the COM server. So think about it as a DNS for DCOM. And the other funny thing is that this call is authenticated. So when we trigger this COM server, what happens is that the privileged COM server will perform a resolve auxit 2 call. And it is an authenticated call. So we, as a malicious user, can intercept the authentication. And then use it. But we can go further. We can also send to the privileged COM server service a string binding containing the information about a fake RPC server under our control. And the COM server, which happily contacts us via the IRAM unknown interface, unknown 2 interface call, will contact us. And again, it is an authenticated call. So at the end, we have the possibility to intercept this authentication. And then, depending on the context, we can reflect or relay this authentication. And this is the whole magic. So it's not black magic, but it's a behavior by default. But as usual, there are a lot of behaviors by default which are most of the time ignored. And then when someone discovers it, they can order it. But this can also be abused. And this is the case. So we have what I call profit 1 and profit 2. Remember these two? We have two authentications we can intercept and manipulate. The second one was implemented by us, starting with the raw potato tool, I think three or four years ago. And this is the first time we implemented a raw oxide resolver so that we could also abuse this second authentication. So let's start from the very beginning, from service to system. So a safety boundary violation. When I say service, I mean abusing the impersonation privileges. Because normally, services have at least impersonation privilege. So it's a matter of abusing this privilege. I think


chunk_text:
  call, will contact us. And again, it is an authenticated call. So at the end, we have the possibility to intercept this authentication. And then, depending on the context, we can reflect or relay this authentication. And this is the whole magic. So it's not black magic, but it's a behavior by default. But as usual, there are a lot of behaviors by default which are most of the time ignored. And then when someone discovers it, they can order it. But this can also be abused. And this is the case. So we have what I call profit 1 and profit 2. Remember these two? We have two authentications we can intercept and manipulate. The second one was implemented by us, starting with the raw potato tool, I think three or four years ago. And this is the first time we implemented a raw oxide resolver so that we could also abuse this second authentication. So let's start from the very beginning, from service to system. So a safety boundary violation. When I say service, I mean abusing the impersonation privileges. Because normally, services have at least impersonation privilege. So it's a matter of abusing this privilege. I think that you know this tool? Yes? No? Ah, good. Okay. This was the very first implementation. It was done in 2016. And it was the first tool which triggered the DECOM server. And it was somehow limited because it used only the bits CLSID and used a fixed port, which was 666. And basically what it did is triggered authentication, intercepted authentication, negotiated a system token, and then impersonated the system token. So once you have impersonation privileges, you impersonate the system token and your system. And this implementation worked only with Meterpreter, so it was somehow limited. And then came our juicy potato. Juicy potato, you know it, yeah? Ah, cool. This was coded by me and my friend Giuseppe in 2018, so many years ago. And it was what you call the sugared version of raw potato because it permits you. We found a lot of other interesting CLSID to abuse. It is possible to specify a port instead of a fixed one. And also, it is standalone. So it uses create process as user or create process with logon token to use the token and then launch a process under the system identity. And it was heavily


chunk_text:
  that you know this tool? Yes? No? Ah, good. Okay. This was the very first implementation. It was done in 2016. And it was the first tool which triggered the DECOM server. And it was somehow limited because it used only the bits CLSID and used a fixed port, which was 666. And basically what it did is triggered authentication, intercepted authentication, negotiated a system token, and then impersonated the system token. So once you have impersonation privileges, you impersonate the system token and your system. And this implementation worked only with Meterpreter, so it was somehow limited. And then came our juicy potato. Juicy potato, you know it, yeah? Ah, cool. This was coded by me and my friend Giuseppe in 2018, so many years ago. And it was what you call the sugared version of raw potato because it permits you. We found a lot of other interesting CLSID to abuse. It is possible to specify a port instead of a fixed one. And also, it is standalone. So it uses create process as user or create process with logon token to use the token and then launch a process under the system identity. And it was heavily used because it was very simple to use. And once you compromise the system or an IAS account, an MS SQL service account, it was very easy to perform a safety boundary violation. This was, let's say, fixed. We're starting from Windows Server 2019. And with this version, it was no more possible to specify a custom port. And then this fix was backported in 2022, also in Windows 2016. So juicy potato stopped working. How was this performed without going too much in details? Simply by escaping the custom port. Not exactly escaping the custom port. Escaping the brackets around the custom port. So once they had escaped, the exploit breaks and it doesn't work anymore. And so goodbye, definitely, to juicy potato. But obviously, meantime, we had other ideas. So we started with raw potato. In raw potato, instead of using the local port, and we can no more specify a local port, we used a redirector on a Linux machine, the socket redirector, which then redirects the calls from port 135 to a custom port on a service running on our machine. And this service is the fake auxit resolver. What does raw potato do? First of


chunk_text:
  used because it was very simple to use. And once you compromise the system or an IAS account, an MS SQL service account, it was very easy to perform a safety boundary violation. This was, let's say, fixed. We're starting from Windows Server 2019. And with this version, it was no more possible to specify a custom port. And then this fix was backported in 2022, also in Windows 2016. So juicy potato stopped working. How was this performed without going too much in details? Simply by escaping the custom port. Not exactly escaping the custom port. Escaping the brackets around the custom port. So once they had escaped, the exploit breaks and it doesn't work anymore. And so goodbye, definitely, to juicy potato. But obviously, meantime, we had other ideas. So we started with raw potato. In raw potato, instead of using the local port, and we can no more specify a local port, we used a redirector on a Linux machine, the socket redirector, which then redirects the calls from port 135 to a custom port on a service running on our machine. And this service is the fake auxit resolver. What does raw potato do? First of all, it uses name pipe instead of TCP IP. And it creates a custom fake port mapper endpoint. This is very important. The port mapper endpoint is the equivalent, again, of the DNS for RPC. And the trick was, because we cannot create another mapper endpoint, because it already exists in the name pipes. But the trick was to escape somehow the checks, so that it is possible to create a port mapper under another, let's say, subdirectory. But because there is a bug, and there is still a bug, in converting the slash chart, as you can see. So if I specify localhost slash pipe slash blah blah blah, it converts it in a real name pipe path. So once we have the name pipe, it is very easy to impersonate the caller, which is in this case system. Once we have impersonated the caller, we are network service in this case, because the process is the RPSS service. Network service is not that interesting, but in this process, the RPSS service, we have the authentication ID of the RPSS, which permits us to access a lot of juicy tokens, system code tokens, and whatever. So with a simple


chunk_text:
  all, it uses name pipe instead of TCP IP. And it creates a custom fake port mapper endpoint. This is very important. The port mapper endpoint is the equivalent, again, of the DNS for RPC. And the trick was, because we cannot create another mapper endpoint, because it already exists in the name pipes. But the trick was to escape somehow the checks, so that it is possible to create a port mapper under another, let's say, subdirectory. But because there is a bug, and there is still a bug, in converting the slash chart, as you can see. So if I specify localhost slash pipe slash blah blah blah, it converts it in a real name pipe path. So once we have the name pipe, it is very easy to impersonate the caller, which is in this case system. Once we have impersonated the caller, we are network service in this case, because the process is the RPSS service. Network service is not that interesting, but in this process, the RPSS service, we have the authentication ID of the RPSS, which permits us to access a lot of juicy tokens, system code tokens, and whatever. So with a simple token kidnapping, once we have access to the process, we kidnap the token of the system user, and then we authenticate, and then we use this token for creating new processes. This is a simple screenshot on how RockPotato works. Classic web shell with a CMD. I am the default IIS user, which has impersonation privileges. I launch my tool, and I get back a system shell. So again, a safety boundary violation. With this idea in mind, so intercepting the second authentication and abusing profit too, we also rewrote part of Juicy Potato so that it is possible to intercept the second authentication, and in the meantime, using a trick from James Forshaw, we could also get rid of the socket redirector, because we are no more interested in the first authentication, but in the second authentication, which is returned via the string bindings by our fake auxit resolver. So we are able to intercept this authentication, but sadly, in this case, we don't have that much CLS ID to abuse, because most of them return you an identification token, which is really useless. Then there was the PrintNotify service, which was the perfect candidate, because it returned an


chunk_text:
  token kidnapping, once we have access to the process, we kidnap the token of the system user, and then we authenticate, and then we use this token for creating new processes. This is a simple screenshot on how RockPotato works. Classic web shell with a CMD. I am the default IIS user, which has impersonation privileges. I launch my tool, and I get back a system shell. So again, a safety boundary violation. With this idea in mind, so intercepting the second authentication and abusing profit too, we also rewrote part of Juicy Potato so that it is possible to intercept the second authentication, and in the meantime, using a trick from James Forshaw, we could also get rid of the socket redirector, because we are no more interested in the first authentication, but in the second authentication, which is returned via the string bindings by our fake auxit resolver. So we are able to intercept this authentication, but sadly, in this case, we don't have that much CLS ID to abuse, because most of them return you an identification token, which is really useless. Then there was the PrintNotify service, which was the perfect candidate, because it returned an impersonation token, but then it was a problem, because it needed the interactive seed. So we used a trick to recover the interactive seed, and we were able to perform the full escalation. After some months, Microsoft fixed the possibility to use this trick, but luckily, starting from Windows 11 and Windows Server 2022, we have this other service, the MCP management service, which has its own CLS ID, and which permits you, again, to get an authentication from the system with the impersonation token. So it's okay. So basically, what we did, I called it a juicy potato NG, so we gave a second chance to a juicy potato. And this still works, but again, we are always talking about safety boundary violations. So in this screenshot, you can see very, very easy to, once you have an impersonation privilege or an assigned primary token privilege, escalate to system, just launch the tool, and you're done. Obviously, there are a lot of other contributors with a lot of other cool potato techniques. Here are some of them. Always safety boundary violations, and there are also other new ones, so it's up to you. But there are a lot of


chunk_text:
  impersonation token, but then it was a problem, because it needed the interactive seed. So we used a trick to recover the interactive seed, and we were able to perform the full escalation. After some months, Microsoft fixed the possibility to use this trick, but luckily, starting from Windows 11 and Windows Server 2022, we have this other service, the MCP management service, which has its own CLS ID, and which permits you, again, to get an authentication from the system with the impersonation token. So it's okay. So basically, what we did, I called it a juicy potato NG, so we gave a second chance to a juicy potato. And this still works, but again, we are always talking about safety boundary violations. So in this screenshot, you can see very, very easy to, once you have an impersonation privilege or an assigned primary token privilege, escalate to system, just launch the tool, and you're done. Obviously, there are a lot of other contributors with a lot of other cool potato techniques. Here are some of them. Always safety boundary violations, and there are also other new ones, so it's up to you. But there are a lot of other possibilities to abuse these potato techniques, so I only describe the one we found in this case. So let's get it a little bit more interesting. With rock potato, with the technique of rock potato, so we thought, but is it possible to perform a real privilege escalation? Because we have all the elements. We have to understand how we can abuse the authentication, and if you can get another type of authentication. And here comes remote potato zero, which is the first security boundary violations. In this case, we are relaying the NTLM authentication. It's a local exploit, but the relay is performed on a remote server, and what does the remote potato do? It abuses some com servers, which impersonates the logged-in user, and this is interesting, because the idea is intercept the authentication of the user connected on another session, and relay the authentication to an external server. So imagine that if you have an admin or whatever user which other privileges connected, I can trigger his authentication and forward the authentication via NTLM to a target server, where I want to access resources on behalf of this user. We had the problem because by default


chunk_text:
  other possibilities to abuse these potato techniques, so I only describe the one we found in this case. So let's get it a little bit more interesting. With rock potato, with the technique of rock potato, so we thought, but is it possible to perform a real privilege escalation? Because we have all the elements. We have to understand how we can abuse the authentication, and if you can get another type of authentication. And here comes remote potato zero, which is the first security boundary violations. In this case, we are relaying the NTLM authentication. It's a local exploit, but the relay is performed on a remote server, and what does the remote potato do? It abuses some com servers, which impersonates the logged-in user, and this is interesting, because the idea is intercept the authentication of the user connected on another session, and relay the authentication to an external server. So imagine that if you have an admin or whatever user which other privileges connected, I can trigger his authentication and forward the authentication via NTLM to a target server, where I want to access resources on behalf of this user. We had the problem because by default signing was enabled, so this limits somehow, but with another trick, we were able to downgrade to RPC-level connect, which means then signing is no more enabled, via the Resolve Auxit 2 call. So the main scenario is obviously when you have a privileged user in a multi-user environment, imagine a remote desktop, a privileged user, I trigger his authentication, and I relate to LDAP. Imagine a domain admin. I know that domain admin should never log on on non-tier 0, but who knows, maybe it could be possible. So you can relate, and at this point, you relay the authentication, and depending on the user you are relaying, you can take over the domain. So in this screenshot, it's just an example. We have a standard user, a domain admin user, which is connected on another session. I launch the Remote Potatoes 0 tool, specifying the session, and then I forward. I am able to intercept the NTLMv2 hashes. I forward the NTLMv2 hashes to an external relay, for example, NTLM relay, and then I can do whatever I want. What we did in Remote Potatoes is also to perform before a local relay from DCOM to HTTP so


chunk_text:
  signing was enabled, so this limits somehow, but with another trick, we were able to downgrade to RPC-level connect, which means then signing is no more enabled, via the Resolve Auxit 2 call. So the main scenario is obviously when you have a privileged user in a multi-user environment, imagine a remote desktop, a privileged user, I trigger his authentication, and I relate to LDAP. Imagine a domain admin. I know that domain admin should never log on on non-tier 0, but who knows, maybe it could be possible. So you can relate, and at this point, you relay the authentication, and depending on the user you are relaying, you can take over the domain. So in this screenshot, it's just an example. We have a standard user, a domain admin user, which is connected on another session. I launch the Remote Potatoes 0 tool, specifying the session, and then I forward. I am able to intercept the NTLMv2 hashes. I forward the NTLMv2 hashes to an external relay, for example, NTLM relay, and then I can do whatever I want. What we did in Remote Potatoes is also to perform before a local relay from DCOM to HTTP so that it is more easy to interface with external relay tools, just like, for example, NTLM relay. We obviously reported this to Microsoft before publishing it, because for us, it's a security boundary violation. And what Microsoft said, after a long debate, a long analysis, and so on, that server must defend themselves against relay attacks. And for this occasion, we created a special T-shirt for this. Sadly, I forgot it, because I wanted to show you this T-shirt, but I left it at home. But 18 months later, kind of unintended fix, broke Remote Potatoes because it was no more possible to control the signing. So it is always signed, so the relay versus LDAP, for example, won't work anymore. But it still works where SMB signing is not required. For example, SMB, HTTP, SMB signing is not required, but normally the default is on domain controller, yes, but on file server and so on, we leave the default, which is not signed. So you can do, a malicious actor can do a lot of nasty things, still can do a lot of nasty things with Remote Potatoes 0. So move on, on Local Potato. This is a curious


chunk_text:
  that it is more easy to interface with external relay tools, just like, for example, NTLM relay. We obviously reported this to Microsoft before publishing it, because for us, it's a security boundary violation. And what Microsoft said, after a long debate, a long analysis, and so on, that server must defend themselves against relay attacks. And for this occasion, we created a special T-shirt for this. Sadly, I forgot it, because I wanted to show you this T-shirt, but I left it at home. But 18 months later, kind of unintended fix, broke Remote Potatoes because it was no more possible to control the signing. So it is always signed, so the relay versus LDAP, for example, won't work anymore. But it still works where SMB signing is not required. For example, SMB, HTTP, SMB signing is not required, but normally the default is on domain controller, yes, but on file server and so on, we leave the default, which is not signed. So you can do, a malicious actor can do a lot of nasty things, still can do a lot of nasty things with Remote Potatoes 0. So move on, on Local Potato. This is a curious story, because it's kind of, I wouldn't call it a bug, but again, it's by design. In the local and telemetry authentication, so we are again speaking about local, local and telemetry authentication is a particular authentication, it's a loopback local authentication, there is a reserved field, which is called reserved field, that is very interesting, and thanks to our friend Ilad Shamir, which gave us this hint, we tried to understand if it is possible somehow to abuse this field, because we had in mind a kind of swapping, and this is what we did. So in the local authentication, the reserved field references the LSAS context, where the user should, where the authentication should occur, associate and occur. So the idea is, why not triggering the authentication of a privileged user, of a system account, swap the context with a user under our control, and then authenticate to another server, to another service running on the same machine, because it's always a local privilege escalation, and that was what we had in mind. First of all, we trigger a system authentication, and we know how to do it. We want to target, for example, the local SMB server,


chunk_text:
  story, because it's kind of, I wouldn't call it a bug, but again, it's by design. In the local and telemetry authentication, so we are again speaking about local, local and telemetry authentication is a particular authentication, it's a loopback local authentication, there is a reserved field, which is called reserved field, that is very interesting, and thanks to our friend Ilad Shamir, which gave us this hint, we tried to understand if it is possible somehow to abuse this field, because we had in mind a kind of swapping, and this is what we did. So in the local authentication, the reserved field references the LSAS context, where the user should, where the authentication should occur, associate and occur. So the idea is, why not triggering the authentication of a privileged user, of a system account, swap the context with a user under our control, and then authenticate to another server, to another service running on the same machine, because it's always a local privilege escalation, and that was what we had in mind. First of all, we trigger a system authentication, and we know how to do it. We want to target, for example, the local SMB server, and perform an arbitrary file write with system privileges, which is really the key to the kingdom. We had to overcome some anti-reflection mechanisms, so we have to specify an SPN, and once everything is set up, we intercept this authentication, we magically swap them, and then what would happen? That we are able to authenticate as a system to the SMB server, and then once you have an arbitrary file write, it's up to you to understand how you could abuse it. For example, we hijacked the printconfig.dll in the printer service, and we were able to use our malicious DLL to get a shell, for example, as a system. So how does this work? We have, first of all, our privileged client, and we trigger the authentication of our privileged client, and we associate it with context, let's say A. Then we have also a client process under our control, which tries to authenticate versus the server service, for example, the SMB server, and our client gets back the context B. Then we swap the context, so that the privileged client will associate with context B, and our client contacts with context A. And at the end, if


chunk_text:
  and perform an arbitrary file write with system privileges, which is really the key to the kingdom. We had to overcome some anti-reflection mechanisms, so we have to specify an SPN, and once everything is set up, we intercept this authentication, we magically swap them, and then what would happen? That we are able to authenticate as a system to the SMB server, and then once you have an arbitrary file write, it's up to you to understand how you could abuse it. For example, we hijacked the printconfig.dll in the printer service, and we were able to use our malicious DLL to get a shell, for example, as a system. So how does this work? We have, first of all, our privileged client, and we trigger the authentication of our privileged client, and we associate it with context, let's say A. Then we have also a client process under our control, which tries to authenticate versus the server service, for example, the SMB server, and our client gets back the context B. Then we swap the context, so that the privileged client will associate with context B, and our client contacts with context A. And at the end, if everything works fine, the privileged client will authenticate against the server service, SMB in this case, and the client process will authenticate against our server service. Okay, I have also a video demonstrating this. You see, I have here a standard user without particular privileges, and my goal is to overwrite the printconfig.dll. Okay, I get no output here. Something strange happening. No. Okay, let's do it another way. Okay. Okay. It's not easy now, but... Ah, sorry. Okay, we skip the video for now, and then we'll see. So, extend this display. Okay. Hmm. It's frozen. Sorry, but... It's more than the demo effect. It's always Windows, no problem. Okay. Okay. Something is not working because... I still... Okay. Okay, without showing the video, but here you get it. I am able, with our local potato exploit, to overwrite the DLL, then I instantiate the object, and I get back a system shell because in my DLL I put the instruction for returning a shell. That's all. That's clearly... No problem. That's clearly a privilege escalation, obviously. And... If I can get out of this video. And clearly Microsoft fixed it with this CVE. And what Microsoft did is


chunk_text:
  everything works fine, the privileged client will authenticate against the server service, SMB in this case, and the client process will authenticate against our server service. Okay, I have also a video demonstrating this. You see, I have here a standard user without particular privileges, and my goal is to overwrite the printconfig.dll. Okay, I get no output here. Something strange happening. No. Okay, let's do it another way. Okay. Okay. It's not easy now, but... Ah, sorry. Okay, we skip the video for now, and then we'll see. So, extend this display. Okay. Hmm. It's frozen. Sorry, but... It's more than the demo effect. It's always Windows, no problem. Okay. Okay. Something is not working because... I still... Okay. Okay, without showing the video, but here you get it. I am able, with our local potato exploit, to overwrite the DLL, then I instantiate the object, and I get back a system shell because in my DLL I put the instruction for returning a shell. That's all. That's clearly... No problem. That's clearly a privilege escalation, obviously. And... If I can get out of this video. And clearly Microsoft fixed it with this CVE. And what Microsoft did is that... This is the reverse engineering of the fix which was done in this DLL. If the caller is from an unverified source, and this flag is set by the TComp client, and if the SPN set is set, the SPN is deleted, so the anti-reflection mechanism won't work, because I have no SPN, and the exploit breaks. So, but... It still works against HTTP. WebDAV, it's a very, very edge case, but it still works. Or, versus custom authentication, which uses the security provider. And Microsoft did not want to fix the second one, because we reported already the second one. They said, no, but this is too complicated, so it's an edge case, so you have to protect your endpoint, you have to use extended protection, blah, blah, blah, blah, blah, blah, and it is not fixed. So, if you go on my blog post, I think I published also the... No, the latest local potato source code is also for HTTP, so you can try it at home, and see that it still works. Then comes fake potato. Fake potato is the one with the asterisk, because it was discovered by me three months ago, let's say


chunk_text:
  that... This is the reverse engineering of the fix which was done in this DLL. If the caller is from an unverified source, and this flag is set by the TComp client, and if the SPN set is set, the SPN is deleted, so the anti-reflection mechanism won't work, because I have no SPN, and the exploit breaks. So, but... It still works against HTTP. WebDAV, it's a very, very edge case, but it still works. Or, versus custom authentication, which uses the security provider. And Microsoft did not want to fix the second one, because we reported already the second one. They said, no, but this is too complicated, so it's an edge case, so you have to protect your endpoint, you have to use extended protection, blah, blah, blah, blah, blah, blah, and it is not fixed. So, if you go on my blog post, I think I published also the... No, the latest local potato source code is also for HTTP, so you can try it at home, and see that it still works. Then comes fake potato. Fake potato is the one with the asterisk, because it was discovered by me three months ago, let's say so, and it's a local privilege escalation, still waiting for Microsoft fix, so, unfortunately, I cannot spoil that much. It's not exactly a potato technique, so it's something a little bit different, and it's cool, because it's logic pack, I think it was there from Windows 2000, so it's something that, I don't know why it was never found, and because it requires an unexpected prerequisite, but which is not that strange, so, and when I discover this, no, it's not possible, it's something that fucked up on my machine, and Microsoft confirmed that it is a security boundary violation, so it has to be fixed. I have a video, I don't know, I pray the God, but before showing you the video, I obviously asked to Microsoft, and they told me, okay, send us the video, in order to avoid the usual drama, so send us the video, and we will tell you if it's okay or not, and you can see the mail, they told me, okay, you can show the video, but do not spoil other things, so I will only show you the video, and I won't talk. Will it work now? That's a good question.


chunk_text:
  so, and it's a local privilege escalation, still waiting for Microsoft fix, so, unfortunately, I cannot spoil that much. It's not exactly a potato technique, so it's something a little bit different, and it's cool, because it's logic pack, I think it was there from Windows 2000, so it's something that, I don't know why it was never found, and because it requires an unexpected prerequisite, but which is not that strange, so, and when I discover this, no, it's not possible, it's something that fucked up on my machine, and Microsoft confirmed that it is a security boundary violation, so it has to be fixed. I have a video, I don't know, I pray the God, but before showing you the video, I obviously asked to Microsoft, and they told me, okay, send us the video, in order to avoid the usual drama, so send us the video, and we will tell you if it's okay or not, and you can see the mail, they told me, okay, you can show the video, but do not spoil other things, so I will only show you the video, and I won't talk. Will it work now? That's a good question. Okay. Oh, okay, okay, great. Oh, okay. In the first, I have an administrator connected on a session, another session, I have another user, standard user, okay, you see two sessions, now I launch my fake potato tool against the admin session, and let's see what's happened. Oops, desktop changed. But, okay. Let's get more serious, okay? So, I relaunch the tool with another mode, okay? And let's see what happens. I get back a shell of the administrator. This is clearly a privilege escalation. But, don't ask me anything, please. Okay? So, now the last one, which is the security boundary evaluation from remote. So, the idea behind is very simple. Instead of triggering a local com server, why not triggering a remote com server? This would be a great remote local privilege escalation. Okay? In fact, obviously an external auxiliary server is required in this case for the first authentication. It's very, very simple because with just a few changes on the code by specifying the remote server and optional credentials, I should trigger the authentication of a remote server because it's in the library. I can specify all the local or the remote server. So, that would


chunk_text:
  Okay. Oh, okay, okay, great. Oh, okay. In the first, I have an administrator connected on a session, another session, I have another user, standard user, okay, you see two sessions, now I launch my fake potato tool against the admin session, and let's see what's happened. Oops, desktop changed. But, okay. Let's get more serious, okay? So, I relaunch the tool with another mode, okay? And let's see what happens. I get back a shell of the administrator. This is clearly a privilege escalation. But, don't ask me anything, please. Okay? So, now the last one, which is the security boundary evaluation from remote. So, the idea behind is very simple. Instead of triggering a local com server, why not triggering a remote com server? This would be a great remote local privilege escalation. Okay? In fact, obviously an external auxiliary server is required in this case for the first authentication. It's very, very simple because with just a few changes on the code by specifying the remote server and optional credentials, I should trigger the authentication of a remote server because it's in the library. I can specify all the local or the remote server. So, that would be great because once I have captured the authentication NTLM Kerberos, I could then relay it. And this is also a great opportunity for Kerberos because I forgot to tell you that it is possible to relay Kerberos authentication under certain conditions. If you have the control of the service principal name, you can perform a Kerberos relay. And this is the perfect scenario because I am able in my fake OXID resolver to specify the SPN and so I can relay also the Kerberos authentication. But there is a great but. Non-admin users generally cannot instantiate remote objects. So, to instantiate, to create a COGET instance on the remote, you need domain admin or local admin rights. So, any chance? So, I started looking at the DCOM configurations and so on in order to find vulnerable DCOM server. And the first one I found, I called it ADCS Squares Potato, which is related to the certification service. So, on the server where the ADCS services are installed, there is this group, the Certificate DCOM Access Group, which contains the authenticated users, everyone. This is needed because users or computers should be able to request and enroll certificates via DCOM.


chunk_text:
  be great because once I have captured the authentication NTLM Kerberos, I could then relay it. And this is also a great opportunity for Kerberos because I forgot to tell you that it is possible to relay Kerberos authentication under certain conditions. If you have the control of the service principal name, you can perform a Kerberos relay. And this is the perfect scenario because I am able in my fake OXID resolver to specify the SPN and so I can relay also the Kerberos authentication. But there is a great but. Non-admin users generally cannot instantiate remote objects. So, to instantiate, to create a COGET instance on the remote, you need domain admin or local admin rights. So, any chance? So, I started looking at the DCOM configurations and so on in order to find vulnerable DCOM server. And the first one I found, I called it ADCS Squares Potato, which is related to the certification service. So, on the server where the ADCS services are installed, there is this group, the Certificate DCOM Access Group, which contains the authenticated users, everyone. This is needed because users or computers should be able to request and enroll certificates via DCOM. So, this is clearly something by default. So, users can activate these applications from remote. As you can see, the Certificate DCOM services have local and remote activation. The certification service DCOM application impersonates the system account. So, via the network, it's the computer account and is activable by everyone, every authenticated user. So, what is the idea behind? Very, very simple again. It's just activating this object via the potato technique that requires the authentication of the server and we will relay this authentication. So, what can we do when we have the authentication of the certificate server? I think we can do a lot of cool things because this is a Tier 0 computer account. This one was discovered also before me, some time before, by another Chinese researcher. Unfortunately, I'm horrible in spelling, so I just say Chinese researchers. It was partially fixed with this CDA. As you can see, again, the concept is always the same. I have a standard user. I request the authentication. The first IP is the IP address of the certification service. And then I have my redirector where also NTLM relay is running. I pass my credentials and as you can


chunk_text:
  So, this is clearly something by default. So, users can activate these applications from remote. As you can see, the Certificate DCOM services have local and remote activation. The certification service DCOM application impersonates the system account. So, via the network, it's the computer account and is activable by everyone, every authenticated user. So, what is the idea behind? Very, very simple again. It's just activating this object via the potato technique that requires the authentication of the server and we will relay this authentication. So, what can we do when we have the authentication of the certificate server? I think we can do a lot of cool things because this is a Tier 0 computer account. This one was discovered also before me, some time before, by another Chinese researcher. Unfortunately, I'm horrible in spelling, so I just say Chinese researchers. It was partially fixed with this CDA. As you can see, again, the concept is always the same. I have a standard user. I request the authentication. The first IP is the IP address of the certification service. And then I have my redirector where also NTLM relay is running. I pass my credentials and as you can see, everything was fine. This is the dump of the NTLM messages and at the end, I get the authentication of the certificate server. So, what can I do now? Relay it. We have a problem because signing is now enabled, so we cannot relay versus LDAP or whatever. And we could relay against the HTTP Web Enroll Service because we then request a certificate of the ADCS server. And as you can imagine, if I have the client, the certificate for authenticating as the certificate server service, I'm done because I can perform code execution on the certificate server machine, back up the public and the private key, forge fake certificates for whatever user I want, and take over the domain. But unfortunately, you cannot relay back NTLM authentication. So, I cannot relay back the authentication to the certificate server itself. So, yeah, it's really limited. But wait, there is a great opportunity with Kéberos because with Kéberos, you can relay back the HTTP. So, the server can relay back the authentication to itself via the network if I use HTTP. And this is interesting because if I don't have extended protection enabled or I do not require SSL,


chunk_text:
  see, everything was fine. This is the dump of the NTLM messages and at the end, I get the authentication of the certificate server. So, what can I do now? Relay it. We have a problem because signing is now enabled, so we cannot relay versus LDAP or whatever. And we could relay against the HTTP Web Enroll Service because we then request a certificate of the ADCS server. And as you can imagine, if I have the client, the certificate for authenticating as the certificate server service, I'm done because I can perform code execution on the certificate server machine, back up the public and the private key, forge fake certificates for whatever user I want, and take over the domain. But unfortunately, you cannot relay back NTLM authentication. So, I cannot relay back the authentication to the certificate server itself. So, yeah, it's really limited. But wait, there is a great opportunity with Kéberos because with Kéberos, you can relay back the HTTP. So, the server can relay back the authentication to itself via the network if I use HTTP. And this is interesting because if I don't have extended protection enabled or I do not require SSL, I can request a certificate. And this is the screenshot with my modified version of the great Kéberos relay tool where I target the Web Enrollment Service. My DECOM host is, again, the ADCS web server. So, I trigger the authentication, relay it back, request a certificate, and obtain the certificate for client authentication of the certificate server. And I'm done. So, yeah. And therefore, we should always use extended protection, blah, blah, blah, because this still works. So, you know if you don't use these countermeasures, you are at your own risk. But I didn't stop here because digging further into the DECOM, I found these two groups. I call them the forgotten groups, and this leads me to remote silver potato. We have these two groups which are built in, I say not so well-known groups, which are the distributed com users group and the performance com users groups. From Microsoft description, we understand that they can somehow interact with the DECOM server, and that is interesting. So, members of these two groups can launch and activate DECOM services from local and remote. So, not only activate, because activate means that the service needs to be running, and


chunk_text:
  I can request a certificate. And this is the screenshot with my modified version of the great Kéberos relay tool where I target the Web Enrollment Service. My DECOM host is, again, the ADCS web server. So, I trigger the authentication, relay it back, request a certificate, and obtain the certificate for client authentication of the certificate server. And I'm done. So, yeah. And therefore, we should always use extended protection, blah, blah, blah, because this still works. So, you know if you don't use these countermeasures, you are at your own risk. But I didn't stop here because digging further into the DECOM, I found these two groups. I call them the forgotten groups, and this leads me to remote silver potato. We have these two groups which are built in, I say not so well-known groups, which are the distributed com users group and the performance com users groups. From Microsoft description, we understand that they can somehow interact with the DECOM server, and that is interesting. So, members of these two groups can launch and activate DECOM services from local and remote. So, not only activate, because activate means that the service needs to be running, and launch means that I can start the service from remote. So, the performance local users group and distributed com users group can do these things. This is cool. Now we have to find a service which can be launched, activated by these users, and which has an authentication which could be useful for us. And I found this object, the SPPUI object interactive class. It's related to the Windows license service, which is the perfect candidate because it runs as an interactive user, and it can be activated and launched by everyone. That does not mean that it's by everyone, because then you have the limits by the DECOM and the members of the DECOM performance local users group. So, this is a very, very interesting scenario. So, by triggering this service, we should get back the authentication of the interactive user connected on some session. If you are a member of this group, it's not correct to call them domain, but on the domain controllers built-in group, you can imagine that this could be very, very dangerous because normally, on a domain controller, the domain admin logs in. So, if you could trigger the authentication of the domain admin,


chunk_text:
  launch means that I can start the service from remote. So, the performance local users group and distributed com users group can do these things. This is cool. Now we have to find a service which can be launched, activated by these users, and which has an authentication which could be useful for us. And I found this object, the SPPUI object interactive class. It's related to the Windows license service, which is the perfect candidate because it runs as an interactive user, and it can be activated and launched by everyone. That does not mean that it's by everyone, because then you have the limits by the DECOM and the members of the DECOM performance local users group. So, this is a very, very interesting scenario. So, by triggering this service, we should get back the authentication of the interactive user connected on some session. If you are a member of this group, it's not correct to call them domain, but on the domain controllers built-in group, you can imagine that this could be very, very dangerous because normally, on a domain controller, the domain admin logs in. So, if you could trigger the authentication of the domain admin, well, that's interesting. So, how does this work? We have an attacker, which is a member of the DECOM users or performance log users group, and then we have a V Team connected on a domain controller. So, again, with the potato technique, I trigger the authentication with the CLS ID of the SPP UI service, which triggers the V Team connected on a session to authenticate to my endpoint. Because, as we saw, we will perform an authenticated resolve-auxit call. We are able to intercept this authentication, in this case from the domain admin, and use it. We can also return a string binding, which contains the port and an optional SPN of our fake RPC server, and we have another authenticated call, and we have the second profit. So, I did this, I tested this, and for the first one, it's okay. I was able to perform an NTLM relay attack with an impersonation level, which is what we need. In the second one, sadly, you have an identification level, which is really useless, because signing is enabled, so you can't even relay versus LDAP. I obviously reported this to Microsoft before, and initially they said it was


chunk_text:
  well, that's interesting. So, how does this work? We have an attacker, which is a member of the DECOM users or performance log users group, and then we have a V Team connected on a domain controller. So, again, with the potato technique, I trigger the authentication with the CLS ID of the SPP UI service, which triggers the V Team connected on a session to authenticate to my endpoint. Because, as we saw, we will perform an authenticated resolve-auxit call. We are able to intercept this authentication, in this case from the domain admin, and use it. We can also return a string binding, which contains the port and an optional SPN of our fake RPC server, and we have another authenticated call, and we have the second profit. So, I did this, I tested this, and for the first one, it's okay. I was able to perform an NTLM relay attack with an impersonation level, which is what we need. In the second one, sadly, you have an identification level, which is really useless, because signing is enabled, so you can't even relay versus LDAP. I obviously reported this to Microsoft before, and initially they said it was a critical finding, but then after some time, they assessed it as a moderate risk, and that does not need an immediate servicing. So, I can talk about this, okay? Okay, I have the video. Finger crossed. It works, great. So, I have my user, standard user, and a member of this, let's say, domain, distributed com users group. On the other, then I am here in the worst scenario, because I have NTLM V1 enabled. So, in NTLM relay, I will remove the message integrity check and disable signing, okay? I launch my tool, where I specify the domain controller address, again, my redirector and the host where NTLM relay is running, and the session, okay? Once I launch it, as you can see at the end, I am able to get authentication administrator. I will forward that indication to NTLM relay, which will forward it to LDAP, which will create a user account with DC sync rights. So, from a standard user, I took over the domain. That's something that... I don't know why they did... They said, no, no, it's not that... Because in my job, because this is a hobby, in my job, I do active


chunk_text:
  a critical finding, but then after some time, they assessed it as a moderate risk, and that does not need an immediate servicing. So, I can talk about this, okay? Okay, I have the video. Finger crossed. It works, great. So, I have my user, standard user, and a member of this, let's say, domain, distributed com users group. On the other, then I am here in the worst scenario, because I have NTLM V1 enabled. So, in NTLM relay, I will remove the message integrity check and disable signing, okay? I launch my tool, where I specify the domain controller address, again, my redirector and the host where NTLM relay is running, and the session, okay? Once I launch it, as you can see at the end, I am able to get authentication administrator. I will forward that indication to NTLM relay, which will forward it to LDAP, which will create a user account with DC sync rights. So, from a standard user, I took over the domain. That's something that... I don't know why they did... They said, no, no, it's not that... Because in my job, because this is a hobby, in my job, I do active directory assessment, and I found it at least two or three times that this group was populated by non-tier zero users. So, therefore, we should consider these two groups absolutely tier zero, until Microsoft decides to fix something. This works also on a local group, on a local server, but obviously a domain controller is much more interesting, okay? So, the next step was Kerberos. Okay, NTLM, I can't relay NTLM. Why not relaying in Kerberos? Well, here we have two problems. The first one is that original Kerberos relay tool, which is a great tool, only intercepts the first authentication, the second authentication. And the second prerequisite for performing Kerberos relay is that you have to control the SPN. So, for the first problem, I recorded Kerberos relay. It was really a long, tedious, and boring task because I had to implement a raw socket server, intercept the authentication, extract the Kerberos, and then move back and forth between DCOM and SMB. It was really... I was giving up several times, but at the end, I was able to get it working. And then we have the second one, SPN. Sadly, in the first authentication, when we return the


chunk_text:
  directory assessment, and I found it at least two or three times that this group was populated by non-tier zero users. So, therefore, we should consider these two groups absolutely tier zero, until Microsoft decides to fix something. This works also on a local group, on a local server, but obviously a domain controller is much more interesting, okay? So, the next step was Kerberos. Okay, NTLM, I can't relay NTLM. Why not relaying in Kerberos? Well, here we have two problems. The first one is that original Kerberos relay tool, which is a great tool, only intercepts the first authentication, the second authentication. And the second prerequisite for performing Kerberos relay is that you have to control the SPN. So, for the first problem, I recorded Kerberos relay. It was really a long, tedious, and boring task because I had to implement a raw socket server, intercept the authentication, extract the Kerberos, and then move back and forth between DCOM and SMB. It was really... I was giving up several times, but at the end, I was able to get it working. And then we have the second one, SPN. Sadly, in the first authentication, when we return the string bindings, even if you return an SPN, the SPN will always be rpcss slash the server where our socket redirector is listening because it's from where it's coming from. So, no chance. Then again, thanks to a trick from James Forshaw, we can bypass these SPN limitations by adding a forged DNS name. Because the Kerberos security provider extension supports a special format for the SPN, which includes the target info. So, the syntax is the following. Service class slash server, which is the classic SPN, plus the base64 encoded target information. And Kerberos will ask for a service ticket service server class, server class server. And the auxet resolver will try to contact a server, which is server plus the base64 address. And the shortest base64 target info address is this one, which corresponds to a completely empty target information. But the security provider will happily accept it. So, what I did is add the DNS record with this strange name, because normally standard domain users can perform secure DNS updates. And then relay the application request ticket to a target server on behalf of the user, in this case the domain admin. Again, this is the scenario.


chunk_text:
  string bindings, even if you return an SPN, the SPN will always be rpcss slash the server where our socket redirector is listening because it's from where it's coming from. So, no chance. Then again, thanks to a trick from James Forshaw, we can bypass these SPN limitations by adding a forged DNS name. Because the Kerberos security provider extension supports a special format for the SPN, which includes the target info. So, the syntax is the following. Service class slash server, which is the classic SPN, plus the base64 encoded target information. And Kerberos will ask for a service ticket service server class, server class server. And the auxet resolver will try to contact a server, which is server plus the base64 address. And the shortest base64 target info address is this one, which corresponds to a completely empty target information. But the security provider will happily accept it. So, what I did is add the DNS record with this strange name, because normally standard domain users can perform secure DNS updates. And then relay the application request ticket to a target server on behalf of the user, in this case the domain admin. Again, this is the scenario. User, member of these groups. Victim, connected domain controller. And the target server, where I want to access resources on behalf of the victim. So, what happens? Again, I perform, I trigger the authentication and then in the socket address I specify this name, because I created this DNS name. The victim will ask for a service ticket RPSS slash target. It will try to authenticate against me with this application request ticket. The attacker will simply forward this ticket to the destination server. And relay is successful. So, just to demonstrate to you that it does not only work on PowerPoint, I have another demo. Okay. Oh, it works, great. So, I create IDCS, dash MyLab is my IDCS server, okay? And this is the... Okay, sorry. Okay. Okay. So, with the Invoke DNS update tool I create this DNS record. Okay, now I have it. I capture the traffic just to show you that it is what was expected. I launch my Silver Potato tool targeting... In this case, I want to target the SMB server of the IDCS server. Okay? With this strange redirect host. And as you can see, I want to dump the local sum


chunk_text:
  User, member of these groups. Victim, connected domain controller. And the target server, where I want to access resources on behalf of the victim. So, what happens? Again, I perform, I trigger the authentication and then in the socket address I specify this name, because I created this DNS name. The victim will ask for a service ticket RPSS slash target. It will try to authenticate against me with this application request ticket. The attacker will simply forward this ticket to the destination server. And relay is successful. So, just to demonstrate to you that it does not only work on PowerPoint, I have another demo. Okay. Oh, it works, great. So, I create IDCS, dash MyLab is my IDCS server, okay? And this is the... Okay, sorry. Okay. Okay. So, with the Invoke DNS update tool I create this DNS record. Okay, now I have it. I capture the traffic just to show you that it is what was expected. I launch my Silver Potato tool targeting... In this case, I want to target the SMB server of the IDCS server. Okay? With this strange redirect host. And as you can see, I want to dump the local sum account database and I was able to dump the admin hash. Okay? And as you can see, the SPN is the one we expected. And... This is all the traffic for the remote registry access, dumping the sum database, etc. Once you have, again, the hash of the local administrator, you can log on, okay? Again, perform a backup of the private key. Elevate to system, perform the backup of private key, etc. And you're done. So, you have, again, another possibility. So... We are at the conclusion. Okay, perfect. What can I say? First of all, that with Potatoes, we break safety and security boundaries. Okay? Most MS fixes were already partial or even not implemented because it's by default. Future NTLM disablement will stop some relay attacks, but remember that if you have control over SPN, you can relay cables. The question is, will Potatoes be still alive and kicking? Who knows? Maybe we should find a Potato in the cloud, but it's not for me. So... Second conclusion for the defenders. So, because many of these attack paths at the end lead to relaying the authentication. So, Microsoft always tells us you have to disable NTLM because


chunk_text:
  account database and I was able to dump the admin hash. Okay? And as you can see, the SPN is the one we expected. And... This is all the traffic for the remote registry access, dumping the sum database, etc. Once you have, again, the hash of the local administrator, you can log on, okay? Again, perform a backup of the private key. Elevate to system, perform the backup of private key, etc. And you're done. So, you have, again, another possibility. So... We are at the conclusion. Okay, perfect. What can I say? First of all, that with Potatoes, we break safety and security boundaries. Okay? Most MS fixes were already partial or even not implemented because it's by default. Future NTLM disablement will stop some relay attacks, but remember that if you have control over SPN, you can relay cables. The question is, will Potatoes be still alive and kicking? Who knows? Maybe we should find a Potato in the cloud, but it's not for me. So... Second conclusion for the defenders. So, because many of these attack paths at the end lead to relaying the authentication. So, Microsoft always tells us you have to disable NTLM because it's dangerous, etc., etc., etc. But, as we can see, Kerberos can be relayed too. So, the only way is to protect our endpoints. So, I hope you enjoyed my talk. Sadly, I had some problems, but... And... Thank you! Thank you very, very much for this interesting talk. And I guess there will be questions in the... Yeah, back there. Some of the... Thank you. So, some of the attacks which you were talking about were using the web dev or web client service. And, of course, one of the countermeasures would be to disable this service. Have you seen any dependencies on this service? Like, what could go wrong if you disable it? Okay, probably... The only attack I performed via local potato expat, via web dev, was with local potato to demonstrate that via HTTP, it was not fixed. Obviously, it's an edge case. Via HTTP. So, I configured a web dev server in order to have an arbitrary write via web dev HTTP. So, this is... The other attacks have nothing to do with web dev. It's versus SMB or whatever. Or versus the web enrollment service. This is just to show that there is still


chunk_text:
  it's dangerous, etc., etc., etc. But, as we can see, Kerberos can be relayed too. So, the only way is to protect our endpoints. So, I hope you enjoyed my talk. Sadly, I had some problems, but... And... Thank you! Thank you very, very much for this interesting talk. And I guess there will be questions in the... Yeah, back there. Some of the... Thank you. So, some of the attacks which you were talking about were using the web dev or web client service. And, of course, one of the countermeasures would be to disable this service. Have you seen any dependencies on this service? Like, what could go wrong if you disable it? Okay, probably... The only attack I performed via local potato expat, via web dev, was with local potato to demonstrate that via HTTP, it was not fixed. Obviously, it's an edge case. Via HTTP. So, I configured a web dev server in order to have an arbitrary write via web dev HTTP. So, this is... The other attacks have nothing to do with web dev. It's versus SMB or whatever. Or versus the web enrollment service. This is just to show that there is still a possibility. Imagine that you have a web application but you need to have local access and then you are able to authenticate on this web application a system account. So, depending on how it is configured, you could do nasty things. But it's really an edge case. Okay, thanks. But still, have you seen any dependencies on the web dev service, web dev client? Like any Windows component or third-party application actually using it, requiring it? No. To be honest, no. Thanks. But maybe it's just limited to my experience. Thanks for a great talk. Are there any other questions? Okay, then. Thank you again. Or it was too complicated or it was really easy. So, no questions. I go for the second one. Thank you.


chunk_text:
  a possibility. Imagine that you have a web application but you need to have local access and then you are able to authenticate on this web application a system account. So, depending on how it is configured, you could do nasty things. But it's really an edge case. Okay, thanks. But still, have you seen any dependencies on the web dev service, web dev client? Like any Windows component or third-party application actually using it, requiring it? No. To be honest, no. Thanks. But maybe it's just limited to my experience. Thanks for a great talk. Are there any other questions? Okay, then. Thank you again. Or it was too complicated or it was really easy. So, no questions. I go for the second one. Thank you.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=yKY7Bvpb45M", "title": "Orange Is The New Black - Fish_, Cherry & Stef", "description": "", "channel_url": "https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA", "duration": 115, "channel": "OrangeCon", "uploader": "OrangeCon", "upload_date": "20240909" } This text was transcribed using whisper model: large-v2 Whoa. I hadn't expected this one. About a year ago, the three of us, we thought, you know, let's do something for the community and start a conference. We did it before, and we thought, you know, let's do it again. And the main reason why we did it is, well, you know all the reasons, there wasn't anything anymore, so we thought, let's kick it off again. It took a little bit of time to get everything running, I have to say. So we were a little bit cautious on the amount. So we thought about, let's aim on about 120 people, let's make it a little bit smaller in intonim, and then we turned up with 300 people. Woo! And the main important part is actually this is not possible only because we started and we were crazy enough to put hours in it. It's possible because you guys are trusting us to put up a nice conference. And so I want to thank you already in advance that you are able to make this possible. We're not going to make it very long for now because we're doing a closing with much more numbers and details, etc. But there are a few things we want to say. First of all, I think we got an awesome program, and Stef has a few words for the speakers. Thank you. Just a few words to everybody who is giving a talk or giving a workshop and also all the volunteers. Thank you very much for joining us for the first conference. I'll keep it very, very brief because we all know who we are waiting for. Let's give it up for Wyn Schwartzout!


chunk_text:
  thank you already in advance that you are able to make this possible. We're not going to make it very long for now because we're doing a closing with much more numbers and details, etc. But there are a few things we want to say. First of all, I think we got an awesome program, and Stef has a few words for the speakers. Thank you. Just a few words to everybody who is giving a talk or giving a workshop and also all the volunteers. Thank you very much for joining us for the first conference. I'll keep it very, very brief because we all know who we are waiting for. Let's give it up for Wyn Schwartzout!


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=kLwndegwRyo", "title": "Cybersecurity\u2019s New Imperative: Metawar Defending The Cognitive Infrastructure - Winn Schwartau", "description": "", "channel_url": "https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA", "duration": 2965, "channel": "OrangeCon", "uploader": "OrangeCon", "upload_date": "20240909" } This text was transcribed using whisper model: large-v2 That's the shortest introduction I've ever received in my life. No, I'm done, that's it. Barry brought me here to screw with your heads a little bit, and cybersecurity's changing for you, it's changing for all of us. This is the new attack surface that you're going to have to be dealing with in the coming years. This is what is happening around the planet, and I call it meta-war. Meta-war is messing with reality. It's reality distortion, changing perceptions, rebuilding your perceptions in such a way that we kind of call it social engineering a little bit, but when you have social engineering occurring on global stages using techniques and technologies that actually go back over 100 years, the ramifications are much more profound than they ever have because we're talking about your identity, who you really are, who we really are, and it's the metaverse. We hear lots of things about the metaverse. We hear Neil Stevenson, all in, all immersive. We have the holodeck in Star Trek world. We got Ready Player One, some versions of Roblox perhaps. We got the three-body problem. All of them distort reality, and when we apply that kind of thinking to what we currently have on the internet, version 2.0, 3.0, whichever one you want to talk about, that is the metaverse. The metaverse is not about the technology of immersion. The metaverse is something much more profound and ultimately much simpler. So let me ask you, first of all, to close your eyes, please. Now imagine it's a dark night in Greece, 800 BC, beautiful warm evening. You can see the Milky Way constellation because there's no light pollution, and a bunch of gentlemen are sitting around a fire, and Homer, Homer of Greek fame, is telling us the story of the tales of brave Ulysses and Troy and the Iliad, and people are listening, engaged in what he is saying. Is that the metaverse? I argue yes, because it's immersion. Momentarily, you are immersed, even in those few words. Some of you went there, actually, and momentarily saw what I was talking about. When you read a book, you are immersed in it


chunk_text:
  have the holodeck in Star Trek world. We got Ready Player One, some versions of Roblox perhaps. We got the three-body problem. All of them distort reality, and when we apply that kind of thinking to what we currently have on the internet, version 2.0, 3.0, whichever one you want to talk about, that is the metaverse. The metaverse is not about the technology of immersion. The metaverse is something much more profound and ultimately much simpler. So let me ask you, first of all, to close your eyes, please. Now imagine it's a dark night in Greece, 800 BC, beautiful warm evening. You can see the Milky Way constellation because there's no light pollution, and a bunch of gentlemen are sitting around a fire, and Homer, Homer of Greek fame, is telling us the story of the tales of brave Ulysses and Troy and the Iliad, and people are listening, engaged in what he is saying. Is that the metaverse? I argue yes, because it's immersion. Momentarily, you are immersed, even in those few words. Some of you went there, actually, and momentarily saw what I was talking about. When you read a book, you are immersed in it until you get pulled out of that reality. You don't know that you are actually in an alternate reality until you're pulled out of it. A great story, great book, a good TV show, only reason you know you're not immersed in the TV show is when it clicks down to SD, when something goes wrong and we're pulled out of it. The metaverse is all about storytelling, the narrative inside of your head, and how long you actually become part of it and believe, absolutely believe, that it's real. Then along came radio in the 1920s, and people like this, they would look at the speaker and be immersed in the story being told by the radio plays, as they used to be called. That was entertainment. Along came 1938 in the US, Orson Welles gave a radio play called War of the Worlds. It was so immersive, so believable, that thousands of Americans took their guns, we have a few guns over there, and decided to shoot the aliens out of the sky because they believed the narrative that was being told. Then along comes TV a few years later, more immersion, and more immersion until where we


chunk_text:
  until you get pulled out of that reality. You don't know that you are actually in an alternate reality until you're pulled out of it. A great story, great book, a good TV show, only reason you know you're not immersed in the TV show is when it clicks down to SD, when something goes wrong and we're pulled out of it. The metaverse is all about storytelling, the narrative inside of your head, and how long you actually become part of it and believe, absolutely believe, that it's real. Then along came radio in the 1920s, and people like this, they would look at the speaker and be immersed in the story being told by the radio plays, as they used to be called. That was entertainment. Along came 1938 in the US, Orson Welles gave a radio play called War of the Worlds. It was so immersive, so believable, that thousands of Americans took their guns, we have a few guns over there, and decided to shoot the aliens out of the sky because they believed the narrative that was being told. Then along comes TV a few years later, more immersion, and more immersion until where we are today with the VR helmets and all of the bits and pieces to try to give us immersive experiences. It's all about the narrative, it's all about the storytelling, and ultimately this is the goal that a lot of people think is cool. Let's get completely all holodeck on ourselves, and that's called the meta point. The fundamental belief is what the metaverse thesis is all about, it's what do you believe, and it's all based upon storytelling, whether it's political, it's religious, it is entertainment, it doesn't matter, or you're immersed in a video game. It doesn't matter because you've got storytelling that has to be believable, and when it's believable, it means that we have so much information coming into our systems, into our brains, that we can't tell the difference, and it can be just momentarily, or it can be for extended periods of time when you're watching a movie, and you just, you take one breath in an hour and a half watching a movie, you have been immersed in it, and that's too much information which becomes part of the manipulation that we see the politicians, religious leaders, and some of the mythomaniacs, some


chunk_text:
  are today with the VR helmets and all of the bits and pieces to try to give us immersive experiences. It's all about the narrative, it's all about the storytelling, and ultimately this is the goal that a lot of people think is cool. Let's get completely all holodeck on ourselves, and that's called the meta point. The fundamental belief is what the metaverse thesis is all about, it's what do you believe, and it's all based upon storytelling, whether it's political, it's religious, it is entertainment, it doesn't matter, or you're immersed in a video game. It doesn't matter because you've got storytelling that has to be believable, and when it's believable, it means that we have so much information coming into our systems, into our brains, that we can't tell the difference, and it can be just momentarily, or it can be for extended periods of time when you're watching a movie, and you just, you take one breath in an hour and a half watching a movie, you have been immersed in it, and that's too much information which becomes part of the manipulation that we see the politicians, religious leaders, and some of the mythomaniacs, some of the crazies out there try to tell us stories that have no basis in consensual reality, or consensual hallucination of what we think is reality, and that manipulation works because it's about reward, and the reward, we see it with 10-year-old kids, and that reward is digital addiction to the like button that triggers a chemical response inside the brain that is pure addiction. The same chemicals are released that the ones that people that take opioids are, the same sort of feel-goods, and once we have the reward, we create the addiction, and that addiction then creates compliance because we want more and more and more of the same based upon the belief systems that the earlier portions of the storytelling are giving us, and this is the cycle of meta-war, regardless of the intent, doesn't matter, and it's all about creating realities. We have two realities, we have our consensual reality, this is a screen, this is a floor, there's a curtain, we sort of agree about that, but the subjective reality inside your head is something entirely different. How do you communicate, how do you tell somebody what you're feeling? How do you communicate to somebody


chunk_text:
  of the crazies out there try to tell us stories that have no basis in consensual reality, or consensual hallucination of what we think is reality, and that manipulation works because it's about reward, and the reward, we see it with 10-year-old kids, and that reward is digital addiction to the like button that triggers a chemical response inside the brain that is pure addiction. The same chemicals are released that the ones that people that take opioids are, the same sort of feel-goods, and once we have the reward, we create the addiction, and that addiction then creates compliance because we want more and more and more of the same based upon the belief systems that the earlier portions of the storytelling are giving us, and this is the cycle of meta-war, regardless of the intent, doesn't matter, and it's all about creating realities. We have two realities, we have our consensual reality, this is a screen, this is a floor, there's a curtain, we sort of agree about that, but the subjective reality inside your head is something entirely different. How do you communicate, how do you tell somebody what you're feeling? How do you communicate to somebody what's inside of your head when there is no reference point for the subjectivity of what you're experiencing? Regardless of whether you can communicate it or not, the influencers, the politicians, all of the people that are trying to make you believe something that may or may not be real, we call it fake news, disinformation, what have you, that's what creates a subjective reality that is dissociated from our consensual hallucination of what we believe, and how much of it is bullshit? That's for each one of us to determine. Our reality, when we look at it from cyber security terms, is built with 11.1 megabits per second of input to our brain. Think about that for a second. That's a shitty MP3 file. But our reality is created with that. Everything you see around you, everything that you're hearing, everything that you're feeling and if you're sitting next to somebody, perhaps smelling, is with 11 megabits per second of info. That's it. That's an amazing amount of computation that's going on inside of our ears, inside of our eyes. Our eyes receive with 576 million receptors. We see this and it's compressed to under 10 megabits just for


chunk_text:
  what's inside of your head when there is no reference point for the subjectivity of what you're experiencing? Regardless of whether you can communicate it or not, the influencers, the politicians, all of the people that are trying to make you believe something that may or may not be real, we call it fake news, disinformation, what have you, that's what creates a subjective reality that is dissociated from our consensual hallucination of what we believe, and how much of it is bullshit? That's for each one of us to determine. Our reality, when we look at it from cyber security terms, is built with 11.1 megabits per second of input to our brain. Think about that for a second. That's a shitty MP3 file. But our reality is created with that. Everything you see around you, everything that you're hearing, everything that you're feeling and if you're sitting next to somebody, perhaps smelling, is with 11 megabits per second of info. That's it. That's an amazing amount of computation that's going on inside of our ears, inside of our eyes. Our eyes receive with 576 million receptors. We see this and it's compressed to under 10 megabits just for the visual component. How is this possible? How can we influence this? How can the good guys use it? How can the bad guys use it to change and alter our perceptions of reality by messing around with our senses? Because that's what makes reality. We have our vestibular system, which is our balance. It's another sense that we often don't think about too much, proprioception. All that means is how do I relate to the physical world around me? How do I fit into it? Am I going to bump into somebody? And then interoception, our body has its own set of senses as well that tie to our external senses, the internal senses, external senses, and every one of them is manipulable, can be orchestrated by content. It's all about the narrative. And then in order to make things even more believable, we add feedback. And that feedback will go just to gaming, the haptic feedback. You're sitting in your racing car thing, you got the monitors sitting there, and your seat is bumping around and you're driving your car. How real is it? What does your brain think versus what your consensual hallucination says? Somebody that's watching


chunk_text:
  the visual component. How is this possible? How can we influence this? How can the good guys use it? How can the bad guys use it to change and alter our perceptions of reality by messing around with our senses? Because that's what makes reality. We have our vestibular system, which is our balance. It's another sense that we often don't think about too much, proprioception. All that means is how do I relate to the physical world around me? How do I fit into it? Am I going to bump into somebody? And then interoception, our body has its own set of senses as well that tie to our external senses, the internal senses, external senses, and every one of them is manipulable, can be orchestrated by content. It's all about the narrative. And then in order to make things even more believable, we add feedback. And that feedback will go just to gaming, the haptic feedback. You're sitting in your racing car thing, you got the monitors sitting there, and your seat is bumping around and you're driving your car. How real is it? What does your brain think versus what your consensual hallucination says? Somebody that's watching you is seeing the physical manifestation of it. You are experiencing something completely different based upon sensory inputs. And again, it's only 11 megabits, that's it. How easy is it for us to do this, for us to alter reality? And this is about the feedback mechanisms. Has anybody read the Apple patent on their new earbuds that are coming out? The patent came out last year. Anybody read it? 38 biosensors are going to be put into your ears. What are they going to do with those biosensors? They're going to know your brain waves, your emotional states, blood sugar, response, emotional response. And what are they going to do with that information? That becomes part of the feedback loop to create a more immersive experience. Is that good? Is that bad? Or is it a capability that we're going to have to deal with as cybersecurity professionals because the techniques are so similar to what we are used to? We are used to feedback mechanisms and looping around and the OODA loops in order just to make our world work in the pure cyber world. But now we add the human component to it. And when we add


chunk_text:
  you is seeing the physical manifestation of it. You are experiencing something completely different based upon sensory inputs. And again, it's only 11 megabits, that's it. How easy is it for us to do this, for us to alter reality? And this is about the feedback mechanisms. Has anybody read the Apple patent on their new earbuds that are coming out? The patent came out last year. Anybody read it? 38 biosensors are going to be put into your ears. What are they going to do with those biosensors? They're going to know your brain waves, your emotional states, blood sugar, response, emotional response. And what are they going to do with that information? That becomes part of the feedback loop to create a more immersive experience. Is that good? Is that bad? Or is it a capability that we're going to have to deal with as cybersecurity professionals because the techniques are so similar to what we are used to? We are used to feedback mechanisms and looping around and the OODA loops in order just to make our world work in the pure cyber world. But now we add the human component to it. And when we add the human component into this, we have active metacontent orchestration. That means how can I use today's technology to mess with your entire sense of reality so that you no longer can have a basis of deciding what is true, what is not true? What are you really experiencing? Are you schizophrenic? How do you tell the difference? And this is what gaming does. This is what advertising does. This is what all communications do that try to engage with the customer. That customer doesn't have to be about money. The customer is the recipient of Homer's story in Greece or reading a book after Gutenberg started printing. Very, very simple, simple ways of influencing the brain. And when we have the feedback loops completely put in with the face tracking, the eye tracking, the biosensing, what does that mean? It means that that loop knows how we react to every single bit of input. 11 megabits per second coming into our sensory inputs triggers a response. And what are we doing with that response? We're telling big tech exactly how we respond to any given stimulus. That's what advertisers count on. They want you addicted to their products by


chunk_text:
  the human component into this, we have active metacontent orchestration. That means how can I use today's technology to mess with your entire sense of reality so that you no longer can have a basis of deciding what is true, what is not true? What are you really experiencing? Are you schizophrenic? How do you tell the difference? And this is what gaming does. This is what advertising does. This is what all communications do that try to engage with the customer. That customer doesn't have to be about money. The customer is the recipient of Homer's story in Greece or reading a book after Gutenberg started printing. Very, very simple, simple ways of influencing the brain. And when we have the feedback loops completely put in with the face tracking, the eye tracking, the biosensing, what does that mean? It means that that loop knows how we react to every single bit of input. 11 megabits per second coming into our sensory inputs triggers a response. And what are we doing with that response? We're telling big tech exactly how we respond to any given stimulus. That's what advertisers count on. They want you addicted to their products by being addicted to the message, by being addicted to the narrative, the story that they're telling you, regardless of whether it's true or not, makes no difference. This is the world that we're building right now. And this is the world that cybersecurity, our field is going to be dealing with more and more and more. It's way beyond pure social engineering because we can now, with existing technology, create these emotions inside of anybody who's participating in any sort of immersive experience. Obviously, the more tech, the more immersive, the more susceptible your brain may be to external influence, you'll get more influenced by it. Some people get influenced by one TikTok video and their life changes. Some people go back to the same TikTok feeds and have to watch 100 of them every day in order to get their fix, to create one of these emotions. That's the full emotional gamut of human beings. With active content orchestration, we know how to create these. Is that a good thing? Is that a bad thing? And what can we or should the cybersecurity community do? We can read minds today. On the left is a picture that was shown


chunk_text:
  being addicted to the message, by being addicted to the narrative, the story that they're telling you, regardless of whether it's true or not, makes no difference. This is the world that we're building right now. And this is the world that cybersecurity, our field is going to be dealing with more and more and more. It's way beyond pure social engineering because we can now, with existing technology, create these emotions inside of anybody who's participating in any sort of immersive experience. Obviously, the more tech, the more immersive, the more susceptible your brain may be to external influence, you'll get more influenced by it. Some people get influenced by one TikTok video and their life changes. Some people go back to the same TikTok feeds and have to watch 100 of them every day in order to get their fix, to create one of these emotions. That's the full emotional gamut of human beings. With active content orchestration, we know how to create these. Is that a good thing? Is that a bad thing? And what can we or should the cybersecurity community do? We can read minds today. On the left is a picture that was shown to a subject in a test lab. On the right is what the brain scans showed he was thinking about. This is real. Do we want it? Do we want to be able to be able to read minds with this level of technology, this level of detail, and build it into how we perceive reality? Then, because of the feedback loops, we're going to tell Facebook, we're going to tell Google, we're going to tell big tech exactly what we're thinking. Do we want that? And is that a good thing or a bad thing? And how can we control this? Should we control it or should we just let big tech do this? This is the new attack surface, and the attack surface is your eyes, your ears, your sense of smell, all of the senses. When you have, I have vertigo. When I get too close to the edge of something, I get really quite dizzy, but I can also have it induced by watching a movie. A helicopter flies over the edge of the Grand Canyon. I tip over on my couch because of vertigo. Can I simulate it? Can I create these types of emotions,


chunk_text:
  to a subject in a test lab. On the right is what the brain scans showed he was thinking about. This is real. Do we want it? Do we want to be able to be able to read minds with this level of technology, this level of detail, and build it into how we perceive reality? Then, because of the feedback loops, we're going to tell Facebook, we're going to tell Google, we're going to tell big tech exactly what we're thinking. Do we want that? And is that a good thing or a bad thing? And how can we control this? Should we control it or should we just let big tech do this? This is the new attack surface, and the attack surface is your eyes, your ears, your sense of smell, all of the senses. When you have, I have vertigo. When I get too close to the edge of something, I get really quite dizzy, but I can also have it induced by watching a movie. A helicopter flies over the edge of the Grand Canyon. I tip over on my couch because of vertigo. Can I simulate it? Can I create these types of emotions, these visceral, physical responses? Can I create them using technology, using immersive? Of course I can. Should we be able to do this as part of what we're going to have to be deciding from policy makers across the planet? Because when we look at our technical versions of what we've been doing for 35 years, and we map it against the mind, the approach is very, very similar. When we deal with DDoS, for example, technically we understand that it's a flood of information. But how many of you have ever been overloaded with information at the end of the day and go, fuck it. I'm just going home. I'm not going to deal with it anymore. What about 10-year-olds? Are they mentally equipped to be able to recognize their own DDoS, their mental DDoS? Probably not. That's a maturity thing, and I only heard half of you recognize it, so I'm worried about some of you as well. We have all of the parallels from what we have been doing, from the field that we know, that need to be applied to the mind, need to be applied to reality distortion, because reality distortion is not only full


chunk_text:
  these visceral, physical responses? Can I create them using technology, using immersive? Of course I can. Should we be able to do this as part of what we're going to have to be deciding from policy makers across the planet? Because when we look at our technical versions of what we've been doing for 35 years, and we map it against the mind, the approach is very, very similar. When we deal with DDoS, for example, technically we understand that it's a flood of information. But how many of you have ever been overloaded with information at the end of the day and go, fuck it. I'm just going home. I'm not going to deal with it anymore. What about 10-year-olds? Are they mentally equipped to be able to recognize their own DDoS, their mental DDoS? Probably not. That's a maturity thing, and I only heard half of you recognize it, so I'm worried about some of you as well. We have all of the parallels from what we have been doing, from the field that we know, that need to be applied to the mind, need to be applied to reality distortion, because reality distortion is not only full immersion. Reality distortion creates—who won the election in the United States in 2016, the Americans or the Russians? Reality distortion because of the sheer number of people who bought into a narrative that was addictive because it made them feel good about themselves and had no basis in consensual reality agreement. We were not humans. We're not built to survive technology. Our primary goal as human beings or as dogs or as plants is only one thing—survive. That's all that we are designed to do, regardless of whether you think that there's a higher power that created us or the aliens created us or whatever it is. Our primary goal is to survive, and that's it. But we were designed to survive bears. We were designed to not drink dirty water. We were designed to survive nature, not false narratives, not technology. And we see the manifestations of all of this technology around us that we're not really sure how to deal with, and in many cases, we choose to ignore it. In the simplest terms, we have in our brains two systems. It's much more complex than that, but easily to look at is system one. It's our gut


chunk_text:
  immersion. Reality distortion creates—who won the election in the United States in 2016, the Americans or the Russians? Reality distortion because of the sheer number of people who bought into a narrative that was addictive because it made them feel good about themselves and had no basis in consensual reality agreement. We were not humans. We're not built to survive technology. Our primary goal as human beings or as dogs or as plants is only one thing—survive. That's all that we are designed to do, regardless of whether you think that there's a higher power that created us or the aliens created us or whatever it is. Our primary goal is to survive, and that's it. But we were designed to survive bears. We were designed to not drink dirty water. We were designed to survive nature, not false narratives, not technology. And we see the manifestations of all of this technology around us that we're not really sure how to deal with, and in many cases, we choose to ignore it. In the simplest terms, we have in our brains two systems. It's much more complex than that, but easily to look at is system one. It's our gut reaction. And in America, I call, I go up to my friend Hans, and I go, hi, you're an asshole. And in America, his gut reaction is to pull out a gun and shoot me. That's system one. It's that gut reaction, that visceral kind of, and we all have it all the time. And when somebody says, oh, no, that's not, well, maybe I should think about it a little. That system one is what keeps us alive. When you're walking down the street and you hear the horn from a car, your brain is automatically determining its distance because of that crazy computer, analog computer we have in our heads. Do you have a visceral reaction to jump back? Maybe, maybe not. If the car is honking at you from only 20 meters, you're going to react differently because you're going to suspect more of a threat to your existential being. It's more of a threat to your life. System two is when we actually think. Critical thinking, cogitation, discussion, debate, actually engaging our conscious minds. System one is unconscious, if you want to use Freudian terminology, William James terminology from the 19th century. System two is where


chunk_text:
  reaction. And in America, I call, I go up to my friend Hans, and I go, hi, you're an asshole. And in America, his gut reaction is to pull out a gun and shoot me. That's system one. It's that gut reaction, that visceral kind of, and we all have it all the time. And when somebody says, oh, no, that's not, well, maybe I should think about it a little. That system one is what keeps us alive. When you're walking down the street and you hear the horn from a car, your brain is automatically determining its distance because of that crazy computer, analog computer we have in our heads. Do you have a visceral reaction to jump back? Maybe, maybe not. If the car is honking at you from only 20 meters, you're going to react differently because you're going to suspect more of a threat to your existential being. It's more of a threat to your life. System two is when we actually think. Critical thinking, cogitation, discussion, debate, actually engaging our conscious minds. System one is unconscious, if you want to use Freudian terminology, William James terminology from the 19th century. System two is where we actually think about things, but here is the problem. In this incredible computer that we have in our skull, system one processes roughly 400 billion bits per second. That's a lot of numbers. Our conscious brain processes approximately four kilobits, a hundred million times less. I just ask you to think for yourself right now, who's really in charge? Is system one in charge of you or is system two in charge of you? What can an adversary, what can the bad guys do with this knowledge and with the capabilities of active meta-content orchestration in order to distort your reality? Talk to system one. Talk to system one. You ever know anybody, and certainly this is true in the US, who listens to the same god-awful radio station talk show host day after day after day after day and what happens? Even though you're not paying attention, it's in the background, what's happening? System one is being primed with a belief system automatically. It's being primed for you to believe and accept what is being impinged upon your subconscious. Our subconscious creates our behavior, creates that gut reaction. System two is supposed to save our asses, doesn't work


chunk_text:
  we actually think about things, but here is the problem. In this incredible computer that we have in our skull, system one processes roughly 400 billion bits per second. That's a lot of numbers. Our conscious brain processes approximately four kilobits, a hundred million times less. I just ask you to think for yourself right now, who's really in charge? Is system one in charge of you or is system two in charge of you? What can an adversary, what can the bad guys do with this knowledge and with the capabilities of active meta-content orchestration in order to distort your reality? Talk to system one. Talk to system one. You ever know anybody, and certainly this is true in the US, who listens to the same god-awful radio station talk show host day after day after day after day and what happens? Even though you're not paying attention, it's in the background, what's happening? System one is being primed with a belief system automatically. It's being primed for you to believe and accept what is being impinged upon your subconscious. Our subconscious creates our behavior, creates that gut reaction. System two is supposed to save our asses, doesn't work all the time, especially when system one becomes so much believing in whatever the narrative is coming from the talk show host, coming from the politician, coming from a religious, spiritual faith, doesn't matter. Enough input of repetition over and over, talking to system one, makes it part of your innate belief system, true or not true. In order for us to survive, we have some built-in mechanisms and the ones on the left, we're familiar with those, flight, fight, freeze, happened to me, I was in Japan, I went to one of those VR things and all immersed in the suit and what have you and they put it on and they give me a long 20-minute lecture on how this whole thing works, right? In Japanese. So I go in and it's this huge warehouse space and it's black, all the walls, floors are black and there's white lines just like the holodeck on Star Trek and I knew, even though I don't speak a word of Japanese other than sushi and sake, was 10, 9 and suddenly the world changed, my belief system completely changed. I was now standing three stories up on a wobbly scaffolding. Every


chunk_text:
  all the time, especially when system one becomes so much believing in whatever the narrative is coming from the talk show host, coming from the politician, coming from a religious, spiritual faith, doesn't matter. Enough input of repetition over and over, talking to system one, makes it part of your innate belief system, true or not true. In order for us to survive, we have some built-in mechanisms and the ones on the left, we're familiar with those, flight, fight, freeze, happened to me, I was in Japan, I went to one of those VR things and all immersed in the suit and what have you and they put it on and they give me a long 20-minute lecture on how this whole thing works, right? In Japanese. So I go in and it's this huge warehouse space and it's black, all the walls, floors are black and there's white lines just like the holodeck on Star Trek and I knew, even though I don't speak a word of Japanese other than sushi and sake, was 10, 9 and suddenly the world changed, my belief system completely changed. I was now standing three stories up on a wobbly scaffolding. Every part of my being believed it. My system two is saying, no, this isn't real. My system one is going, yes, it is. And I absolutely, completely froze. So I wasted $50 by not playing and shooting too many aliens because I was scared out of my mind. That is complete immersion. That changes everything, even though I consciously knew it wasn't real. Every part of my being said something completely different. This is how we react to things automatically. This is all that we have in our reaction systems which makes the meta-content orchestrators, the bad guys, makes it really easy for them to be able to focus on any of these because our relationship with technology is not natural. We were not designed to do this. Some people love tech, hate tech, we all have been through the love-hate relationships with it. Who has never cursed technology? Hans, come on. Everything always works for you, right? Okay, Hans, you can talk to him. Never has anything gone wrong. This is our relationship with tech. And this is what we expect from tech. This is sort of what we've been told over the years, whether it was early Microsoft


chunk_text:
  part of my being believed it. My system two is saying, no, this isn't real. My system one is going, yes, it is. And I absolutely, completely froze. So I wasted $50 by not playing and shooting too many aliens because I was scared out of my mind. That is complete immersion. That changes everything, even though I consciously knew it wasn't real. Every part of my being said something completely different. This is how we react to things automatically. This is all that we have in our reaction systems which makes the meta-content orchestrators, the bad guys, makes it really easy for them to be able to focus on any of these because our relationship with technology is not natural. We were not designed to do this. Some people love tech, hate tech, we all have been through the love-hate relationships with it. Who has never cursed technology? Hans, come on. Everything always works for you, right? Okay, Hans, you can talk to him. Never has anything gone wrong. This is our relationship with tech. And this is what we expect from tech. This is sort of what we've been told over the years, whether it was early Microsoft days, early DOS days, DEC, IBM, it doesn't matter. We're told the same thing over and over again by big tech. And it's always, the next generation will even be better. The next generation will be more immersive. Do we want that? Do we need that? And is it a good thing or a bad thing to have? These are the disconnects. These are the attack vectors that are being used and will continue to be used by whoever is playing, whoever wants to convince you of something. Is it the advertiser who says that you need a better baby food formula for your kid or you're a bad parent? Or you have to drive a certain kind of car because it is the best because of these reasons that are trying to convince you. It's all about believability. And the advertisers over the years, they know how to do this. They've been messing with our minds for a long damn time. Now we're adding the technology with different motivations. These are the fundamental issues that we've got that are really messing with us. And we hear constantly about disinformation. And yeah, disinformation is a big problem, absolutely. But there's


chunk_text:
  days, early DOS days, DEC, IBM, it doesn't matter. We're told the same thing over and over again by big tech. And it's always, the next generation will even be better. The next generation will be more immersive. Do we want that? Do we need that? And is it a good thing or a bad thing to have? These are the disconnects. These are the attack vectors that are being used and will continue to be used by whoever is playing, whoever wants to convince you of something. Is it the advertiser who says that you need a better baby food formula for your kid or you're a bad parent? Or you have to drive a certain kind of car because it is the best because of these reasons that are trying to convince you. It's all about believability. And the advertisers over the years, they know how to do this. They've been messing with our minds for a long damn time. Now we're adding the technology with different motivations. These are the fundamental issues that we've got that are really messing with us. And we hear constantly about disinformation. And yeah, disinformation is a big problem, absolutely. But there's something certainly a lot more fundamental than disinformation that's causing the schisms that we are seeing in society today. That was a five megabyte hard drive in 1956. Anybody still have one in their garage? God knows how much power that took. What we're dealing with is too much information. We all go through this, especially geeks. We go, that's enough. I can't take it anymore. I've got to shut it off and that's it. Can't do it. And then you freeze because we're used to receiving information so constantly. Too much information. We don't know how to filter it. How do we digest zettabytes of information? And the information age, I argue, roughly mid-1950s when we started producing massive amounts of information that are constantly coming at us. Who taught us how to filter it? Who has taught us what information is valuable, not valuable, a pain, disinformation? It's all because of too much information. And when we look at the total amount of information that we are being subjected to daily, our capacity, if we are awake and alert 24 hours a day, our capacity is 74 gigabytes of data streaming at 11 megabits. That's it. Anything beyond


chunk_text:
  something certainly a lot more fundamental than disinformation that's causing the schisms that we are seeing in society today. That was a five megabyte hard drive in 1956. Anybody still have one in their garage? God knows how much power that took. What we're dealing with is too much information. We all go through this, especially geeks. We go, that's enough. I can't take it anymore. I've got to shut it off and that's it. Can't do it. And then you freeze because we're used to receiving information so constantly. Too much information. We don't know how to filter it. How do we digest zettabytes of information? And the information age, I argue, roughly mid-1950s when we started producing massive amounts of information that are constantly coming at us. Who taught us how to filter it? Who has taught us what information is valuable, not valuable, a pain, disinformation? It's all because of too much information. And when we look at the total amount of information that we are being subjected to daily, our capacity, if we are awake and alert 24 hours a day, our capacity is 74 gigabytes of data streaming at 11 megabits. That's it. Anything beyond that, we go into overload. Or we fall into disbelief systems or a false narrative. Or we begin believing in many ways like a schizophrenic. We see something and we make something up out of it, pareidolia is what it's called. And that's what happens with information overload. How many of us have actually been to school and they taught us, here is how to filter information so you don't get overloaded? How many of us have been teaching our kids this? You had one. Okay. You got one hand out of 7,000 people. Okay. Teaching kids too much information, how do you filter it? How do we get through the noise? Something that we don't do terribly well. And when we look at the experiments that are being done, what is causing this disinformation, this stuff all around the planet, all the lies that are being told in order to create social movements, political movements, whatever they happen to be. The studies have been done. The trigger of disinformation is too much information because we don't know how to filter it. We don't know how to filter it at all. We're not taught that way. We're said more and


chunk_text:
  that, we go into overload. Or we fall into disbelief systems or a false narrative. Or we begin believing in many ways like a schizophrenic. We see something and we make something up out of it, pareidolia is what it's called. And that's what happens with information overload. How many of us have actually been to school and they taught us, here is how to filter information so you don't get overloaded? How many of us have been teaching our kids this? You had one. Okay. You got one hand out of 7,000 people. Okay. Teaching kids too much information, how do you filter it? How do we get through the noise? Something that we don't do terribly well. And when we look at the experiments that are being done, what is causing this disinformation, this stuff all around the planet, all the lies that are being told in order to create social movements, political movements, whatever they happen to be. The studies have been done. The trigger of disinformation is too much information because we don't know how to filter it. We don't know how to filter it at all. We're not taught that way. We're said more and more. In order to be smart and successful, you have to have more information. That's almost the exact opposite because we're dealing with too much information. We can't filter it out. And what is important information? What really matters to our survival? It's a new problem. When we look at some of the studies that have been done out there and they look at, this is out of Cambridge, who is more susceptible to disinformation in the United States? It turns out to be those of the conservative political bent. By a factor of 250%, they believe bullshit easier than progressive, liberal, whatever term you want to use. And what does that mean? That means that they are targetable. They can be influenced so much more easily because of their preexisting mental system one reactions. The studies and the science is very solid on all of this. So cybersecurity people, we can help with all of this, of course. We need to learn how to coexist with technology as a species, otherwise we're going to lose. Because he who controls, they who control the technology control the narrative. The narrative for you, the narrative for society, the narrative for any


chunk_text:
  more. In order to be smart and successful, you have to have more information. That's almost the exact opposite because we're dealing with too much information. We can't filter it out. And what is important information? What really matters to our survival? It's a new problem. When we look at some of the studies that have been done out there and they look at, this is out of Cambridge, who is more susceptible to disinformation in the United States? It turns out to be those of the conservative political bent. By a factor of 250%, they believe bullshit easier than progressive, liberal, whatever term you want to use. And what does that mean? That means that they are targetable. They can be influenced so much more easily because of their preexisting mental system one reactions. The studies and the science is very solid on all of this. So cybersecurity people, we can help with all of this, of course. We need to learn how to coexist with technology as a species, otherwise we're going to lose. Because he who controls, they who control the technology control the narrative. The narrative for you, the narrative for society, the narrative for any culture or country or organization. They control that narrative. And when they control that narrative, they're using what? They're using algorithms. How many of you live algorithm free? I got one person up there who is about to commit suicide. Think about living algorithm free. Who's making the decisions for what you receive in information? It's part of that feedback loop because while they may not be sensing your particular brain waves right at the moment, or you may not have the apple buds that are sensing exactly your emotional and chemical composition moment by moment, but they do know how to influence through repetition. They do know how to influence through marketing, and they know how to do it for politics. We've seen it. And the work comes from some Russians, and I'll show you how that all ties together. Technology is not only addictive, but it's a stressor. How many of you check your battery more than twice a day? Those without... Okay, you're all raising your hands. Yeah, because we're worried. It's a stress. It's an anxiety. All of these things are about anxiety and addiction. Up on the left, how many of you ever done that?


chunk_text:
  culture or country or organization. They control that narrative. And when they control that narrative, they're using what? They're using algorithms. How many of you live algorithm free? I got one person up there who is about to commit suicide. Think about living algorithm free. Who's making the decisions for what you receive in information? It's part of that feedback loop because while they may not be sensing your particular brain waves right at the moment, or you may not have the apple buds that are sensing exactly your emotional and chemical composition moment by moment, but they do know how to influence through repetition. They do know how to influence through marketing, and they know how to do it for politics. We've seen it. And the work comes from some Russians, and I'll show you how that all ties together. Technology is not only addictive, but it's a stressor. How many of you check your battery more than twice a day? Those without... Okay, you're all raising your hands. Yeah, because we're worried. It's a stress. It's an anxiety. All of these things are about anxiety and addiction. Up on the left, how many of you ever done that? The rest of you are lying, okay. We've all done this. One way or another, this is about our addiction to the technology that is created by too much information and the control that the algorithms have over our behavior. And this is the way it is today without even looking down the line with future technologies. Now we're going to add AI to it because AI fixes everything. Well, we built AI in our own image. We don't like what we see, do we? We have a problem with the way AI... Otherwise, the global debates over it, should we allow it? Should we ban it? How do we control it? Well, we don't know that answer, but we do know that it's all about bias. We do know it's a black box. We know what we can see going in. We can see what's coming out, and we have no idea how it is being done. Just like a human being. We have an input, we have an output, and we are a black box. Come up with some answer. I'll say something. You'll give me an input. I'll say something. You give the same input to Hans


chunk_text:
  The rest of you are lying, okay. We've all done this. One way or another, this is about our addiction to the technology that is created by too much information and the control that the algorithms have over our behavior. And this is the way it is today without even looking down the line with future technologies. Now we're going to add AI to it because AI fixes everything. Well, we built AI in our own image. We don't like what we see, do we? We have a problem with the way AI... Otherwise, the global debates over it, should we allow it? Should we ban it? How do we control it? Well, we don't know that answer, but we do know that it's all about bias. We do know it's a black box. We know what we can see going in. We can see what's coming out, and we have no idea how it is being done. Just like a human being. We have an input, we have an output, and we are a black box. Come up with some answer. I'll say something. You'll give me an input. I'll say something. You give the same input to Hans here, and he'll give you something completely different. Piece of Hans bullshit. We made it to look like us, and we're not happy with this at all because we don't understand how it works. When is AI good? It's good for translating. Sometimes I use it when I travel, and I know I did try to marry some guy's dog somewhere, and that didn't exactly go well with the translator. But when close is good enough. When you have authority. When you have human interaction to be able to finally make a decision, hopefully bringing in system two thinking, because everybody else is writing and saying, no, AI is going to take care of everything. I went to the CES, and my wife bought an AI-controlled vacuum cleaner. I'm still not completely convinced because the vacuum cleaner is losing the war with my cats. And what happens when AI gets angry? I didn't like that question when I'm going to fuck with you now. How do we know? How would we ever know if AI is angry, has an emotion? Is there a Turing test for any of this shit? No. Do we need one? Yeah. We need some sort


chunk_text:
  here, and he'll give you something completely different. Piece of Hans bullshit. We made it to look like us, and we're not happy with this at all because we don't understand how it works. When is AI good? It's good for translating. Sometimes I use it when I travel, and I know I did try to marry some guy's dog somewhere, and that didn't exactly go well with the translator. But when close is good enough. When you have authority. When you have human interaction to be able to finally make a decision, hopefully bringing in system two thinking, because everybody else is writing and saying, no, AI is going to take care of everything. I went to the CES, and my wife bought an AI-controlled vacuum cleaner. I'm still not completely convinced because the vacuum cleaner is losing the war with my cats. And what happens when AI gets angry? I didn't like that question when I'm going to fuck with you now. How do we know? How would we ever know if AI is angry, has an emotion? Is there a Turing test for any of this shit? No. Do we need one? Yeah. We need some sort of discussion over being able to recognize tipping points, just like we do in cybersecurity. It's the same thing, except with a different technology, and the technology is in our minds. And today we talk about privacy, PII, personally identifiable information, and it's bad. And that's why we've got GDPR over here. We've got shitty-ass laws in the US that don't do anything, all to protect privacy. But what if PII suddenly had no value anymore because with the feedback loops and the sensors and the body tracking and eye tracking and emotion tracking technologies, I then have personally identifiable behavior, PIB. And we're already getting there. We're already seeing it. People know how to induce that you to press the like button, the buy button, the review me button. We are programmed to do this because they know how to trigger our behavior because they're monitoring our behavior. Is this a good thing? Is this a bad thing? And how do we control this from a policy standpoint at the national level and at the enterprise level? These same issues occur not only for us personally, but these are issues for the enterprise because they're security issues, except there's


chunk_text:
  of discussion over being able to recognize tipping points, just like we do in cybersecurity. It's the same thing, except with a different technology, and the technology is in our minds. And today we talk about privacy, PII, personally identifiable information, and it's bad. And that's why we've got GDPR over here. We've got shitty-ass laws in the US that don't do anything, all to protect privacy. But what if PII suddenly had no value anymore because with the feedback loops and the sensors and the body tracking and eye tracking and emotion tracking technologies, I then have personally identifiable behavior, PIB. And we're already getting there. We're already seeing it. People know how to induce that you to press the like button, the buy button, the review me button. We are programmed to do this because they know how to trigger our behavior because they're monitoring our behavior. Is this a good thing? Is this a bad thing? And how do we control this from a policy standpoint at the national level and at the enterprise level? These same issues occur not only for us personally, but these are issues for the enterprise because they're security issues, except there's a different processor involved. It's a warm, wet, hunk of wet meat versus the silicon. How do we make these all work with each other? The addictive process is a loop, just like any other OODA loop. And how do we stop it? Well, when it comes to physical addiction, they say, cut the loop, stop the process. That's what they claim. But that requires an awful lot of human endurance to be able to go through that. However, we do have the technical ability to cut some loops, don't we? What if there were no more like buttons that created digital opioids? Is that a good thing? Or do we just cut that loop for kids because it's messing with their brain's development? Cut the loop. Do you want to be influenced by which algorithm to tell you what to buy? Or should that loop be cut? Should we have the choice to live an algorithm-free life? Which algorithms do I want part of my decision-making process? Which algorithms do I not want? Why don't we have the choice? We don't have the choice because Silicon Valley's mantra is, if your product, your idea, your service is not addictive,


chunk_text:
  a different processor involved. It's a warm, wet, hunk of wet meat versus the silicon. How do we make these all work with each other? The addictive process is a loop, just like any other OODA loop. And how do we stop it? Well, when it comes to physical addiction, they say, cut the loop, stop the process. That's what they claim. But that requires an awful lot of human endurance to be able to go through that. However, we do have the technical ability to cut some loops, don't we? What if there were no more like buttons that created digital opioids? Is that a good thing? Or do we just cut that loop for kids because it's messing with their brain's development? Cut the loop. Do you want to be influenced by which algorithm to tell you what to buy? Or should that loop be cut? Should we have the choice to live an algorithm-free life? Which algorithms do I want part of my decision-making process? Which algorithms do I not want? Why don't we have the choice? We don't have the choice because Silicon Valley's mantra is, if your product, your idea, your service is not addictive, it will not get invested in. That's the world we're living in. If it's not addictive, it's not worth playing. How do we defend the cognitive immune system? We have an immune system. Humans are pretty good bullshit detectors if they're given an opportunity to do it. But an awful lot of people are living in a pure system one world where their bullshit detectors part of system two do not come into play. How do we get the immune system, mental immune system strengthened? How do we build in critical thinking? And then an idea that has been ignored is called critical ignoring. Critical ignoring. Instead of being bombarded with all of this information all the time, shouldn't the first question be, do I even give a shit? Do I care? If you ask that question first, your information overload, what's coming into your system one and system two processing will absolutely decrease. And it is the same thing we do with cybersecurity. When cybersecurity, if we see an event, we go into a pause mode. We go into a further analytic mode. We engage deeper analytic servers. Maybe bring in the sims. What's really going on here? The


chunk_text:
  it will not get invested in. That's the world we're living in. If it's not addictive, it's not worth playing. How do we defend the cognitive immune system? We have an immune system. Humans are pretty good bullshit detectors if they're given an opportunity to do it. But an awful lot of people are living in a pure system one world where their bullshit detectors part of system two do not come into play. How do we get the immune system, mental immune system strengthened? How do we build in critical thinking? And then an idea that has been ignored is called critical ignoring. Critical ignoring. Instead of being bombarded with all of this information all the time, shouldn't the first question be, do I even give a shit? Do I care? If you ask that question first, your information overload, what's coming into your system one and system two processing will absolutely decrease. And it is the same thing we do with cybersecurity. When cybersecurity, if we see an event, we go into a pause mode. We go into a further analytic mode. We engage deeper analytic servers. Maybe bring in the sims. What's really going on here? The brain works exactly the same way. If we know how to turn on that pause button, and it's all about creating a momentary delay. Just like your parents said is when you were a kid, you get wrong. Take a breath. Count to 10. Think about it. Or as women say about men, give them a couple days, they'll come around. It's about that pause to engage system two thinking so that our automatic system one stuff is not doing all the reacting like we do in the U.S. I have a neighbor, when there's a black guy who does delivery pizza, she makes sure to answer the door with a gun. System one lives well and strong near where I am. And it's all about engaging system two. How do we get it to become engaged? And it's not just system one or system two. It's a constant analog flowing continuum. It's a process that we have to become accustomed to. And it's exactly what we do in cybersecurity. How much time and effort goes into primary analysis and detection reaction? How much goes into deeper analytics? We go two layers, three layers, doesn't matter. But the process is


chunk_text:
  brain works exactly the same way. If we know how to turn on that pause button, and it's all about creating a momentary delay. Just like your parents said is when you were a kid, you get wrong. Take a breath. Count to 10. Think about it. Or as women say about men, give them a couple days, they'll come around. It's about that pause to engage system two thinking so that our automatic system one stuff is not doing all the reacting like we do in the U.S. I have a neighbor, when there's a black guy who does delivery pizza, she makes sure to answer the door with a gun. System one lives well and strong near where I am. And it's all about engaging system two. How do we get it to become engaged? And it's not just system one or system two. It's a constant analog flowing continuum. It's a process that we have to become accustomed to. And it's exactly what we do in cybersecurity. How much time and effort goes into primary analysis and detection reaction? How much goes into deeper analytics? We go two layers, three layers, doesn't matter. But the process is exactly the same. And we got to just hit pause in the brain. And the techniques to do it are pretty well established and they go back 60 years. And it was anti-propaganda, mind control from the 1960s, Professor McGuire. And then for some reason it was ignored. It was ignored until early 2010s. And some guys in Cambridge said, we wonder how we could get people to think better. How do we engage system two? And they found out that playing a game does it. And for those of you who are interested, take a look at Bad News. It's a game. Cranky Uncle. Harmony Square. These are all disinformation games built for that reason, to try to get people to not believe so much bullshit. And the term that they have developed for this is called pre-bunking. And pre-bunking basically means, hey, I'm about to tell you a couple of lies in the next 10 minutes. What have I just done? I've primed them that I'm going to lie. Then I tell them some stuff. His bullshit detector has increased, because I pre-warned him. These games used at enterprise level and at the individual level absolutely build up


chunk_text:
  exactly the same. And we got to just hit pause in the brain. And the techniques to do it are pretty well established and they go back 60 years. And it was anti-propaganda, mind control from the 1960s, Professor McGuire. And then for some reason it was ignored. It was ignored until early 2010s. And some guys in Cambridge said, we wonder how we could get people to think better. How do we engage system two? And they found out that playing a game does it. And for those of you who are interested, take a look at Bad News. It's a game. Cranky Uncle. Harmony Square. These are all disinformation games built for that reason, to try to get people to not believe so much bullshit. And the term that they have developed for this is called pre-bunking. And pre-bunking basically means, hey, I'm about to tell you a couple of lies in the next 10 minutes. What have I just done? I've primed them that I'm going to lie. Then I tell them some stuff. His bullshit detector has increased, because I pre-warned him. These games used at enterprise level and at the individual level absolutely build up your cognitive immune system. They strengthen it. And the numbers exist. The curves exist. And you have to do it periodically, like any good vaccine. It's a mental vaccine. And all we're doing is creating another OODA loop in order to get us to think better. There's a ton of these games out there that get into the critical thinking, critical ignoring. But you have to have had first to get people to care, get people to give a shit, to be able to want to learn how to engage system two. There's cyber ranges that are being built right now for mental immune system strengthening, where you have battles, information battles, true information warfare in the way that the Russians think about it. And that's, do I give a shit, is the first thing that you have to ask when you're being bombarded with headlines coming streaming at you. And you do it naturally. You're scrolling through all the crap that comes into your inbox. You go, no, no, no, no, no, until you see something. So you're already doing it to an extent. How do we get the whole planet to actually engage in critical ignoring, avoiding the


chunk_text:
  your cognitive immune system. They strengthen it. And the numbers exist. The curves exist. And you have to do it periodically, like any good vaccine. It's a mental vaccine. And all we're doing is creating another OODA loop in order to get us to think better. There's a ton of these games out there that get into the critical thinking, critical ignoring. But you have to have had first to get people to care, get people to give a shit, to be able to want to learn how to engage system two. There's cyber ranges that are being built right now for mental immune system strengthening, where you have battles, information battles, true information warfare in the way that the Russians think about it. And that's, do I give a shit, is the first thing that you have to ask when you're being bombarded with headlines coming streaming at you. And you do it naturally. You're scrolling through all the crap that comes into your inbox. You go, no, no, no, no, no, until you see something. So you're already doing it to an extent. How do we get the whole planet to actually engage in critical ignoring, avoiding the rabbit hole, and avoiding too much information? The Russians defined it. If you've never read the work of Yuri Bezmenov, I suggest you do. He was a Russian propagandist for the KGB in the 1960s. And everything that he has said, back with a book called A Love Letter to America, published in 1984, describes exactly where we are today. Exactly where we are. So then I started looking at, what are we doing about it? So any idea how many of this, anybody have an idea on the answer to this question? Shout it out. Not all at once, please. Zero? What'd you say? 200. 200. That's the answer. Somewhere in there. Between Project Horizon, DACAS in the UK, the EU and UK spend about 5 billion euros a year working on cognitive strengthening. US, how much? 90. You're fucking right it is. Not funny. Not funny, because you see what's going on in the US right now. Over here, there's a whole lot of it. A tremendous amount of awareness that is being put into defending entire populations. Finland, Sweden have some amazing programs going on. UK has got some ones that are coming out of the military.


chunk_text:
  rabbit hole, and avoiding too much information? The Russians defined it. If you've never read the work of Yuri Bezmenov, I suggest you do. He was a Russian propagandist for the KGB in the 1960s. And everything that he has said, back with a book called A Love Letter to America, published in 1984, describes exactly where we are today. Exactly where we are. So then I started looking at, what are we doing about it? So any idea how many of this, anybody have an idea on the answer to this question? Shout it out. Not all at once, please. Zero? What'd you say? 200. 200. That's the answer. Somewhere in there. Between Project Horizon, DACAS in the UK, the EU and UK spend about 5 billion euros a year working on cognitive strengthening. US, how much? 90. You're fucking right it is. Not funny. Not funny, because you see what's going on in the US right now. Over here, there's a whole lot of it. A tremendous amount of awareness that is being put into defending entire populations. Finland, Sweden have some amazing programs going on. UK has got some ones that are coming out of the military. EU is still trying to figure out, what do we do? How do we implement it? But they're getting there. And then the United States, we're defenseless. Right now, the US is defenseless against cognitive attacks. And because of certain political forces in the US, virtually every one of the private and public cognitive defense efforts were shut down by threats. That's scary. That really depressed the hell out of me when I discovered that. We need hackers. We need the cybersecurity community. Because the technology of silicon, the technology, the system of our brain, they're really the same. Just different approaches, different tweaks. But the models, the systems behind them, the detection, the reaction mechanisms are all things that we're completely familiar with that have not been applied to us. We have the maps. We understand the basics of the models. Now, how do we implement it? How do we get multidisciplinary groups, led by hackers, led by the cybersecurity community, in order to create an ability for us to survive technology? How do we learn to coexist peacefully with technology? Otherwise, we're just going to give up control completely. I hopefully have completely depressed you this morning. But


chunk_text:
  EU is still trying to figure out, what do we do? How do we implement it? But they're getting there. And then the United States, we're defenseless. Right now, the US is defenseless against cognitive attacks. And because of certain political forces in the US, virtually every one of the private and public cognitive defense efforts were shut down by threats. That's scary. That really depressed the hell out of me when I discovered that. We need hackers. We need the cybersecurity community. Because the technology of silicon, the technology, the system of our brain, they're really the same. Just different approaches, different tweaks. But the models, the systems behind them, the detection, the reaction mechanisms are all things that we're completely familiar with that have not been applied to us. We have the maps. We understand the basics of the models. Now, how do we implement it? How do we get multidisciplinary groups, led by hackers, led by the cybersecurity community, in order to create an ability for us to survive technology? How do we learn to coexist peacefully with technology? Otherwise, we're just going to give up control completely. I hopefully have completely depressed you this morning. But it's up to you. It's up to cybersecurity. The misinformation groups, the psychologists, the neuroscientists, all the people I've spoken to, they've all said to me, cybersecurity guys, please come help. Cybersecurity people are problem solvers. It doesn't matter what the problem is. We enjoy the shit out of solving problems. Well, dudes, we got some problems. And I invite you to become part of the solution. Hopefully I haven't depressed you too much. Thank you so much. Thank you.


chunk_text:
  it's up to you. It's up to cybersecurity. The misinformation groups, the psychologists, the neuroscientists, all the people I've spoken to, they've all said to me, cybersecurity guys, please come help. Cybersecurity people are problem solvers. It doesn't matter what the problem is. We enjoy the shit out of solving problems. Well, dudes, we got some problems. And I invite you to become part of the solution. Hopefully I haven't depressed you too much. Thank you so much. Thank you.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=KOqfjjzCLQE", "title": "Low Energy To High Energy: Hacking Nearby EV-Chargers Over Bluetooth - Daan Keuper", "description": "", "channel_url": "https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA", "duration": 1360, "channel": "OrangeCon", "uploader": "OrangeCon", "upload_date": "20240909" } This text was transcribed using whisper model: large-v2 Welcome to our talk. We are Thijs Alkmaar and Daan Keuper, and together with our colleague Khaled Nassar, we are the research department of Computest. Computest is a security company from the Netherlands. We're an office in Zoetermeer. They do security services like pen testing, incident response, we've managed SOC, red teaming. But we are the research department, which means that we don't do work for customers, but we do research for public benefit, research projects that help society, make it a bit safer, but also being able to talk about the research that we do. And one of the activities that we like to do is Pwn2Own. This is a hacking competition. In case you're not familiar with it yet, it's very different from a CTF. So the idea behind Pwn2Own is that it's a competition for finding actual zero-day vulnerabilities in existing software. So it's organized by a company called CDI. And a few months before the actual event, they set out a few targets. They tell you, you're going to get this reward if you manage to hack it. And then teams start working on them, typically at least for a few months or a few weeks. And then at the event, they just go there, they run their exploits to demonstrate that it works. And then you get a reward. So the reward depends on whether there are other teams targeting the same thing as well. Typically the first team that successfully demonstrates a vulnerability gets a full reward, but any later teams get a lower reward. And if you have the same vulnerability as another team, your reward is even lower again because they don't want people to share their vulnerabilities. So we participated in Pwn2Own now three times. So the first time was in 2021 with Zoom, which was very important at that time. And then a year later, we looked at industrial control systems, like the fuel systems used in factories. And earlier this year, in January, there was a new addition, one focused on automotive, where we also participated. It has various targets, like it had a Tesla with different subcomponents of the Tesla.


chunk_text:
  set out a few targets. They tell you, you're going to get this reward if you manage to hack it. And then teams start working on them, typically at least for a few months or a few weeks. And then at the event, they just go there, they run their exploits to demonstrate that it works. And then you get a reward. So the reward depends on whether there are other teams targeting the same thing as well. Typically the first team that successfully demonstrates a vulnerability gets a full reward, but any later teams get a lower reward. And if you have the same vulnerability as another team, your reward is even lower again because they don't want people to share their vulnerabilities. So we participated in Pwn2Own now three times. So the first time was in 2021 with Zoom, which was very important at that time. And then a year later, we looked at industrial control systems, like the fuel systems used in factories. And earlier this year, in January, there was a new addition, one focused on automotive, where we also participated. It has various targets, like it had a Tesla with different subcomponents of the Tesla. There were automotive operating systems, infotainment systems, and the targets that we had the most success with, that were EV chargers. And for three different EV chargers, we had exploits, which means that we could take them over, get full control over the device, just with an arbitrary code. And for all three of them, we had a way to do this just by being in Bluetooth range. So we didn't need to be on the same network. We didn't need to have like a password or whatever for the device. We just stand somewhere near it, connect to it, and yeah, we can take it over. So we did that with three different devices. This is a Juicebox 40, the Autel Maxi Charger, and the ChargePoint Home Flex. And all of them have similar functionality, like these are home chargers. So this is something you get installed at home, but typically you need an electrician to install this, but they're not superchargers. They don't go for the very high energy. And they have similar functionality, like they have an app, you can do scheduled charging, you can see how much energy has been used already, that sort of thing.


chunk_text:
  There were automotive operating systems, infotainment systems, and the targets that we had the most success with, that were EV chargers. And for three different EV chargers, we had exploits, which means that we could take them over, get full control over the device, just with an arbitrary code. And for all three of them, we had a way to do this just by being in Bluetooth range. So we didn't need to be on the same network. We didn't need to have like a password or whatever for the device. We just stand somewhere near it, connect to it, and yeah, we can take it over. So we did that with three different devices. This is a Juicebox 40, the Autel Maxi Charger, and the ChargePoint Home Flex. And all of them have similar functionality, like these are home chargers. So this is something you get installed at home, but typically you need an electrician to install this, but they're not superchargers. They don't go for the very high energy. And they have similar functionality, like they have an app, you can do scheduled charging, you can see how much energy has been used already, that sort of thing. And all of them were like typically IoT level of security. Clearly not much thought has been put into the development of this firmware. So this was for two of them, anybody in Bluetooth range could just connect to them. There was no authentication on that part at all. And for the third one, there was some authentication, but it had a backdoor in it. So anybody who had that backdoor token could just connect to it. Now, sadly, we don't have that much time today, so we cannot really talk about all three of them. We're going to focus on the ChargePoint Home Flex. But if you want to know more about the other chargers and how we perform research, or if you want to do something like this yourself, we have full write-ups for all three of them. I think we posted the latest one today on our website. So yeah, we're trying to help other people do research like this, maybe on the same target or similar targets. So that's why we also publish full write-ups on what we did and how we approach our research. So the ChargePoint Home Flex, this one is a bit different


chunk_text:
  And all of them were like typically IoT level of security. Clearly not much thought has been put into the development of this firmware. So this was for two of them, anybody in Bluetooth range could just connect to them. There was no authentication on that part at all. And for the third one, there was some authentication, but it had a backdoor in it. So anybody who had that backdoor token could just connect to it. Now, sadly, we don't have that much time today, so we cannot really talk about all three of them. We're going to focus on the ChargePoint Home Flex. But if you want to know more about the other chargers and how we perform research, or if you want to do something like this yourself, we have full write-ups for all three of them. I think we posted the latest one today on our website. So yeah, we're trying to help other people do research like this, maybe on the same target or similar targets. So that's why we also publish full write-ups on what we did and how we approach our research. So the ChargePoint Home Flex, this one is a bit different from the other two because this one runs Linux. But we did first need to extract the firmware from this charger. This is our setup for doing that. This charger, it would boot Linux and it would boot automatically, so we couldn't tell it to change how it was booting. We could connect over Telnet, but there was a password, a root password, that we didn't have. But luckily, JTAG was enabled on this device, which typically is disabled in production devices. But luckily for us, this was not disabled here. So during boot, we could pause the boot loader, tell it to not automatically boot its configuration that was saved, but then just make it wait a bit so we can change the boot configuration, add a new user so we can log into it. And then we had access to the device while it was running. And why did we need to do it? Well, we didn't have the firmware for this device. So we don't really know how this kind of thing updates itself. We know nothing. So we need to know what code is running on there. So we needed to extract that first. So by


chunk_text:
  from the other two because this one runs Linux. But we did first need to extract the firmware from this charger. This is our setup for doing that. This charger, it would boot Linux and it would boot automatically, so we couldn't tell it to change how it was booting. We could connect over Telnet, but there was a password, a root password, that we didn't have. But luckily, JTAG was enabled on this device, which typically is disabled in production devices. But luckily for us, this was not disabled here. So during boot, we could pause the boot loader, tell it to not automatically boot its configuration that was saved, but then just make it wait a bit so we can change the boot configuration, add a new user so we can log into it. And then we had access to the device while it was running. And why did we need to do it? Well, we didn't have the firmware for this device. So we don't really know how this kind of thing updates itself. We know nothing. So we need to know what code is running on there. So we needed to extract that first. So by just following these steps, getting access via the hardware, we were able to just copy all of the files once we had access. Now one thing that differed from the other two chargers from this one is that there was prior research for this charger. Kaspersky in 2018 looked at the same charger and they wrote a full report on this with how they researched it, what kind of things they found and made all of this public. And back then they found that there was a stack buffer overflow when you set the Wi-Fi password. So typically how these chargers work is you connect over Bluetooth to the charger. The first time you set it up, you give it your Wi-Fi password or the password for your Wi-Fi network and the name, and then it connects to that. And then you don't need to use Bluetooth anymore. So it was one packet that you needed to send and there was a buffer overflow in that. So of course, this was six years ago. You don't expect new vulnerabilities there. Well, not in the service itself. So the way that this works is you send first a password that goes


chunk_text:
  just following these steps, getting access via the hardware, we were able to just copy all of the files once we had access. Now one thing that differed from the other two chargers from this one is that there was prior research for this charger. Kaspersky in 2018 looked at the same charger and they wrote a full report on this with how they researched it, what kind of things they found and made all of this public. And back then they found that there was a stack buffer overflow when you set the Wi-Fi password. So typically how these chargers work is you connect over Bluetooth to the charger. The first time you set it up, you give it your Wi-Fi password or the password for your Wi-Fi network and the name, and then it connects to that. And then you don't need to use Bluetooth anymore. So it was one packet that you needed to send and there was a buffer overflow in that. So of course, this was six years ago. You don't expect new vulnerabilities there. Well, not in the service itself. So the way that this works is you send first a password that goes to a binary called onboardee. And there's some inter-process communication happening to a binary called WLAN app, which handles all of the setup for the Wi-Fi password. And typically how these devices work with Wi-Fi is that they don't use a password itself, but they derive a key from the password immediately. But they didn't want to implement this. They saw there's a command for that. So they just copy all of the data into a shell command and execute it without any verification or escaping or whatever. So yeah, this is a straightforward example of a command injection. You just put a double quote in there and then some semicolon or whatever, and then you can run extra commands. So this charger, I think we, no, this one we ordered end of October. So all of these chargers were American models. So we had to order them on Amazon and it took weeks for them to ship to us. We ordered this one end of October, but then Amazon lost our package. They told me it was probably delivered. They really said probably, but it hadn't shown up. So we had to reorder it at like December 1st, I


chunk_text:
  to a binary called onboardee. And there's some inter-process communication happening to a binary called WLAN app, which handles all of the setup for the Wi-Fi password. And typically how these devices work with Wi-Fi is that they don't use a password itself, but they derive a key from the password immediately. But they didn't want to implement this. They saw there's a command for that. So they just copy all of the data into a shell command and execute it without any verification or escaping or whatever. So yeah, this is a straightforward example of a command injection. You just put a double quote in there and then some semicolon or whatever, and then you can run extra commands. So this charger, I think we, no, this one we ordered end of October. So all of these chargers were American models. So we had to order them on Amazon and it took weeks for them to ship to us. We ordered this one end of October, but then Amazon lost our package. They told me it was probably delivered. They really said probably, but it hadn't shown up. So we had to reorder it at like December 1st, I think. So it was like almost Christmas when this thing came in and yeah, it was getting near the competition. So we really had only a few days to work on this charger. And Dan and Gert were doing all of the JTAG stuff with the U-Boot and whatever. And then within a day they had this and they had this command injection. And I was like, I don't believe you guys. You're saying this is way too easy. No way that this actually works here. But yeah, it did work. And as I mentioned before the competition, you get a lower reward if other teams have the same vulnerability. And we hoped sort of that there might not be that many entrants for this competition, but that turned out to be completely wrong because there were seven entries for this charger and we were seventh out of the seven. And then like we saw the attempts on the first day and we don't really know what vulnerabilities they are using, of course, because they are still zero days. So they need to keep that quiet. We saw on the schedule that the first team succeeded, but then all of


chunk_text:
  think. So it was like almost Christmas when this thing came in and yeah, it was getting near the competition. So we really had only a few days to work on this charger. And Dan and Gert were doing all of the JTAG stuff with the U-Boot and whatever. And then within a day they had this and they had this command injection. And I was like, I don't believe you guys. You're saying this is way too easy. No way that this actually works here. But yeah, it did work. And as I mentioned before the competition, you get a lower reward if other teams have the same vulnerability. And we hoped sort of that there might not be that many entrants for this competition, but that turned out to be completely wrong because there were seven entries for this charger and we were seventh out of the seven. And then like we saw the attempts on the first day and we don't really know what vulnerabilities they are using, of course, because they are still zero days. So they need to keep that quiet. We saw on the schedule that the first team succeeded, but then all of the following teams all collided. So this made it very likely to us, if you look at like the prior research from Kaspersky, that everybody just had looked at the same parts and everybody had the same bugs. So we were there in Tokyo and we're, yeah, a bit annoyed because, yeah, we just know that we're going to do up on this. So then we sort of started to look at it a bit further and I'm going to hand it over to Dan for this part. Yes. So we had around 12 hours remaining before entry was due. So it was around 9 PM in the evening and we're like, okay, fuck it. We're just going to try to find something new. We have nothing better to do. We went clubbing three nights in a row. So we thought, okay, this night we're going to just spend all night, see if we can find a better vulnerability to avoid a bug collision. So this all was made possible because our hotel had a beer vending machine, which kept us awake all night. So at least I was a little bit sleep deprived. We were jet lagged. So we


chunk_text:
  the following teams all collided. So this made it very likely to us, if you look at like the prior research from Kaspersky, that everybody just had looked at the same parts and everybody had the same bugs. So we were there in Tokyo and we're, yeah, a bit annoyed because, yeah, we just know that we're going to do up on this. So then we sort of started to look at it a bit further and I'm going to hand it over to Dan for this part. Yes. So we had around 12 hours remaining before entry was due. So it was around 9 PM in the evening and we're like, okay, fuck it. We're just going to try to find something new. We have nothing better to do. We went clubbing three nights in a row. So we thought, okay, this night we're going to just spend all night, see if we can find a better vulnerability to avoid a bug collision. So this all was made possible because our hotel had a beer vending machine, which kept us awake all night. So at least I was a little bit sleep deprived. We were jet lagged. So we couldn't sleep the nights prior. We went clubbing a couple of times. So we hadn't slept in a couple of nights. But due to this vending machine, we pulled an all nighter trying to find a different vulnerability that might not collide during the competition. So we didn't actually have the charger with us because we thought that might pose problems with customs if you bring a charger through customs. Turns out that's not true because we got a new charger from the competition leader for further research. So we took that back in my backpack and no problems at customs whatsoever. No questions asked. So apparently you can just bring your EV charger across the border. So we didn't actually have the charger with us. We did have one in the office where we could remotely log into. So every Bluetooth vector was now out of the question because we didn't have the charger to actually test any vulnerabilities we might find in the Bluetooth packet handling. So we were bound to network attacks. So this is the services that the charger is actually running. It has a Telnet daemon running at all times. But since we didn't know


chunk_text:
  couldn't sleep the nights prior. We went clubbing a couple of times. So we hadn't slept in a couple of nights. But due to this vending machine, we pulled an all nighter trying to find a different vulnerability that might not collide during the competition. So we didn't actually have the charger with us because we thought that might pose problems with customs if you bring a charger through customs. Turns out that's not true because we got a new charger from the competition leader for further research. So we took that back in my backpack and no problems at customs whatsoever. No questions asked. So apparently you can just bring your EV charger across the border. So we didn't actually have the charger with us. We did have one in the office where we could remotely log into. So every Bluetooth vector was now out of the question because we didn't have the charger to actually test any vulnerabilities we might find in the Bluetooth packet handling. So we were bound to network attacks. So this is the services that the charger is actually running. It has a Telnet daemon running at all times. But since we didn't know the root passwords, we deemed it uninteresting. It had an outgoing WebSocket connection to the ChargePoint cloud. And we looked at this prior, but it seems to validate the certificates. So we also deemed that uninteresting. And it had an outgoing SSH connection that would actually fail because the service it was trying to connect to no longer existed. But the service was a bit strange. It would connect to some cloud service and it would use that to reverse proxy the Telnet port to the charger. I'm guessing this is some kind of maintenance daemon. Like this way ChargePoint will always have Telnet access to every charger to do emergency maintenance or support. But yeah, since we already had access to the Telnet port, if you were on the same network, we also deemed that SSH connection not that interesting from an attacker point of view. So we decided to go back to that WebSocket connection for a little bit to see if certificates validation was indeed correctly implemented or maybe they use an outdated version of some SSL library that would contain vulnerabilities or maybe we could make it drop back to an HTTP connection or something. So


chunk_text:
  the root passwords, we deemed it uninteresting. It had an outgoing WebSocket connection to the ChargePoint cloud. And we looked at this prior, but it seems to validate the certificates. So we also deemed that uninteresting. And it had an outgoing SSH connection that would actually fail because the service it was trying to connect to no longer existed. But the service was a bit strange. It would connect to some cloud service and it would use that to reverse proxy the Telnet port to the charger. I'm guessing this is some kind of maintenance daemon. Like this way ChargePoint will always have Telnet access to every charger to do emergency maintenance or support. But yeah, since we already had access to the Telnet port, if you were on the same network, we also deemed that SSH connection not that interesting from an attacker point of view. So we decided to go back to that WebSocket connection for a little bit to see if certificates validation was indeed correctly implemented or maybe they use an outdated version of some SSL library that would contain vulnerabilities or maybe we could make it drop back to an HTTP connection or something. So this is the configuration file. Here you see the URL that it would connect to during normal operation. And it would indeed see that it has the verify hostname setting set to one, which we assumed would make it set to true and would indeed verify the hostname. We looked at the binary a bit more and we learned that it used curl for all the WebSocket communication and that this setting was actually setting the SSL verify host option in curl. So looking a bit more closely at these values, well, actually there are three values. You have zero, which means don't do any verification. And you have two, which means do certificate validation. And there you have one. And one is a bit of a foot gun. It's some sort of debug value that was also promptly removed from curl because nobody understood this correctly, of course. Luckily, ChargePoint didn't update their curl library in quite some time. So it was earlier than version 7.28. And what version one means, it will check if the certificate is signed by a valid CA, but it wouldn't check the domain name. That's basically what it said. But a valid certificate


chunk_text:
  this is the configuration file. Here you see the URL that it would connect to during normal operation. And it would indeed see that it has the verify hostname setting set to one, which we assumed would make it set to true and would indeed verify the hostname. We looked at the binary a bit more and we learned that it used curl for all the WebSocket communication and that this setting was actually setting the SSL verify host option in curl. So looking a bit more closely at these values, well, actually there are three values. You have zero, which means don't do any verification. And you have two, which means do certificate validation. And there you have one. And one is a bit of a foot gun. It's some sort of debug value that was also promptly removed from curl because nobody understood this correctly, of course. Luckily, ChargePoint didn't update their curl library in quite some time. So it was earlier than version 7.28. And what version one means, it will check if the certificate is signed by a valid CA, but it wouldn't check the domain name. That's basically what it said. But a valid certificate or signed by a valid CA in this situation means that it needs to be signed by a certificate from ChargePoint. But luckily, the device had just a certificate for us because it also used client-side authentication. So we could just extract. And it was signed by the same root key. So we could just extract that certificate and use that to man-in-the-middle the WebSocket connection. So at this time, it was around midnight. Beer started kicking in. We're slightly past our Balmer peak at this point. And we were researching this from a hotel in Tokyo with a drum and bass from a crappy laptop speaker. And the charger was, of course, in our office in the Netherlands. But, yeah, it was near 5 p.m., so the office would close. So we were like, okay. At this point, we also learned that we were running the incorrect firmware on our charger. So we already knew, like, okay, if we crash this thing, we have no way to log back into it or do any further research. So whatever vulnerability we find, it needs to be easily exploitable. Because if it crashes, we're done. We also learned, because we have


chunk_text:
  or signed by a valid CA in this situation means that it needs to be signed by a certificate from ChargePoint. But luckily, the device had just a certificate for us because it also used client-side authentication. So we could just extract. And it was signed by the same root key. So we could just extract that certificate and use that to man-in-the-middle the WebSocket connection. So at this time, it was around midnight. Beer started kicking in. We're slightly past our Balmer peak at this point. And we were researching this from a hotel in Tokyo with a drum and bass from a crappy laptop speaker. And the charger was, of course, in our office in the Netherlands. But, yeah, it was near 5 p.m., so the office would close. So we were like, okay. At this point, we also learned that we were running the incorrect firmware on our charger. So we already knew, like, okay, if we crash this thing, we have no way to log back into it or do any further research. So whatever vulnerability we find, it needs to be easily exploitable. Because if it crashes, we're done. We also learned, because we have the old firmware, that most offsets are most likely wrong. So any memory corruption where you need offsets also will most likely not work. So we thought, okay, we really need a simple vulnerability here. Like something like an arbitrary file write or just a system command injection would all do the job. So we spent the entire night trying to find a message that would lead to arbitrary code execution. This is the format of the messages that go over that bus. We spent all night. It was quite messy, because the whole IPC layer made it very difficult to see where each message would go to. But in the end, we found a message that we could send, where it would extract something from the payload it would receive from the cloud, and it would directly slap it into a system command. I have no idea what the normal uses of this command is, but we had straight up command execution. So we wrote the report, went on the metro without any sleep to the venue, and luckily it worked. We were the seventh team, but we found a new vulnerability that it didn't juke. So we're very


chunk_text:
  the old firmware, that most offsets are most likely wrong. So any memory corruption where you need offsets also will most likely not work. So we thought, okay, we really need a simple vulnerability here. Like something like an arbitrary file write or just a system command injection would all do the job. So we spent the entire night trying to find a message that would lead to arbitrary code execution. This is the format of the messages that go over that bus. We spent all night. It was quite messy, because the whole IPC layer made it very difficult to see where each message would go to. But in the end, we found a message that we could send, where it would extract something from the payload it would receive from the cloud, and it would directly slap it into a system command. I have no idea what the normal uses of this command is, but we had straight up command execution. So we wrote the report, went on the metro without any sleep to the venue, and luckily it worked. We were the seventh team, but we found a new vulnerability that it didn't juke. So we're very glad we managed to pull this off. So I'm also seeing that we're nearing the break, but I want to go back for one second to that SSH connection, because we also looked a little bit deeper into that silly SSH connection, and this is the init script that actually spawns that shell service, SSH service. It has several hosts that it can connect to, based on in which year the device was produced. It had one for 2016, 2017. Of course, we're now in 2024, and it didn't have any hosts for that year. So it would just fall back to the normal URL, the default value. But that host was no longer online. So we tried, hey, can we maybe with our charger log into any of the other hosts, like the older versions? And it turned out we could. Our SSH key would work on one of those older systems. They call it the mothership. So this is basically what it does. Based on your serial number, it would claim a port, and it would open a reverse proxy to your local Telnet daemon. And we could log in. We tried, of course, if we could get


chunk_text:
  glad we managed to pull this off. So I'm also seeing that we're nearing the break, but I want to go back for one second to that SSH connection, because we also looked a little bit deeper into that silly SSH connection, and this is the init script that actually spawns that shell service, SSH service. It has several hosts that it can connect to, based on in which year the device was produced. It had one for 2016, 2017. Of course, we're now in 2024, and it didn't have any hosts for that year. So it would just fall back to the normal URL, the default value. But that host was no longer online. So we tried, hey, can we maybe with our charger log into any of the other hosts, like the older versions? And it turned out we could. Our SSH key would work on one of those older systems. They call it the mothership. So this is basically what it does. Based on your serial number, it would claim a port, and it would open a reverse proxy to your local Telnet daemon. And we could log in. We tried, of course, if we could get a shell, but that didn't work. So they had thought about this a little bit. But then we thought, okay, if we can do reverse proxies, we can also do forward proxies. So can we maybe connect to other chargers via this host? So we tried some other stuff to see if we could get that to work. And indeed, we could connect to other Telnet services of other chargers. But of course, we didn't have the root password, so yeah, that wasn't very useful. So then we thought, okay, can we maybe connect them to other hosts outside of charge points? Like an open proxy sort of thing. That also works. If you can make one tunnel, you can probably make more tunnels. So, okay, cool finding. Open proxy, maybe not very useful, but okay. Until we learned that this service is hosted on AWS. We're like, oh, and we connect to the meta service of AWS. Well, it turns out we can. So we extracted all kinds of access keys that this specific instance had. We're like, okay, I hope this instance doesn't have much access to some of the charge point resources. So we thought, okay, let's


chunk_text:
  a shell, but that didn't work. So they had thought about this a little bit. But then we thought, okay, if we can do reverse proxies, we can also do forward proxies. So can we maybe connect to other chargers via this host? So we tried some other stuff to see if we could get that to work. And indeed, we could connect to other Telnet services of other chargers. But of course, we didn't have the root password, so yeah, that wasn't very useful. So then we thought, okay, can we maybe connect them to other hosts outside of charge points? Like an open proxy sort of thing. That also works. If you can make one tunnel, you can probably make more tunnels. So, okay, cool finding. Open proxy, maybe not very useful, but okay. Until we learned that this service is hosted on AWS. We're like, oh, and we connect to the meta service of AWS. Well, it turns out we can. So we extracted all kinds of access keys that this specific instance had. We're like, okay, I hope this instance doesn't have much access to some of the charge point resources. So we thought, okay, let's list S3 buckets. Oh, wow. They had 142 S3 buckets. We had read primitives on all of them, it seems. Some have very interesting name with prods, but also PAI, data lake, payment details, et cetera. Yeah, we stopped our research here because this was outside of the scope of the competition. But, yeah, it was interesting because two weeks ago or so, there were some questions in Parliament about some research that you could control, like, 4 million solar panels, and that could have a very negative impact on the electricity grid if you can control so much solar panels at once. But if you think about it, this problem is, of course, much bigger than only solar panels. There are much more devices that either consume a lot of power or produce a lot of power that are all connected to some cloud of some manufacturer that didn't really take security into account. So with that in mind, I would say if you want to know more about our research, please go to our website. You can find all three write-ups of all three chargers. If you're interested in participating in Pwn2Own, there's one coming up in October.


chunk_text:
  list S3 buckets. Oh, wow. They had 142 S3 buckets. We had read primitives on all of them, it seems. Some have very interesting name with prods, but also PAI, data lake, payment details, et cetera. Yeah, we stopped our research here because this was outside of the scope of the competition. But, yeah, it was interesting because two weeks ago or so, there were some questions in Parliament about some research that you could control, like, 4 million solar panels, and that could have a very negative impact on the electricity grid if you can control so much solar panels at once. But if you think about it, this problem is, of course, much bigger than only solar panels. There are much more devices that either consume a lot of power or produce a lot of power that are all connected to some cloud of some manufacturer that didn't really take security into account. So with that in mind, I would say if you want to know more about our research, please go to our website. You can find all three write-ups of all three chargers. If you're interested in participating in Pwn2Own, there's one coming up in October. There are some crappy IP cameras as targets, so I'm sure you're going to have fun. And if there are any more questions, I'm willing to answer some questions. Thank you. I had to grab that first. Are there any questions from the audience? Nobody? Everybody wants to go for a break? Can we then please have another big round of applause for...


chunk_text:
  There are some crappy IP cameras as targets, so I'm sure you're going to have fun. And if there are any more questions, I'm willing to answer some questions. Thank you. I had to grab that first. Are there any questions from the audience? Nobody? Everybody wants to go for a break? Can we then please have another big round of applause for...


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=Rv0otVFKrkk", "title": "Making Penetration Testing Auditable - Brenno De Winter", "description": "", "channel_url": "https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA", "duration": 1818, "channel": "OrangeCon", "uploader": "OrangeCon", "upload_date": "20240909" } This text was transcribed using whisper model: large-v2 Welcome, Noé. Indeed, my talk today is about making penetration testing auditable again. For the people that know me, of course, there are a lot of cats in my presentation. You might think that doesn't serve a purpose, but you might be wrong there. Okay, I'm Brenno de Winter. I'm currently part of the CISO team of the Ministry of Health, Welfare, and something else, and today we're going to talk about penetration testing, and let's have a quick look towards what the legislator is requiring from us. One of the big things that is happening this month is that this too will come into effect, into full effect. Also in the Netherlands, I know that a lot of people out here that think that it doesn't start. Well, it does start. We don't have a Dutch law yet, that's a different story, but we're also getting the Cyber Resilience Act when you are developing software, and these laws basically are shouting for assurance. On the normative side, we have got frameworks for the non-Dutchies, the ISO 200007123. For the ones that are working within the Dutch government, we've got the Baseline Informatiebeveiliging Overheid, which is basically the 27001 and 2, and in healthcare we've got the 7510, which is more or less the same, only the focus is a little bit different. If we use software, or if we make software, and we fuck it up big time, and people are involved, the GDPR kicks into effect, and the GDPR has an article, article 82, that basically says like, if you fuck up, you pay for the damage. So introducing software has liabilities, and those liabilities you want to mitigate. If you look specifically at the NIS2, I'm not going through all the laws, don't worry, but if you're looking at the NIS2, you have to show more clarity. At this point basically said like, okay, I've got this piece of paper, it has the word pen test on it, I give it to an auditor, and that's basically end of the story. Now the law says that you have to deliver underlying evidence. So the pen test itself might not be enough anymore. And the


chunk_text:
  side, we have got frameworks for the non-Dutchies, the ISO 200007123. For the ones that are working within the Dutch government, we've got the Baseline Informatiebeveiliging Overheid, which is basically the 27001 and 2, and in healthcare we've got the 7510, which is more or less the same, only the focus is a little bit different. If we use software, or if we make software, and we fuck it up big time, and people are involved, the GDPR kicks into effect, and the GDPR has an article, article 82, that basically says like, if you fuck up, you pay for the damage. So introducing software has liabilities, and those liabilities you want to mitigate. If you look specifically at the NIS2, I'm not going through all the laws, don't worry, but if you're looking at the NIS2, you have to show more clarity. At this point basically said like, okay, I've got this piece of paper, it has the word pen test on it, I give it to an auditor, and that's basically end of the story. Now the law says that you have to deliver underlying evidence. So the pen test itself might not be enough anymore. And the question is, is a pen test basically showing that things are fine, or is it a proof that the director of the organization is in control? Well, maybe neither at this moment. Maybe a pen test doesn't answer that question. If you look at a couple of companies in the Netherlands, and I did my best, or Dieppel did his best to translate it to proper English, then you see all sorts of statements that basically if you take them together, oh, why is this still in Dutch? I did make a mistake here apparently, but basically every company is saying something else. Showing the severity of IT problems, making infrastructure proof of sound, show the state of security, show vulnerabilities. None of these companies is saying, give assurance that the basics are in place. And that's a big thing. I think I started, I started, no, I don't know why it's all in Dutch all of a sudden, because I did translate them all over the last three days. What we see happening is that with the pen test, a lot of companies are claiming that they do magic. I really have had them sitting down and say, we


chunk_text:
  question is, is a pen test basically showing that things are fine, or is it a proof that the director of the organization is in control? Well, maybe neither at this moment. Maybe a pen test doesn't answer that question. If you look at a couple of companies in the Netherlands, and I did my best, or Dieppel did his best to translate it to proper English, then you see all sorts of statements that basically if you take them together, oh, why is this still in Dutch? I did make a mistake here apparently, but basically every company is saying something else. Showing the severity of IT problems, making infrastructure proof of sound, show the state of security, show vulnerabilities. None of these companies is saying, give assurance that the basics are in place. And that's a big thing. I think I started, I started, no, I don't know why it's all in Dutch all of a sudden, because I did translate them all over the last three days. What we see happening is that with the pen test, a lot of companies are claiming that they do magic. I really have had them sitting down and say, we can't tell what we did because it's magic. What we did is a company secret. What we do with the pen test is not something you can use against us. It's similar to buying a house in the Netherlands. You've got these companies that will help you and they will come to your house and they will say and have a look at your house and say like, okay, this is structurally proper built. I bought a house in Amstelveen and the guy said, well, the roof, you know, you might in the next five years have to replace like 10 or 12 tiles, but that's just about it. Four months later, I could replace my entire roof and there's nothing you can say about that. So the customer, and this is always a problem in communication, the customer has a total different expectation and they're filled with techno-optimism. Customers have been looking at my website, so it must be good. They couldn't penetrate it, so it must be perfect. Well, we did a pen test, so everything must be okay. And we're jumping around that everything is okay. So we've got the company on one hand saying, basically what


chunk_text:
  can't tell what we did because it's magic. What we did is a company secret. What we do with the pen test is not something you can use against us. It's similar to buying a house in the Netherlands. You've got these companies that will help you and they will come to your house and they will say and have a look at your house and say like, okay, this is structurally proper built. I bought a house in Amstelveen and the guy said, well, the roof, you know, you might in the next five years have to replace like 10 or 12 tiles, but that's just about it. Four months later, I could replace my entire roof and there's nothing you can say about that. So the customer, and this is always a problem in communication, the customer has a total different expectation and they're filled with techno-optimism. Customers have been looking at my website, so it must be good. They couldn't penetrate it, so it must be perfect. Well, we did a pen test, so everything must be okay. And we're jumping around that everything is okay. So we've got the company on one hand saying, basically what we offer is your insight in your problems and the customer perceiving it as being assurance. The reality is that we are non-compliant, not pen tested, and unknown risk accepted. Because if you don't know what your risks are, you accept risks that you don't realize. Six months later, let's say, you know, you're a city, you did a pen test on the infrastructure. After six months, all of a sudden, your entire city is hacked. All your data is ransomwared. And that's basically the end of the story. And again, you can shout as much. We did an infrastructure pen test and there were no significant findings. But at the end of the day, your data is gone. This incident, and a couple of people will know which incident I'm talking about, was for me a life-changing event. It was the first time that I realized that the board of directors, or the major, did everything right from her perspective. But on the other hand, she still loosed out. Hold that thought. For the next couple of years, there will be a lot new laws that will be introduced. I can summarize all European laws that are coming our


chunk_text:
  we offer is your insight in your problems and the customer perceiving it as being assurance. The reality is that we are non-compliant, not pen tested, and unknown risk accepted. Because if you don't know what your risks are, you accept risks that you don't realize. Six months later, let's say, you know, you're a city, you did a pen test on the infrastructure. After six months, all of a sudden, your entire city is hacked. All your data is ransomwared. And that's basically the end of the story. And again, you can shout as much. We did an infrastructure pen test and there were no significant findings. But at the end of the day, your data is gone. This incident, and a couple of people will know which incident I'm talking about, was for me a life-changing event. It was the first time that I realized that the board of directors, or the major, did everything right from her perspective. But on the other hand, she still loosed out. Hold that thought. For the next couple of years, there will be a lot new laws that will be introduced. I can summarize all European laws that are coming our way very simple. Europe is saying, fuck you to magic. Europe is saying, make proper risk assessments and deal with the risks. All the laws that you will see passing will have these elements in it. I see people make pictures, but the slides will be available in full English ultimately. And if you join the group, you're part of making them and then there are your slides as well. So compliance shouldn't be looking somebody in the eyes and saying, okay, it must be good because the eyes are so blue. And this is what we're used to this. We've got SOC 1 and SOC 2, type 1 and type 2, design and existence or operational effectiveness. We're used to this insecurity. So it's nothing really new and it shouldn't be. So we should help the auditor. We've got hackers to look. That means that we've got no established level of knowledge. We can't use that. We take inspiration for standards. That means we do non-standardized tests. What we do is magic. No, what you do is dark magic. What a pen test is, well, that's what we do. So we don't have a framework. That's strange because we


chunk_text:
  way very simple. Europe is saying, fuck you to magic. Europe is saying, make proper risk assessments and deal with the risks. All the laws that you will see passing will have these elements in it. I see people make pictures, but the slides will be available in full English ultimately. And if you join the group, you're part of making them and then there are your slides as well. So compliance shouldn't be looking somebody in the eyes and saying, okay, it must be good because the eyes are so blue. And this is what we're used to this. We've got SOC 1 and SOC 2, type 1 and type 2, design and existence or operational effectiveness. We're used to this insecurity. So it's nothing really new and it shouldn't be. So we should help the auditor. We've got hackers to look. That means that we've got no established level of knowledge. We can't use that. We take inspiration for standards. That means we do non-standardized tests. What we do is magic. No, what you do is dark magic. What a pen test is, well, that's what we do. So we don't have a framework. That's strange because we do have a framework. The broader question is, what do we do with an audit? Is that testing a claim? Is it looking back? Is it looking forward? Is it I'm convinced that it will be okay someday? What do we want to steer towards? If I have two cars, one is 23 years old, one is 21 years old and every year they get a test and they get basic tests. The brakes, the lights, the tires, that type of stuff. What they don't do is electrical. So it might be you get into your car after a positive test and the car burst into flames. But probably what will happen is that I will go back to the garage and say like, what the F did you do? Why didn't you warn me of this? Even though it isn't one of the formal tests. And I hear a lot that in pen testing you can't do standardized tests. That's funny because there are total books written about how to do that. And OWASP has a couple of very cool testing guides that basically describe exactly what you should do. And I always hear like, yeah, but there's always


chunk_text:
  do have a framework. The broader question is, what do we do with an audit? Is that testing a claim? Is it looking back? Is it looking forward? Is it I'm convinced that it will be okay someday? What do we want to steer towards? If I have two cars, one is 23 years old, one is 21 years old and every year they get a test and they get basic tests. The brakes, the lights, the tires, that type of stuff. What they don't do is electrical. So it might be you get into your car after a positive test and the car burst into flames. But probably what will happen is that I will go back to the garage and say like, what the F did you do? Why didn't you warn me of this? Even though it isn't one of the formal tests. And I hear a lot that in pen testing you can't do standardized tests. That's funny because there are total books written about how to do that. And OWASP has a couple of very cool testing guides that basically describe exactly what you should do. And I always hear like, yeah, but there's always a test that doesn't apply to this subject or to this scope. Well, okay, let's take that test out then. But in general, it's like testing your basics. What is being tested to my car is reproducible. It's reproducible in a way that as soon as the garage is finished and they say like, okay, I certify this car, they've got a certain chance that the government will step in and say like, okay, we'll redo your test. And they could lose their license over it. So they do it properly. For pen test, this is basically some basic surgery and you fixed it. Cut out the magic, provide more certainty and deliver the evidence. That would basically turn everything around. So this is what we did. And we are quite a growing group. I'll talk about that later. Here's the new problem. Because of all the magic, there is no definition of a pen test. I've had Victor de Paus, who has been in IT law for 43 years. He went through all Dutch law, all the European laws, and there's a lot in cyber security defined in law, but the word pen test is not one of them.


chunk_text:
  a test that doesn't apply to this subject or to this scope. Well, okay, let's take that test out then. But in general, it's like testing your basics. What is being tested to my car is reproducible. It's reproducible in a way that as soon as the garage is finished and they say like, okay, I certify this car, they've got a certain chance that the government will step in and say like, okay, we'll redo your test. And they could lose their license over it. So they do it properly. For pen test, this is basically some basic surgery and you fixed it. Cut out the magic, provide more certainty and deliver the evidence. That would basically turn everything around. So this is what we did. And we are quite a growing group. I'll talk about that later. Here's the new problem. Because of all the magic, there is no definition of a pen test. I've had Victor de Paus, who has been in IT law for 43 years. He went through all Dutch law, all the European laws, and there's a lot in cyber security defined in law, but the word pen test is not one of them. And this is part of the issue. So we came with quite a group with a definition. You might debate about it, but at least we've got the definition now. And if you think this can be better, come and help please. Same thing, okay, let's dark magic. If you're a hacker, if you know stuff, you probably can prove that you know stuff. So there are certain exams you can take. By the way, we didn't make this up. There is this Dutch schedule called CCV, they've got this wonderful schedule. They had education criteria. We copied that. Because why find out to will yourself and somebody else did already good job. So you have to have certain amount of skills and you need to be able to prove it. Well, the cool thing about skills is nowadays you can check them online. Get back to that later. The other thing is if you've got the testing guide, I've got controls. Basically I can do a claim towards security and then the test will prove if it's correct or not. So I've got design, existence and operating effectiveness. And if these words do not say anything, then you're probably


chunk_text:
  And this is part of the issue. So we came with quite a group with a definition. You might debate about it, but at least we've got the definition now. And if you think this can be better, come and help please. Same thing, okay, let's dark magic. If you're a hacker, if you know stuff, you probably can prove that you know stuff. So there are certain exams you can take. By the way, we didn't make this up. There is this Dutch schedule called CCV, they've got this wonderful schedule. They had education criteria. We copied that. Because why find out to will yourself and somebody else did already good job. So you have to have certain amount of skills and you need to be able to prove it. Well, the cool thing about skills is nowadays you can check them online. Get back to that later. The other thing is if you've got the testing guide, I've got controls. Basically I can do a claim towards security and then the test will prove if it's correct or not. So I've got design, existence and operating effectiveness. And if these words do not say anything, then you're probably not an auditor. If you're an auditor, you think like happy. So what we did, we found a minimum set of testing guides, benchmarks, shit you could use that is already there and you should use actually. And we put that into a bunch of controls that basically say like this is what you've got to do. This is how you can validate it as an auditor. This is the value of this criteria. This is what you're missing out on if you don't use it. And the last one is if you want to do procurement, this is how to do procurement. And one of the things that is different to a lot of companies right now is if you get a report and you do it according to this scheme, then you are allowed to deliver the report to other parties to prove that you did your work wrong. So right, sorry, or wrong. But I meant right, of course. Now you can still say like, OK, but I don't want to share my pen test. Well, that's, I understand that, we'll deal with that in a second. So now in the whole scheme, bigger scheme of things,


chunk_text:
  not an auditor. If you're an auditor, you think like happy. So what we did, we found a minimum set of testing guides, benchmarks, shit you could use that is already there and you should use actually. And we put that into a bunch of controls that basically say like this is what you've got to do. This is how you can validate it as an auditor. This is the value of this criteria. This is what you're missing out on if you don't use it. And the last one is if you want to do procurement, this is how to do procurement. And one of the things that is different to a lot of companies right now is if you get a report and you do it according to this scheme, then you are allowed to deliver the report to other parties to prove that you did your work wrong. So right, sorry, or wrong. But I meant right, of course. Now you can still say like, OK, but I don't want to share my pen test. Well, that's, I understand that, we'll deal with that in a second. So now in the whole scheme, bigger scheme of things, you know, you've got your vulnerability scans, your penetration tests. Now that we've got a firm basis, basically the next thing you can do is red teaming. And if you do red teaming without a basic pen test, I've done that a couple of times, you're throwing stuff over. It's funny when you do it, but it's not funny if you're on the receiving side. You've got your code review, your regular security assessments and your audits. So I'm not claiming it's replacing everything. It's just the technical audit side that you've got your basics in place. After penetration testing, you can hand the penetration test with all the evidence to an auditor and they can write a report based on that test. So if you don't want to share your pen test because you think it's too sensitive or discloses too much, then at least an auditor can say like, okay, this guy did a proper job or this girl did a proper job. And you can send that around. In the Netherlands, we've got a couple of interesting things. One is that we've got cities and they have to go through an ANSIA audit. That is basically an


chunk_text:
  you know, you've got your vulnerability scans, your penetration tests. Now that we've got a firm basis, basically the next thing you can do is red teaming. And if you do red teaming without a basic pen test, I've done that a couple of times, you're throwing stuff over. It's funny when you do it, but it's not funny if you're on the receiving side. You've got your code review, your regular security assessments and your audits. So I'm not claiming it's replacing everything. It's just the technical audit side that you've got your basics in place. After penetration testing, you can hand the penetration test with all the evidence to an auditor and they can write a report based on that test. So if you don't want to share your pen test because you think it's too sensitive or discloses too much, then at least an auditor can say like, okay, this guy did a proper job or this girl did a proper job. And you can send that around. In the Netherlands, we've got a couple of interesting things. One is that we've got cities and they have to go through an ANSIA audit. That is basically an audit that security is more or less okay. For that audit, they have to do pen tests. So what we see happen is 346 times the same pen test on the same software being executed because you need to be compliant. This would solve that. The second thing is that I see pen tests being ordered on software that has already been pen tested internally because if somebody externally does it, then it's more assurance. Now, if you want assurance, go to an auditor. That's the logic place to go. And don't be scared. We are left out on work. For the people here that know Stephen Covey, I believe in the abundance of work available in the IT security industry. And I don't think in scarcity. So long story short, we finally get time to test shit that we should have tested years ago. We call it the methodology for information security research with audit value. In Dutch, that is the Methodeek voor Informatiebeveiligingsonderzoek met Auditwaarde. And you abbreviate it as MEOW. And this is the logo. And this is my cat, Otis. Yeah, Otis is R and sweet. So I already said you get a set of controls.


chunk_text:
  audit that security is more or less okay. For that audit, they have to do pen tests. So what we see happen is 346 times the same pen test on the same software being executed because you need to be compliant. This would solve that. The second thing is that I see pen tests being ordered on software that has already been pen tested internally because if somebody externally does it, then it's more assurance. Now, if you want assurance, go to an auditor. That's the logic place to go. And don't be scared. We are left out on work. For the people here that know Stephen Covey, I believe in the abundance of work available in the IT security industry. And I don't think in scarcity. So long story short, we finally get time to test shit that we should have tested years ago. We call it the methodology for information security research with audit value. In Dutch, that is the Methodeek voor Informatiebeveiligingsonderzoek met Auditwaarde. And you abbreviate it as MEOW. And this is the logo. And this is my cat, Otis. Yeah, Otis is R and sweet. So I already said you get a set of controls. You get official procedural report by an auditor. We deliver a model pen test report so that if you're all alone and you are a pen tester, you're not on your own. We give you all the legal information and we'll make an advisory guide which will be available on October 18th as a book for everybody who wants it. And last but not least, we have also things included. You see pieces of a pen test report. We also thought about how to make things hoof-de-proof. For instance, if an administrator goes like, no, you're not allowed to get shell on a system. It's no longer the pen tester's problem, we'll make it a manager's problem. I basically say like, we tried to test it but we weren't granted access. So basically, we don't know what the status is and it gets a red color. And here's something very interesting. Managers hate red. Even though managers are mostly red in behavior, they hate the red color for some reason. So we'll make it a damn issue. So we thought about a lot of things, probably we forgot a lot of things, that makes it easier for you to execute


chunk_text:
  You get official procedural report by an auditor. We deliver a model pen test report so that if you're all alone and you are a pen tester, you're not on your own. We give you all the legal information and we'll make an advisory guide which will be available on October 18th as a book for everybody who wants it. And last but not least, we have also things included. You see pieces of a pen test report. We also thought about how to make things hoof-de-proof. For instance, if an administrator goes like, no, you're not allowed to get shell on a system. It's no longer the pen tester's problem, we'll make it a manager's problem. I basically say like, we tried to test it but we weren't granted access. So basically, we don't know what the status is and it gets a red color. And here's something very interesting. Managers hate red. Even though managers are mostly red in behavior, they hate the red color for some reason. So we'll make it a damn issue. So we thought about a lot of things, probably we forgot a lot of things, that makes it easier for you to execute your work. It is now more measurable because you know what test you are doing. You know, I recently spoke to a company said like, we do a 50,000 euro pen test. And when the money is gone, then we stop. If I were a company and I would hear this, my hourly rate would cyclically go like really up. Because that's less work, more money. And then we say like, next year we'll look at different things. That's measurable now. So hopefully we are looking all at the same. And we have got clarity on what we do, what it means. It's verifiable. And hopefully we stop doing the same tests more than once on the exact same software. And that all together helps you to be fact-based in control, hopefully. And we're doing this, I'm doing this, we are doing this at the Ministry of Health. But throughout the year I found a lot of friends that started to help out and look with us. And also a part of the procurement and buying power that we have together. Because I've seen in the corona times when you do things together or in bigger numbers, you know, companies


chunk_text:
  your work. It is now more measurable because you know what test you are doing. You know, I recently spoke to a company said like, we do a 50,000 euro pen test. And when the money is gone, then we stop. If I were a company and I would hear this, my hourly rate would cyclically go like really up. Because that's less work, more money. And then we say like, next year we'll look at different things. That's measurable now. So hopefully we are looking all at the same. And we have got clarity on what we do, what it means. It's verifiable. And hopefully we stop doing the same tests more than once on the exact same software. And that all together helps you to be fact-based in control, hopefully. And we're doing this, I'm doing this, we are doing this at the Ministry of Health. But throughout the year I found a lot of friends that started to help out and look with us. And also a part of the procurement and buying power that we have together. Because I've seen in the corona times when you do things together or in bigger numbers, you know, companies are more inclined to help out to do it in the same way. And this is not a complete list because there are a lot of organizations that say like, okay, I can't be on the slide, but I'm still pretty proud that I've got a whole bunch of friends that are at least helping. And not the least of that are Davey Day Academy, OWASP, because it's their standards I try to abuse the most, because they are public. And that makes it easier. That is basically what I had to share, so I would like to open the floor for questions if there's any time left. I've got no clue how much time I spent. There is definitely time left for some questions. So are there any questions from the audience? Give me one second. Yes, I could try. No, no, we start sweet, and then if it's a wrong question, then we hit you in the face. Talk in the microphone so that everybody can hear. Is there an on-off button on it? Yeah, then you're going to do sports. So the thing I'm pretty familiar with when working in security, right, is when you're measuring the,


chunk_text:
  are more inclined to help out to do it in the same way. And this is not a complete list because there are a lot of organizations that say like, okay, I can't be on the slide, but I'm still pretty proud that I've got a whole bunch of friends that are at least helping. And not the least of that are Davey Day Academy, OWASP, because it's their standards I try to abuse the most, because they are public. And that makes it easier. That is basically what I had to share, so I would like to open the floor for questions if there's any time left. I've got no clue how much time I spent. There is definitely time left for some questions. So are there any questions from the audience? Give me one second. Yes, I could try. No, no, we start sweet, and then if it's a wrong question, then we hit you in the face. Talk in the microphone so that everybody can hear. Is there an on-off button on it? Yeah, then you're going to do sports. So the thing I'm pretty familiar with when working in security, right, is when you're measuring the, what you call, how bad a vulnerability is, right, you talk about the CVSS vectors in this framework that you're mentioning, and I was interested in knowing how it correlates. For example, how do you compare CVSS version 2 and 1 or 3, for example? Because you can't really convert between them because it's not really defined. Yeah, we've defined CVSS version 4 because that also gives you context information as well, so that in the measurement of how severe it is, it's a very good question for the ones who don't know what the common vulnerability scoring system is. When you do a pen test and you have findings, we, from a technical perspective, tend to say like, okay, this is the end of the world, always. So for me, every finding is critical. Now we've got the scoring system to say like, okay, we give you a number between zero and ten, ten being like critical and zero being like purely informational, and we're using indeed the common vulnerability scoring system. The last version, 4.0, also gives a lot of context information. For instance, if you've got a computer that is never attached to the internet, the same


chunk_text:
  what you call, how bad a vulnerability is, right, you talk about the CVSS vectors in this framework that you're mentioning, and I was interested in knowing how it correlates. For example, how do you compare CVSS version 2 and 1 or 3, for example? Because you can't really convert between them because it's not really defined. Yeah, we've defined CVSS version 4 because that also gives you context information as well, so that in the measurement of how severe it is, it's a very good question for the ones who don't know what the common vulnerability scoring system is. When you do a pen test and you have findings, we, from a technical perspective, tend to say like, okay, this is the end of the world, always. So for me, every finding is critical. Now we've got the scoring system to say like, okay, we give you a number between zero and ten, ten being like critical and zero being like purely informational, and we're using indeed the common vulnerability scoring system. The last version, 4.0, also gives a lot of context information. For instance, if you've got a computer that is never attached to the internet, the same finding might get a lower number than, of course, a public-facing thing. So we use 4.0. Is that enough answer to your question? Yeah, I like it. First of all, thanks for putting in the effort into making pen testing more measurable. What does MEOW fix that is not fixed by either Certified Secure or OWASP ASVS? Oh, yeah, that's a cool one. OWASP ASVS is a standard. Can you give me a second? Then I'll pull up a slide where it is exactly saying what ASVS is. And that is this slide. If you look at ASVS, it is for culture building, process maturing, and it is used for putting down requirements. When you do validation, you've got different guides. So the use of the ASVS is a different use. And this is a good question because there's something else. I see a lot of pen tests that talk about the OWASP top 10. We are not educating because that is purely meant for educating. It is not meant to test, for instance. It's basically a popularity contest with the top 10, yeah. So we've had a look at it on the ASVS because that's what I thought as


chunk_text:
  finding might get a lower number than, of course, a public-facing thing. So we use 4.0. Is that enough answer to your question? Yeah, I like it. First of all, thanks for putting in the effort into making pen testing more measurable. What does MEOW fix that is not fixed by either Certified Secure or OWASP ASVS? Oh, yeah, that's a cool one. OWASP ASVS is a standard. Can you give me a second? Then I'll pull up a slide where it is exactly saying what ASVS is. And that is this slide. If you look at ASVS, it is for culture building, process maturing, and it is used for putting down requirements. When you do validation, you've got different guides. So the use of the ASVS is a different use. And this is a good question because there's something else. I see a lot of pen tests that talk about the OWASP top 10. We are not educating because that is purely meant for educating. It is not meant to test, for instance. It's basically a popularity contest with the top 10, yeah. So we've had a look at it on the ASVS because that's what I thought as well in the beginning. But then I got a firm lesson from OWASP, like, stop doing that. But shouldn't you always verify against your requirements? It depends on what you are verifying. It's a good question because I'm just writing a book called The Validation Crisis. Because this is a big thing, yes, you should, but for the testing guides, the technical testing guides, OWASP did something else. And that's all, of course, interconnected. So yeah, this is why we end up with different testing books. But we were at the same page as you were in the beginning. Yeah, and that was kind of a shock to me because that was in my head for years. Will be the last question, I think. All right, thanks. So you rightfully point out that we should stop testing the exact same software for the same issues. Of course, there is no such thing as the exact same software. Small modifications are being made all the time. So do you have thoughts on that? And most particularly, whose responsibility will it be to identify when a component has to be retested? The pen testers or the organizations? You said you were asking


chunk_text:
  well in the beginning. But then I got a firm lesson from OWASP, like, stop doing that. But shouldn't you always verify against your requirements? It depends on what you are verifying. It's a good question because I'm just writing a book called The Validation Crisis. Because this is a big thing, yes, you should, but for the testing guides, the technical testing guides, OWASP did something else. And that's all, of course, interconnected. So yeah, this is why we end up with different testing books. But we were at the same page as you were in the beginning. Yeah, and that was kind of a shock to me because that was in my head for years. Will be the last question, I think. All right, thanks. So you rightfully point out that we should stop testing the exact same software for the same issues. Of course, there is no such thing as the exact same software. Small modifications are being made all the time. So do you have thoughts on that? And most particularly, whose responsibility will it be to identify when a component has to be retested? The pen testers or the organizations? You said you were asking multiple questions at once. Who's responsible? And for all the CISOs in this room, listen very carefully, management, especially in the law, management, administration is responsible for security. It's not a CISO job. It's a CISO job to facilitate the process, to watch if things are going right. But it's a management job. So management should decide if they're working on software all the time.


chunk_text:
  multiple questions at once. Who's responsible? And for all the CISOs in this room, listen very carefully, management, especially in the law, management, administration is responsible for security. It's not a CISO job. It's a CISO job to facilitate the process, to watch if things are going right. But it's a management job. So management should decide if they're working on software all the time.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=MxDq552Di3Y", "title": "The Registry Rundown - Cedric Van Bockhaven & Max Grim", "description": "", "channel_url": "https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA", "duration": 1823, "channel": "OrangeCon", "uploader": "OrangeCon", "upload_date": "20240909" } This text was transcribed using whisper model: large-v2 Welcome to our talk, the Registry Rundown. My name is Cedric van Bockhaven. I'm a Red Teamer and Offensive Developer at Outflank, just like my colleague Max. In general, we just spend our days hacking away at things. We're both very technical people, and also at home with home automations and stuff like that, like my partner says. But he usually thinks I break stuff rather than also repairing them. So, Max, you want to introduce yourself? Yeah. So, my microphone is not working, or is it? Oh, great. Lovely. So, I'm Max. I'm also a Red Teamer and Offensive Developer at Outflank. Nowadays, we're part of Fortra. And I have more of a software engineering background. So, before I went into cybersecurity, I worked more on building websites, building applications for companies, and I took that experience into the offensive world. And in my free time, I also like to do some hardware hacking. I build some conference badges and also do some home automation. Yeah. So, actually, for me, the first conference I ever went to was Hack in the Box. So, it's actually great to see now Orangecom being organized also by a lot of the same people that we knew from back then. And this research was also developed actually at a conference. So, two years ago, we were at Brucon, and we were just having a moment of, well, just sitting down and started to play with some scripts. And then we found some interesting stuff in the Windows Registry. So, that's what we're going to talk to you about today. So, a lot of people know that using the registry as an administrator, you can connect to a remote system and just operate registry. But today, we'll see that also as a non-administrator, you can do some quite interesting things with the registry. So, our agenda for today is going over some quick history, then look at how the registry can be managed remotely, and then also look at some vulnerabilities and exploitation primitives that might be useful in security work. Starting with some history. So, the registry dates back from a long, long time ago. Basically, around the


chunk_text:
  automation. Yeah. So, actually, for me, the first conference I ever went to was Hack in the Box. So, it's actually great to see now Orangecom being organized also by a lot of the same people that we knew from back then. And this research was also developed actually at a conference. So, two years ago, we were at Brucon, and we were just having a moment of, well, just sitting down and started to play with some scripts. And then we found some interesting stuff in the Windows Registry. So, that's what we're going to talk to you about today. So, a lot of people know that using the registry as an administrator, you can connect to a remote system and just operate registry. But today, we'll see that also as a non-administrator, you can do some quite interesting things with the registry. So, our agenda for today is going over some quick history, then look at how the registry can be managed remotely, and then also look at some vulnerabilities and exploitation primitives that might be useful in security work. Starting with some history. So, the registry dates back from a long, long time ago. Basically, around the time I was born. So, back in Windows 3.1, the registry was first created for storing com-based components, configuration data. And then also, a lot of information was still being stored in .ini files. So, if you had a program installed, then that program would store its settings also in .ini files. Nowadays, or around Windows 95 and NT, what they started doing is moving that information to the registry. So, if you open Registry Editor, what you'll see is a hierarchical view of typically these hives. HKEY-LOCAL-MACHINE, HKEY-USERS, and so on. Thank you. And you also have a number of other hives that you don't typically see in the registry, but they are present. So, you can interact with them if you know how to. And those are the ones that are grayed out on this slide. There are two hives that are particularly interesting for us, which is, first of all, the HKEY-LOCAL-MACHINE hive, which stores all sorts of computer-specific settings, configuration data. So, think about local policies, group policies that are being applied on the computer level. So, not on the user level, but the computer level. In contrast to HKEY-USERS, which contains then, of course, the


chunk_text:
  time I was born. So, back in Windows 3.1, the registry was first created for storing com-based components, configuration data. And then also, a lot of information was still being stored in .ini files. So, if you had a program installed, then that program would store its settings also in .ini files. Nowadays, or around Windows 95 and NT, what they started doing is moving that information to the registry. So, if you open Registry Editor, what you'll see is a hierarchical view of typically these hives. HKEY-LOCAL-MACHINE, HKEY-USERS, and so on. Thank you. And you also have a number of other hives that you don't typically see in the registry, but they are present. So, you can interact with them if you know how to. And those are the ones that are grayed out on this slide. There are two hives that are particularly interesting for us, which is, first of all, the HKEY-LOCAL-MACHINE hive, which stores all sorts of computer-specific settings, configuration data. So, think about local policies, group policies that are being applied on the computer level. So, not on the user level, but the computer level. In contrast to HKEY-USERS, which contains then, of course, the user-specific information. Under HKEY-USERS, what you'll typically see is a number of subkeys denoted by S15 and so on. So, S1521 is a domain identifier or a local computer identifier. So, for every user on the system, you'll see a subkey here and storing the information of the individual user. What's interesting here is that there are a number of keys. You see it with the blocked icon that we cannot access. So, as a non-administrator, typically you cannot access information of another user. However, if you're an administrator, you should be able to. But what you also see is that there is one hive that we can access, S1518, or the default hive. You can access that also without administrator permissions on the local system and the remote system and see what's in there. So, S1518 is actually the key related to the local system user. So, containing system configuration information and also stored for, for example, if you're on the logon screen, like NumLog settings, for example, that's what you typically will find in there. And there's a number of other ones, S1519 for local service, S1520 for network service, and so on. So, just used for storing


chunk_text:
  user-specific information. Under HKEY-USERS, what you'll typically see is a number of subkeys denoted by S15 and so on. So, S1521 is a domain identifier or a local computer identifier. So, for every user on the system, you'll see a subkey here and storing the information of the individual user. What's interesting here is that there are a number of keys. You see it with the blocked icon that we cannot access. So, as a non-administrator, typically you cannot access information of another user. However, if you're an administrator, you should be able to. But what you also see is that there is one hive that we can access, S1518, or the default hive. You can access that also without administrator permissions on the local system and the remote system and see what's in there. So, S1518 is actually the key related to the local system user. So, containing system configuration information and also stored for, for example, if you're on the logon screen, like NumLog settings, for example, that's what you typically will find in there. And there's a number of other ones, S1519 for local service, S1520 for network service, and so on. So, just used for storing user data. Then we have a number of other hives, like HKEYCLASSESROOT, HKEYCURRENTUSER, and these are a bit more interesting in the sense that they're not actually real hives, rather they are sort of symbolic links or virtual mappings to the real data. So, only HKEYLOCALMACHINE and HKEYUSER are actually this backed. And if we look at HKEYUSER, HKEYCURRENTUSER, then this is actually containing, again, the information of a specific user. In this case, the user that is logged in. So, our own information. And, yeah, typically if you open an application under your own user, then that application might store its configuration data there. Settings are stored here, but also COM classes. We'll get back to that in a second. Then we have HKEYCR, or HKEYCLASSESROOT, and this is where we'll find all sorts of information related to mappings of extensions, like what program should open a DOC file or what program should open an EXE file, and we'll also find COM class registrations here. Now, HKEYCR is special in the sense that when you open HKEYCLASSESROOT, it will show you information for your own user, overlaid on top of the information that is normally being used for the


chunk_text:
  user data. Then we have a number of other hives, like HKEYCLASSESROOT, HKEYCURRENTUSER, and these are a bit more interesting in the sense that they're not actually real hives, rather they are sort of symbolic links or virtual mappings to the real data. So, only HKEYLOCALMACHINE and HKEYUSER are actually this backed. And if we look at HKEYUSER, HKEYCURRENTUSER, then this is actually containing, again, the information of a specific user. In this case, the user that is logged in. So, our own information. And, yeah, typically if you open an application under your own user, then that application might store its configuration data there. Settings are stored here, but also COM classes. We'll get back to that in a second. Then we have HKEYCR, or HKEYCLASSESROOT, and this is where we'll find all sorts of information related to mappings of extensions, like what program should open a DOC file or what program should open an EXE file, and we'll also find COM class registrations here. Now, HKEYCR is special in the sense that when you open HKEYCLASSESROOT, it will show you information for your own user, overlaid on top of the information that is normally being used for the local system. So, it's a special overlaid hive. What is COM then? I already mentioned COM classes a few times. So, COM is used on a system as a framework for applications to communicate with one another, actually components on the system can interact with one another, so it can be used between processes, but even also over the network if we're talking about distributed COM or DCOM. Maybe you've used this in Microsoft Word, for example. You can do really crazy stuff, like embedding an Excel document in your Word document in a PowerPoint document, which is also known as OLE, Object Linking and Embedding, which leans on component-object model. What you can do is, for example, create an object of the InternetExplorer.application class and then navigate to a specific URL, and that works then via COM. With this class, InternetExplorer.application, there's an associated CLS ID, and that information is stored in the registry under the HKEYCR hive, and then it will tell, under specific registry key, local server 32, which application to actually instantiate to run and interact with on a COM level. All sorts of applications will register these COM classes, so you can then use those


chunk_text:
  local system. So, it's a special overlaid hive. What is COM then? I already mentioned COM classes a few times. So, COM is used on a system as a framework for applications to communicate with one another, actually components on the system can interact with one another, so it can be used between processes, but even also over the network if we're talking about distributed COM or DCOM. Maybe you've used this in Microsoft Word, for example. You can do really crazy stuff, like embedding an Excel document in your Word document in a PowerPoint document, which is also known as OLE, Object Linking and Embedding, which leans on component-object model. What you can do is, for example, create an object of the InternetExplorer.application class and then navigate to a specific URL, and that works then via COM. With this class, InternetExplorer.application, there's an associated CLS ID, and that information is stored in the registry under the HKEYCR hive, and then it will tell, under specific registry key, local server 32, which application to actually instantiate to run and interact with on a COM level. All sorts of applications will register these COM classes, so you can then use those COM classes to interact with them, also a source of many vulnerabilities. If you weren't in this talk today, you would be in Tam Gommers' talk, who's also talking about COM and UAC bypasses. HKEYCLASS is rude, for example, if you install Java, they install, I don't know, 500 of these registry keys looking like a cafe. I don't know why, but I thought it was funny. Max, remote. As attackers, we want to interface with this registry, for example, to do reconnaissance, to do lateral movement, or maybe even some relaying attacks, and there's at least two ways that we know of on how to remotely interact with this registry. The first method is via the remote registry protocol, or MSRRP. This is handled by the remote registry service, and by default on servers, this is marked as auto start, and unfortunately on clients, it's disabled. So this protocol, we mostly focus on servers. So, auto start means that it's not running by default, but we can trigger to run it. So we can access a named pipe, and then it will start up, and then we can start interacting with it, and then after a while, it will


chunk_text:
  COM classes to interact with them, also a source of many vulnerabilities. If you weren't in this talk today, you would be in Tam Gommers' talk, who's also talking about COM and UAC bypasses. HKEYCLASS is rude, for example, if you install Java, they install, I don't know, 500 of these registry keys looking like a cafe. I don't know why, but I thought it was funny. Max, remote. As attackers, we want to interface with this registry, for example, to do reconnaissance, to do lateral movement, or maybe even some relaying attacks, and there's at least two ways that we know of on how to remotely interact with this registry. The first method is via the remote registry protocol, or MSRRP. This is handled by the remote registry service, and by default on servers, this is marked as auto start, and unfortunately on clients, it's disabled. So this protocol, we mostly focus on servers. So, auto start means that it's not running by default, but we can trigger to run it. So we can access a named pipe, and then it will start up, and then we can start interacting with it, and then after a while, it will shut down by itself again. So how do we do this? If the service is not started, we can retrieve the winreg file from the IPC dollar share on the remote system, and this will trigger the service to start, and then we can start interacting with it. And then we can start interacting with it, and we do this with RPC calls, which are transported over an SMB named pipe, and this named pipe is pipe backslash winreg. And the nice thing about this protocol is that you don't need to be a local administrator on the remote machine. So essentially, any domain user in your domain can go to a server and talk to the remote registry over it. You can actually do this in regedit. In regedit, there's a context menu where you connect to a remote server, or you can use other tools such as reg.py, which is part of the Python impact toolkit. And this is actually a nicely documented protocol by Microsoft. There's this huge PDF that you can download with all the different opnims, all the different RPC functions that you can call, and then you can do stuff like deleting keys, enumerating


chunk_text:
  shut down by itself again. So how do we do this? If the service is not started, we can retrieve the winreg file from the IPC dollar share on the remote system, and this will trigger the service to start, and then we can start interacting with it. And then we can start interacting with it, and we do this with RPC calls, which are transported over an SMB named pipe, and this named pipe is pipe backslash winreg. And the nice thing about this protocol is that you don't need to be a local administrator on the remote machine. So essentially, any domain user in your domain can go to a server and talk to the remote registry over it. You can actually do this in regedit. In regedit, there's a context menu where you connect to a remote server, or you can use other tools such as reg.py, which is part of the Python impact toolkit. And this is actually a nicely documented protocol by Microsoft. There's this huge PDF that you can download with all the different opnims, all the different RPC functions that you can call, and then you can do stuff like deleting keys, enumerating keys, opening them, saving to them, whatever you want. Now I mentioned that there's a second one, and this one works via WMI. So WMI uses DCOM to communicate, and this in turn again goes over RPC, but this is like more the traditional RPC that uses a dynamic and random high TCP port. And if you want to interface with WMI, you need to go to the correct namespace, which in this case is root simv2, and then within there, there's a class, the std regprof class, and this class will have all these methods as well where you can open a key, read from it, save to it, whatever you want, basically. And there's advantages and disadvantages to this way of communicating. So the advantage is that it's both enabled on clients and on servers by default, but you need to be a local admin on the remote machine to be able to talk to it. And you can use PowerShell with GetWMIProject to talk to it. You can also use WMI Explorer, which is a nice toolkit where you can see all the namespaces, select the right class, and then it shows you all the parameters that


chunk_text:
  keys, opening them, saving to them, whatever you want. Now I mentioned that there's a second one, and this one works via WMI. So WMI uses DCOM to communicate, and this in turn again goes over RPC, but this is like more the traditional RPC that uses a dynamic and random high TCP port. And if you want to interface with WMI, you need to go to the correct namespace, which in this case is root simv2, and then within there, there's a class, the std regprof class, and this class will have all these methods as well where you can open a key, read from it, save to it, whatever you want, basically. And there's advantages and disadvantages to this way of communicating. So the advantage is that it's both enabled on clients and on servers by default, but you need to be a local admin on the remote machine to be able to talk to it. And you can use PowerShell with GetWMIProject to talk to it. You can also use WMI Explorer, which is a nice toolkit where you can see all the namespaces, select the right class, and then it shows you all the parameters that you need. And there wasn't a tool available for Impacted yet, so we wrote a little extension for Impacted that communicates with the registry over WMI, and here you can see as well, if you use a regular user, you won't be able to access it. You get an access denied, but with an admin user, you can just list the keys and work your way up from there. So now that we know how to interact with it, let's see how we can actually, as attackers, abuse this. And there's already, of course, some common attack factors out there. You can do some credential dumping, so you can dump the SAM security and system hives remotely via secret dump.py. This works via the remote registry. You can also use Mimikatz to do that, or you can configure persistency to add something to the run key on the remote system. You can do com hijacks, which is probably what time is talking about right now, and many, many more things that you can do. But there's actually quite some interesting reconnaissance that you can do as an attacker as well. So if we look at what kind of permissions we


chunk_text:
  you need. And there wasn't a tool available for Impacted yet, so we wrote a little extension for Impacted that communicates with the registry over WMI, and here you can see as well, if you use a regular user, you won't be able to access it. You get an access denied, but with an admin user, you can just list the keys and work your way up from there. So now that we know how to interact with it, let's see how we can actually, as attackers, abuse this. And there's already, of course, some common attack factors out there. You can do some credential dumping, so you can dump the SAM security and system hives remotely via secret dump.py. This works via the remote registry. You can also use Mimikatz to do that, or you can configure persistency to add something to the run key on the remote system. You can do com hijacks, which is probably what time is talking about right now, and many, many more things that you can do. But there's actually quite some interesting reconnaissance that you can do as an attacker as well. So if we look at what kind of permissions we have remotely, it's that we cannot read HKLM if we are a domain user and access it remotely. You need to be a local admin for that, even if you use the remote registry protocol. And if you're a local admin, the HKLM hive has some interesting information. You can read about which EDR software is installed, the AV inclusions that are configured, local or group policies, like Cedric mentioned. So it is quite an interesting source of information. So if you are admin in an operation, this is a good start for reconnaissance. But here we are more interested in what can you access as a domain user. So as I said, you cannot read HKLM, but you can read HKU and HKCR, so the user hive and the class's root hive. If you are logging in, under HKU you always have access to the dot default, the S1518. And if the user remotely is logged in interactively on that computer and you, from a remote part, log into the remote registry, you can actually also go into the SID of that particular user and view all the settings that are mounted under that key. And then there is


chunk_text:
  have remotely, it's that we cannot read HKLM if we are a domain user and access it remotely. You need to be a local admin for that, even if you use the remote registry protocol. And if you're a local admin, the HKLM hive has some interesting information. You can read about which EDR software is installed, the AV inclusions that are configured, local or group policies, like Cedric mentioned. So it is quite an interesting source of information. So if you are admin in an operation, this is a good start for reconnaissance. But here we are more interested in what can you access as a domain user. So as I said, you cannot read HKLM, but you can read HKU and HKCR, so the user hive and the class's root hive. If you are logging in, under HKU you always have access to the dot default, the S1518. And if the user remotely is logged in interactively on that computer and you, from a remote part, log into the remote registry, you can actually also go into the SID of that particular user and view all the settings that are mounted under that key. And then there is the HKCU, which is not the user, but current user. And this is nothing more than a SIM link. So when the user is not logged in on the remote machine, it will link to dot default. And if it is logged in, it will actually map back to that user SID that you can also see in HKU. And this dot default that you can always access already has quite some interesting information for you as an attacker that you can use in a reconnaissance phase. But first, let's look at the HKU itself. So here you can see at the bottom that I'm using Rec.py again. I'm a regular user and I'm querying the user hive. And here I can see that these user SIDs are actually mounted. So from this information, I can already know that these users are logged in on the remote system interactively. And that I can use in my red team to potentially go to there and then dump their credentials. So this is a nice way to map which users are already logged in currently on the machine. But this is not necessarily new. This is also how the POS logged on


chunk_text:
  the HKCU, which is not the user, but current user. And this is nothing more than a SIM link. So when the user is not logged in on the remote machine, it will link to dot default. And if it is logged in, it will actually map back to that user SID that you can also see in HKU. And this dot default that you can always access already has quite some interesting information for you as an attacker that you can use in a reconnaissance phase. But first, let's look at the HKU itself. So here you can see at the bottom that I'm using Rec.py again. I'm a regular user and I'm querying the user hive. And here I can see that these user SIDs are actually mounted. So from this information, I can already know that these users are logged in on the remote system interactively. And that I can use in my red team to potentially go to there and then dump their credentials. So this is a nice way to map which users are already logged in currently on the machine. But this is not necessarily new. This is also how the POS logged on tool, which is part of sysinternals, works and how Bloodhound collects some of this information. But here you can see that if the user is logged in, it will actually be mounted and you can read from it if you have the right permissions. And if the user is not logged in, the whole hive will not be loaded. But what we found is that in the dot default key that everybody can access, there's actually also a log of users that historically ever at some time logged in. So if the user once logged into this machine, there will be a record there with the UTC timestamp of the first login. It will not show you if it's currently logged in, but at least you get a sense of what users did ever logged into this machine before. Now, I told you that you cannot access the HKLM as a local admin. But of course, Microsoft wouldn't be Microsoft if there aren't exceptions. So there's actually two keys that configure these exceptions. It's the allowed exact paths and the allowed paths. And the difference between the two is that with the allowed paths, you can actually also enumerate the


chunk_text:
  tool, which is part of sysinternals, works and how Bloodhound collects some of this information. But here you can see that if the user is logged in, it will actually be mounted and you can read from it if you have the right permissions. And if the user is not logged in, the whole hive will not be loaded. But what we found is that in the dot default key that everybody can access, there's actually also a log of users that historically ever at some time logged in. So if the user once logged into this machine, there will be a record there with the UTC timestamp of the first login. It will not show you if it's currently logged in, but at least you get a sense of what users did ever logged into this machine before. Now, I told you that you cannot access the HKLM as a local admin. But of course, Microsoft wouldn't be Microsoft if there aren't exceptions. So there's actually two keys that configure these exceptions. It's the allowed exact paths and the allowed paths. And the difference between the two is that with the allowed paths, you can actually also enumerate the subkeys. And this is what I extracted from a Windows server. And I highlighted some parts that I'm going to show you later. But if the path is configured in this key, you can actually also as a regular domain user access these. So let's give an example of that. Here I'm querying HKLM software, Microsoft Windows NT current version as a regular user. And I get all sorts of information about the system. What kind of architecture is it running? Which server version is it? And if it's not a volume license key, even the license key is already there. And you can just access that remotely as a user. But this gives you a sense of, okay, is this a somewhat older system or not? And what kind of ETW rules would that have by default, etc. There used to be a vulnerability in this, which is fixed in October 2022. And we actually sort of found this vulnerability at the same time. It's just that the other person was a bit faster with reporting it than we were. But if you had an exact registry path handle, you were actually allowed to also enumerate the descendant subkeys


chunk_text:
  subkeys. And this is what I extracted from a Windows server. And I highlighted some parts that I'm going to show you later. But if the path is configured in this key, you can actually also as a regular domain user access these. So let's give an example of that. Here I'm querying HKLM software, Microsoft Windows NT current version as a regular user. And I get all sorts of information about the system. What kind of architecture is it running? Which server version is it? And if it's not a volume license key, even the license key is already there. And you can just access that remotely as a user. But this gives you a sense of, okay, is this a somewhat older system or not? And what kind of ETW rules would that have by default, etc. There used to be a vulnerability in this, which is fixed in October 2022. And we actually sort of found this vulnerability at the same time. It's just that the other person was a bit faster with reporting it than we were. But if you had an exact registry path handle, you were actually allowed to also enumerate the descendant subkeys of the allowed exact paths. This was reported and fixed, so it doesn't work anymore. But let's see. Some more examples. So here as a regular user, I'm also querying HKLM and I can see what services are installed. And in this case, I can see that CrowdStrike is there because it's configured as an event log surface. So now I know that, okay, maybe I shouldn't send an EXE to that computer, but use a more sophisticated payload. Huh? Oh, yes. We still want the system to keep working afterwards. You can enumerate printer drivers that are installed remotely. And then if it's an older system, maybe use PrintNightmare or some other exploit that revolves around drivers. Maybe there's a vulnerable driver on the remote system that involves turning on the RGBs on your memory stick and that has a vulnerability. And at least now we know what drivers are there that we can potentially use at a later stage. And querying all these registry keys is generally not considered as malicious, so you will not run into any detections unless there's very specific trapdoors in there, so to say. So this is a nice way to do some


chunk_text:
  of the allowed exact paths. This was reported and fixed, so it doesn't work anymore. But let's see. Some more examples. So here as a regular user, I'm also querying HKLM and I can see what services are installed. And in this case, I can see that CrowdStrike is there because it's configured as an event log surface. So now I know that, okay, maybe I shouldn't send an EXE to that computer, but use a more sophisticated payload. Huh? Oh, yes. We still want the system to keep working afterwards. You can enumerate printer drivers that are installed remotely. And then if it's an older system, maybe use PrintNightmare or some other exploit that revolves around drivers. Maybe there's a vulnerable driver on the remote system that involves turning on the RGBs on your memory stick and that has a vulnerability. And at least now we know what drivers are there that we can potentially use at a later stage. And querying all these registry keys is generally not considered as malicious, so you will not run into any detections unless there's very specific trapdoors in there, so to say. So this is a nice way to do some remote reconnaissance. And I'll give one last example. This is the classes root, which you can fully enumerate as a domain user. And here you can see things like, okay, the open with list, like what kind of files have been opened in the past and how are they configured. And in this case, we know, okay, there's at least Word and Excel on there, so maybe we can do something with that. And now we go into a few vulnerabilities that we found. We found two vulnerabilities that are around information disclosure. We reported them to Microsoft. They came back to us that they said they were not critical, not high impact, but they still sent them to their respective teams to be fixed. The first one is that as a regular domain user, it's not possible to read HKLM keys, right, without these exceptions that I just mentioned. But if you use the remote registry protocol, the RPC responses that you have on specific calls actually leak some information. In this case, it leaks information about the existence of the HKLM key. So what we do, we first open a handle to a specific subkey in HKLM that


chunk_text:
  remote reconnaissance. And I'll give one last example. This is the classes root, which you can fully enumerate as a domain user. And here you can see things like, okay, the open with list, like what kind of files have been opened in the past and how are they configured. And in this case, we know, okay, there's at least Word and Excel on there, so maybe we can do something with that. And now we go into a few vulnerabilities that we found. We found two vulnerabilities that are around information disclosure. We reported them to Microsoft. They came back to us that they said they were not critical, not high impact, but they still sent them to their respective teams to be fixed. The first one is that as a regular domain user, it's not possible to read HKLM keys, right, without these exceptions that I just mentioned. But if you use the remote registry protocol, the RPC responses that you have on specific calls actually leak some information. In this case, it leaks information about the existence of the HKLM key. So what we do, we first open a handle to a specific subkey in HKLM that we want to check out, and we set the sum desire to key set value, and I'll show you in a bit why we do that. This should result in access denied because we do this as a regular domain user. And then we try to delete this key. And once we delete this key, there's actually a leak in the information in the response code that will tell us if the key exists or not. So I have it visually here. First, we open the key, and here we should get an access denied because we're a regular domain user, right? And if we do not get an access denied, we should actually abort because then otherwise it would mean that the next step we're going to delete the key, we're actually going to delete the key on the remote system, and generally you don't want to do that on a production system. So this is like a safety check in there. Then we try to delete the key, and then we can see what our status is, and there's basically two. You can get an error file not found, and that means that the key doesn't exist, or


chunk_text:
  we want to check out, and we set the sum desire to key set value, and I'll show you in a bit why we do that. This should result in access denied because we do this as a regular domain user. And then we try to delete this key. And once we delete this key, there's actually a leak in the information in the response code that will tell us if the key exists or not. So I have it visually here. First, we open the key, and here we should get an access denied because we're a regular domain user, right? And if we do not get an access denied, we should actually abort because then otherwise it would mean that the next step we're going to delete the key, we're actually going to delete the key on the remote system, and generally you don't want to do that on a production system. So this is like a safety check in there. Then we try to delete the key, and then we can see what our status is, and there's basically two. You can get an error file not found, and that means that the key doesn't exist, or you get an access denied, and then you know, oh, the key actually did exist. I just don't have access to delete it. And we made a little script that feeds a file, gets fed in with all the different keys, and now you can enumerate and see what kind of software is installed there. So you can give it a predefined list of some EDRs and some other software, and then we can remotely see if it exists or not. There's a second one, and this basically allows you to check if a random file exists on the remote file system or not. So here again, we open the key first, but we now use HQ, and HQ every domain user can do, and then we try to save this key remotely on the file system on a specific path, and this response code actually reveals if the file exists or not. So again, visually, we open the key. We're allowed because it's HQ. We try to save it, and the return status tells us either the directory does not exist or the directory exists, and this you can then also use to see if certain files or programs


chunk_text:
  you get an access denied, and then you know, oh, the key actually did exist. I just don't have access to delete it. And we made a little script that feeds a file, gets fed in with all the different keys, and now you can enumerate and see what kind of software is installed there. So you can give it a predefined list of some EDRs and some other software, and then we can remotely see if it exists or not. There's a second one, and this basically allows you to check if a random file exists on the remote file system or not. So here again, we open the key first, but we now use HQ, and HQ every domain user can do, and then we try to save this key remotely on the file system on a specific path, and this response code actually reveals if the file exists or not. So again, visually, we open the key. We're allowed because it's HQ. We try to save it, and the return status tells us either the directory does not exist or the directory exists, and this you can then also use to see if certain files or programs are installed on the remote system, which is a nice reconnaissance thing to do. One more thing from my side before I hand it over back to Cedric. In the past few years, we actually abused ADCS quite a lot, and for those who don't know what ADCS is, ADCS is a role that you can install on your domain controller, and it's basically Microsoft's PKI implementation that hands out certificates based on templates. So it can be a certificate for Kerberos authentication or for authenticating to your Wi-Fi or whatever you want with that certificate, and it turns out that these templates are generally quite easy to misconfigure, and in certain combinations, we as attackers can abuse those to get domain admin, basically, and normally, we would query these certificate templates via Certify or Certify, and they use COM or RPC or LDAP to query towards the domain controller like, hey, can you give me all the certificate templates that are configured in this environment, but since this has been abused so much, there's actually quite a lot of detections around this as well, but it turns out that by default, every domain joint computer that is part of


chunk_text:
  are installed on the remote system, which is a nice reconnaissance thing to do. One more thing from my side before I hand it over back to Cedric. In the past few years, we actually abused ADCS quite a lot, and for those who don't know what ADCS is, ADCS is a role that you can install on your domain controller, and it's basically Microsoft's PKI implementation that hands out certificates based on templates. So it can be a certificate for Kerberos authentication or for authenticating to your Wi-Fi or whatever you want with that certificate, and it turns out that these templates are generally quite easy to misconfigure, and in certain combinations, we as attackers can abuse those to get domain admin, basically, and normally, we would query these certificate templates via Certify or Certify, and they use COM or RPC or LDAP to query towards the domain controller like, hey, can you give me all the certificate templates that are configured in this environment, but since this has been abused so much, there's actually quite a lot of detections around this as well, but it turns out that by default, every domain joint computer that is part of the domain where the ADCS is configured will have a local cache of all the certificate templates in its registry in the default key, which every domain user in the network can query, which is great for us because we wrote a little tool which we call regcertify, and here I use regedit, but you can also do this remotely. You export this whole subtree, and then we feed it into our tool called regcertify, and then you get an overview of the certificate template, and I'll explain why this is vulnerable. Every user, you can see a tree that every user is allowed to use this certificate template to request a certificate. You can use it for client authentication, so it means you can use it for Kerberos, and the one that enrolls the certificate, so us, the domain user, can define for who the certificate is, so we can fill in, we are domain admin Pietje, we want this for Kerberos, we are domain user, we can request it, and then within two steps, we are domain admin. Really nice way to use in a red team, and really nice to get the certificate templates this way. Yeah,


chunk_text:
  the domain where the ADCS is configured will have a local cache of all the certificate templates in its registry in the default key, which every domain user in the network can query, which is great for us because we wrote a little tool which we call regcertify, and here I use regedit, but you can also do this remotely. You export this whole subtree, and then we feed it into our tool called regcertify, and then you get an overview of the certificate template, and I'll explain why this is vulnerable. Every user, you can see a tree that every user is allowed to use this certificate template to request a certificate. You can use it for client authentication, so it means you can use it for Kerberos, and the one that enrolls the certificate, so us, the domain user, can define for who the certificate is, so we can fill in, we are domain admin Pietje, we want this for Kerberos, we are domain user, we can request it, and then within two steps, we are domain admin. Really nice way to use in a red team, and really nice to get the certificate templates this way. Yeah, so a lot of reconnaissance possibilities, and again, I want to stress that you can do a lot of this without administrator permission, so accessing this sort of information is normally not possible without having administrator rights, so we'll see in the next few slides also how we can abuse that for malicious purposes. Starting with relaying, so there is a registry RRP interface you can use, base right safe key, to trigger a course authentication on the remote site, so for people familiar with Petit Potem and similar course authentications, this is a variation on that, just need to call it with a few specific parameters, and then it will tell you error privilege not held, and in the meantime, you receive the hash of the remote computer, which you can then use to forward it, for example, to ADCS, and obtain a certificate for that computer system. Next to saying error privilege not held, it will actually create a file on the remote system, where you pointed it to, and create it, but it won't have any content unless you are an administrator, so one funny thing you can do with that is, for example, you can course


chunk_text:
  so a lot of reconnaissance possibilities, and again, I want to stress that you can do a lot of this without administrator permission, so accessing this sort of information is normally not possible without having administrator rights, so we'll see in the next few slides also how we can abuse that for malicious purposes. Starting with relaying, so there is a registry RRP interface you can use, base right safe key, to trigger a course authentication on the remote site, so for people familiar with Petit Potem and similar course authentications, this is a variation on that, just need to call it with a few specific parameters, and then it will tell you error privilege not held, and in the meantime, you receive the hash of the remote computer, which you can then use to forward it, for example, to ADCS, and obtain a certificate for that computer system. Next to saying error privilege not held, it will actually create a file on the remote system, where you pointed it to, and create it, but it won't have any content unless you are an administrator, so one funny thing you can do with that is, for example, you can course a domain controller and have a file put there in the temp folder, making it look like the system is being cryptolockered, if you want to cause mayhem, but yeah, I think the most interesting one for us is lateral movement, so as a non-administrator user with the remote registry, you can laterally move, which is normally not possible due to remote UAC controls. So first, let's have a look at how this works as an administrator. Normally, if you want to execute code as an administrator, what you would do via the registry is perform some sort of a COM hijack, so modify a CLS ID under the HKEY local machine, and then find a way for that COM object to be triggered. This does not always work, because you need trusted installer permissions in a lot of cases, but for some reason, if you create software Microsoft app model lookaside, if you create that key, the registry will also look in this other location to see if there's an entry under it. We don't know why, but it does not require trusted installer permissions, so just if you do this remotely, you will be allowed to, and then


chunk_text:
  a domain controller and have a file put there in the temp folder, making it look like the system is being cryptolockered, if you want to cause mayhem, but yeah, I think the most interesting one for us is lateral movement, so as a non-administrator user with the remote registry, you can laterally move, which is normally not possible due to remote UAC controls. So first, let's have a look at how this works as an administrator. Normally, if you want to execute code as an administrator, what you would do via the registry is perform some sort of a COM hijack, so modify a CLS ID under the HKEY local machine, and then find a way for that COM object to be triggered. This does not always work, because you need trusted installer permissions in a lot of cases, but for some reason, if you create software Microsoft app model lookaside, if you create that key, the registry will also look in this other location to see if there's an entry under it. We don't know why, but it does not require trusted installer permissions, so just if you do this remotely, you will be allowed to, and then you can perform a COM hijack. So in this case, you still need to find a suitable COM object to hijack, and then wait until it is instantiated, or you need to find a way to trigger it. Another option for triggering it is finding a service that also instantiates a COM object, and then triggering that service remotely. Coincidentally, it happens to be the case that using RPC calls, you can trigger about 50 services remotely to start, including services on a domain controller. So we have a small demo of that here. So you can send an RPC ping to those services, and then one second later, it says triggered, and then the service actually started on domain controller. You can do this with a lot of services, and a lot of those services also instantiate their own COM objects, which you can hijack, and then obtain remote code execution. Then, as a not administrator, what we can do is modify information under HKCU remotely. We've already seen that in Max's slides, and we can do the same trick. So perform a COM hijack under the current user, and if that user then opens the application that uses


chunk_text:
  you can perform a COM hijack. So in this case, you still need to find a suitable COM object to hijack, and then wait until it is instantiated, or you need to find a way to trigger it. Another option for triggering it is finding a service that also instantiates a COM object, and then triggering that service remotely. Coincidentally, it happens to be the case that using RPC calls, you can trigger about 50 services remotely to start, including services on a domain controller. So we have a small demo of that here. So you can send an RPC ping to those services, and then one second later, it says triggered, and then the service actually started on domain controller. You can do this with a lot of services, and a lot of those services also instantiate their own COM objects, which you can hijack, and then obtain remote code execution. Then, as a not administrator, what we can do is modify information under HKCU remotely. We've already seen that in Max's slides, and we can do the same trick. So perform a COM hijack under the current user, and if that user then opens the application that uses the COM object, it will trigger, and you get code execution. Because also for classes stored under the htclass root, HKCU takes precedence, so this is the way we can do a COM hijack. But which COM object are you going to target? You could target Microsoft Word, for example. So if the user opens Microsoft Word, it triggers. But if you want to have a little bit more control over when it happens, if you want to have a good target, one thing to do is, for example, find handles to keys with modify access. So this is a screenshot of System Informer showing which registry keys are currently opened, and which have notify access, which means that if something happens to the key, the application that uses the handle will do something with it. So what we see here is that searchhost.exe, for example, the one highlighted, has notify permissions. So if you modify that key specifically, it will trigger something in searchhost.exe. So what we did is basically the same thing. We modified a key under this path, just inserted some garbage, and then we didn't know exactly how to change it, so we just let the


chunk_text:
  the COM object, it will trigger, and you get code execution. Because also for classes stored under the htclass root, HKCU takes precedence, so this is the way we can do a COM hijack. But which COM object are you going to target? You could target Microsoft Word, for example. So if the user opens Microsoft Word, it triggers. But if you want to have a little bit more control over when it happens, if you want to have a good target, one thing to do is, for example, find handles to keys with modify access. So this is a screenshot of System Informer showing which registry keys are currently opened, and which have notify access, which means that if something happens to the key, the application that uses the handle will do something with it. So what we see here is that searchhost.exe, for example, the one highlighted, has notify permissions. So if you modify that key specifically, it will trigger something in searchhost.exe. So what we did is basically the same thing. We modified a key under this path, just inserted some garbage, and then we didn't know exactly how to change it, so we just let the process crash, which starts verfol.exe, which is the error reporting service, which has its own COM object, so we can perform a COM hijack on that application instead. Small demo of that. It's set, and then once we switch back to the computer view, we now have a calculator running. One last thing, then, is we noticed the same thing with Citrix. Citrix has an interesting setup where a lot of cases, they allow all domain users to RDP to a system, but then perform access control once you are logged in. So really, after you've already gotten permission to log in, they perform access control. So this is what you see when you log in via RDP, saying you don't have access. But this is actually running under the context of the user that is already logged in. So what we can do is perform a COM hijack via the registry remotely, and just click OK on the screen, and then we get access. We also reported this to Citrix. They thought it was not a vulnerability, but you may convince us otherwise. So yeah, in summary, a few ways to use the registry remotely for reconnaissance, relaying, and


chunk_text:
  process crash, which starts verfol.exe, which is the error reporting service, which has its own COM object, so we can perform a COM hijack on that application instead. Small demo of that. It's set, and then once we switch back to the computer view, we now have a calculator running. One last thing, then, is we noticed the same thing with Citrix. Citrix has an interesting setup where a lot of cases, they allow all domain users to RDP to a system, but then perform access control once you are logged in. So really, after you've already gotten permission to log in, they perform access control. So this is what you see when you log in via RDP, saying you don't have access. But this is actually running under the context of the user that is already logged in. So what we can do is perform a COM hijack via the registry remotely, and just click OK on the screen, and then we get access. We also reported this to Citrix. They thought it was not a vulnerability, but you may convince us otherwise. So yeah, in summary, a few ways to use the registry remotely for reconnaissance, relaying, and lateral movement purposes. If you want to know more, there's some great research being done recently by Google Project Zero, Yoru, who has gone from Windows registry in literally 1992 up until now. I don't know how he found out the details. He must have got some contacts within Microsoft. Really good resource, as well as Pavel Yusifovich blog posts. Thanks a lot for listening to us.


chunk_text:
  lateral movement purposes. If you want to know more, there's some great research being done recently by Google Project Zero, Yoru, who has gone from Windows registry in literally 1992 up until now. I don't know how he found out the details. He must have got some contacts within Microsoft. Really good resource, as well as Pavel Yusifovich blog posts. Thanks a lot for listening to us.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=y-zb450CSks", "title": "Securing OT, Too Hard Or Not For Me? - Erwin Paternotte", "description": "", "channel_url": "https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA", "duration": 2112, "channel": "OrangeCon", "uploader": "OrangeCon", "upload_date": "20240909" } This text was transcribed using whisper model: large-v2 Yeah, thanks for joining for my talk. This is maybe not the most advanced OT talk you will see or hear about, but it's also meant for people who maybe not know so much about OT, and actually an ex-colleague of mine just walked in and said, well, I don't know that much about OT, so this is the talk for you. A little bit about my background. I recently joined as a CTI specialist at the NCC. Before that, I did penetration testing, ethical hacking for about 20 years at different companies, and during that time, I also got the chance to actually test some OT systems myself. So I'm actually combining both threat intelligence and my hands-on experience here in this talk, and hopefully will give you some insight, because why do I want to do this presentation? Well, I know what systems, OT systems look from the inside. I know what vulnerabilities are there, but I also see the outside world where there's a lot of focus on the latest zero days or the latest APTs hacking into these systems, and I think there's a big disconnect between these two, and because there's so much focus on the high-end attacks, I think a lot of people just give up and say, well, I'm not going to fix it. It's not worth doing it. I'm just going to do nothing, and because there's nothing that can be done, everything can be hacked. We all heard it before, and I hope I can change that a bit, because I think there's still a lot that can be done, a lot that can be improved to actually make those systems a little bit more secure. I'm not sure who has previous experience with OT. Raise hands. Well, about half of it. Okay. Half of it may sound familiar to you already, but why is it different? Because it is different in some way, but it's not different in some other ways. What is different is that it's a lot of legacy, because these systems typically run for 30 years or 30 years plus, so you get a lot of old systems that were designed


chunk_text:
  where there's a lot of focus on the latest zero days or the latest APTs hacking into these systems, and I think there's a big disconnect between these two, and because there's so much focus on the high-end attacks, I think a lot of people just give up and say, well, I'm not going to fix it. It's not worth doing it. I'm just going to do nothing, and because there's nothing that can be done, everything can be hacked. We all heard it before, and I hope I can change that a bit, because I think there's still a lot that can be done, a lot that can be improved to actually make those systems a little bit more secure. I'm not sure who has previous experience with OT. Raise hands. Well, about half of it. Okay. Half of it may sound familiar to you already, but why is it different? Because it is different in some way, but it's not different in some other ways. What is different is that it's a lot of legacy, because these systems typically run for 30 years or 30 years plus, so you get a lot of old systems that were designed in a different time. They were also designed with safety in mind, and that means physical safety, and not with security in mind. There are fail-safes, but they're aimed at some incident happening and not somebody deliberately changing your process or meddling with your process. Availability is most important in these systems. Things have to run. There's not so much confidentiality. Integrity comes second, but it is actually reversed from an IT environment, and incidents may have physical impact. If things go wrong, in some systems, you have the safety instrumentation systems that actually will kick in, but still, things can actually explode in some cases, so that makes it interesting as well, but first, a look at threat actors, and I see this part. People typically skip in OT environments, and they think about attackers physically coming onto your premise or into your factory, plugging in a USB device and hacking your systems that way, but there's actually a lot of different ways that can be done and easier ways as well, and I actually start with ransomware first, and not many people realize that ransomware is actually a big problem in these environments as well because it is


chunk_text:
  in a different time. They were also designed with safety in mind, and that means physical safety, and not with security in mind. There are fail-safes, but they're aimed at some incident happening and not somebody deliberately changing your process or meddling with your process. Availability is most important in these systems. Things have to run. There's not so much confidentiality. Integrity comes second, but it is actually reversed from an IT environment, and incidents may have physical impact. If things go wrong, in some systems, you have the safety instrumentation systems that actually will kick in, but still, things can actually explode in some cases, so that makes it interesting as well, but first, a look at threat actors, and I see this part. People typically skip in OT environments, and they think about attackers physically coming onto your premise or into your factory, plugging in a USB device and hacking your systems that way, but there's actually a lot of different ways that can be done and easier ways as well, and I actually start with ransomware first, and not many people realize that ransomware is actually a big problem in these environments as well because it is untargeted, so that also means that everybody can become a victim, also OT environments, and they're not specifically targeting the OT process itself, but they're actually focusing on the IT systems because that's what they know and understand. They just run their playbook and run their scripts as they normally would. However, there's a lot of connections still between IT and OT. If you first start talking to people who run OT systems, they say, oh, it's not connected, and when you start asking questions, you say, oh, but how do you actually get your antivirus updates if you are running antivirus at all? How do you actually manage your system? And then increasingly, you see more and more connections, so it's a myth that they're still air-gapped, although they were designed that way, it's not the case anymore, and actually, there's an increasing number of incidents, and I made the following slide. This is from Dragos, which is an American company who tracks threat actors, both nation-states but also ransomware nowadays, and these are just the incidents from Q2 this year, so you see it's quite a lot, and you see the different ransomware groups, and each dot is


chunk_text:
  untargeted, so that also means that everybody can become a victim, also OT environments, and they're not specifically targeting the OT process itself, but they're actually focusing on the IT systems because that's what they know and understand. They just run their playbook and run their scripts as they normally would. However, there's a lot of connections still between IT and OT. If you first start talking to people who run OT systems, they say, oh, it's not connected, and when you start asking questions, you say, oh, but how do you actually get your antivirus updates if you are running antivirus at all? How do you actually manage your system? And then increasingly, you see more and more connections, so it's a myth that they're still air-gapped, although they were designed that way, it's not the case anymore, and actually, there's an increasing number of incidents, and I made the following slide. This is from Dragos, which is an American company who tracks threat actors, both nation-states but also ransomware nowadays, and these are just the incidents from Q2 this year, so you see it's quite a lot, and you see the different ransomware groups, and each dot is one victim, so you can also see who's most popular, and it's actually increasing compared to Q1 as well, and that also has to do with the actions, the legal actions that were taken before, like some of the takedowns that were done by law enforcement, but it's actually increasing again, and you also see new groups, actually, they have never seen before, and of course, those are still on the right side there, they're not doing that many attacks yet, but there's actually an increase, and they also see government-affiliated groups now adopting ransomware attacks. They actually reused existing samples that are available, modified a bit, and actually also sort of hiked their tracks that way to make it seem like it's ransomware, but it may be not, or they're just trying to disrupt processes, and again, they're not targeting OT systems directly, but they're targeting maybe your active directory, which is mostly shared between IT and OT, or it's not shared, but there is a trust between them. Typically, a two-way trust, so basically, if effectively, for a ransomware actor who is domain admin in your IT environment, he can do whatever also to your OT systems, and


chunk_text:
  one victim, so you can also see who's most popular, and it's actually increasing compared to Q1 as well, and that also has to do with the actions, the legal actions that were taken before, like some of the takedowns that were done by law enforcement, but it's actually increasing again, and you also see new groups, actually, they have never seen before, and of course, those are still on the right side there, they're not doing that many attacks yet, but there's actually an increase, and they also see government-affiliated groups now adopting ransomware attacks. They actually reused existing samples that are available, modified a bit, and actually also sort of hiked their tracks that way to make it seem like it's ransomware, but it may be not, or they're just trying to disrupt processes, and again, they're not targeting OT systems directly, but they're targeting maybe your active directory, which is mostly shared between IT and OT, or it's not shared, but there is a trust between them. Typically, a two-way trust, so basically, if effectively, for a ransomware actor who is domain admin in your IT environment, he can do whatever also to your OT systems, and then we're talking, of course, about the Windows systems, more and more in the higher layers of your OT network, but that happens to be the HMIs that actually are a human-machine interface. That's what your operators look at. It's the SCADA systems that actually measure a lot of things on a bit higher level, like what's the production, et cetera. I don't know many operators who would happily run the environment if these systems are not available. I mean, the process itself might still run, but you don't have visibility anymore, and typically, that still means you actually go into controlled shutdown, or it could be as benign as your ERP system, which is actually, within your IT environment, is not available anymore, so you cannot produce or you cannot ship anymore. Your label printers are not working. Actually, the scales in your factory to weight what you've produced are out of order, so you still have to shut down, and actually, these numbers are quite high, and if you want to look at the full analysis, there's actually the link. I will, of course, also provide slides later, and then you can have a look, but it's actually,


chunk_text:
  then we're talking, of course, about the Windows systems, more and more in the higher layers of your OT network, but that happens to be the HMIs that actually are a human-machine interface. That's what your operators look at. It's the SCADA systems that actually measure a lot of things on a bit higher level, like what's the production, et cetera. I don't know many operators who would happily run the environment if these systems are not available. I mean, the process itself might still run, but you don't have visibility anymore, and typically, that still means you actually go into controlled shutdown, or it could be as benign as your ERP system, which is actually, within your IT environment, is not available anymore, so you cannot produce or you cannot ship anymore. Your label printers are not working. Actually, the scales in your factory to weight what you've produced are out of order, so you still have to shut down, and actually, these numbers are quite high, and if you want to look at the full analysis, there's actually the link. I will, of course, also provide slides later, and then you can have a look, but it's actually, yeah, most people overlook this actor in relation to OT networks, and then there is this group, the hacktivism group, and that's a difficult group to look at because it's really a mix from local environment groups to more organized groups, and we'll talk about these a little bit more in the next slide, and in essence, it's still untargeted. They're more device-oriented. They know how to hack into a certain device, and they're not targeting you specifically, but you just happen to have the device to know how to exploit, and like I said, there are diverse groups, but in the recent years, we see more and more that there are actually also connections and ties between these and APTs. They're sort of doing the dirty work, and I'll show you a bit more about that, and mostly they're targeting internet-connected OT devices, and that may sound strange. How do these devices end up on the internet? But there are actually quite a few, and technically, hacks have actually a low complexity. It's not hard to do. It's sometimes even devising banners on systems or clicking around in an HMI interface. They still have consequences, and there has been


chunk_text:
  yeah, most people overlook this actor in relation to OT networks, and then there is this group, the hacktivism group, and that's a difficult group to look at because it's really a mix from local environment groups to more organized groups, and we'll talk about these a little bit more in the next slide, and in essence, it's still untargeted. They're more device-oriented. They know how to hack into a certain device, and they're not targeting you specifically, but you just happen to have the device to know how to exploit, and like I said, there are diverse groups, but in the recent years, we see more and more that there are actually also connections and ties between these and APTs. They're sort of doing the dirty work, and I'll show you a bit more about that, and mostly they're targeting internet-connected OT devices, and that may sound strange. How do these devices end up on the internet? But there are actually quite a few, and technically, hacks have actually a low complexity. It's not hard to do. It's sometimes even devising banners on systems or clicking around in an HMI interface. They still have consequences, and there has been physical impact, but yeah, and it's quite a problem, actually, this group. Because if you look at the census query I've done yesterday evening, these are all the systems, and I'll just look at the numbers all the way on the left. You can actually see the number of systems that are identified by census as being ICS or SCADA-related. They have a couple of labels, and they're all over the world, but actually, the Netherlands is, well, what is it? I haven't counted exactly, but you can see it over there. Over 1,500 systems connected to the internet. Why are these systems there? Who put them on these networks? And I looked a little bit into it. You actually see a lot of systems that are connected to the IP ranges of mobile internet providers, so the KPNs, the Vodafone, Seagulls, et cetera, and why is that? Well, you have suppliers who may think it's a good idea to actually use a 4G router to connect these devices to the internet because they need to manage it. So there's still a lot of these devices around, and there's also different groups looking at these. So you have CAR, or


chunk_text:
  physical impact, but yeah, and it's quite a problem, actually, this group. Because if you look at the census query I've done yesterday evening, these are all the systems, and I'll just look at the numbers all the way on the left. You can actually see the number of systems that are identified by census as being ICS or SCADA-related. They have a couple of labels, and they're all over the world, but actually, the Netherlands is, well, what is it? I haven't counted exactly, but you can see it over there. Over 1,500 systems connected to the internet. Why are these systems there? Who put them on these networks? And I looked a little bit into it. You actually see a lot of systems that are connected to the IP ranges of mobile internet providers, so the KPNs, the Vodafone, Seagulls, et cetera, and why is that? Well, you have suppliers who may think it's a good idea to actually use a 4G router to connect these devices to the internet because they need to manage it. So there's still a lot of these devices around, and there's also different groups looking at these. So you have CAR, or Cyber Army of Russia Reborn. That is actually nowadays linked to Sandworm, so it's linked to an APT, and they look at the internet and what they can find, and the still of this HMI is actually from a video they put online where they are actually clicking on all buttons they can find and changing values. I really got the idea they have no clue what they're doing, and still they managed to overflow the water tank you see over there. And it's also hard to actually verify if these claims are true or not or if they're just fabricating information, but in this case, it was eventually confirmed that indeed they managed to overflow the water tank. And if I look at what they're doing in that video, I really look at like, do you actually understand at all what you're doing, or is it just sheer luck you actually managed to overflow the water tank? But still, they are causing issues. Another group is Cyber Adventures linked to Iran that actually are targeting Unitronics PLCs for the very reason that those are Israeli PLCs. So, if you happen to have these devices connected to the internet, hopefully


chunk_text:
  Cyber Army of Russia Reborn. That is actually nowadays linked to Sandworm, so it's linked to an APT, and they look at the internet and what they can find, and the still of this HMI is actually from a video they put online where they are actually clicking on all buttons they can find and changing values. I really got the idea they have no clue what they're doing, and still they managed to overflow the water tank you see over there. And it's also hard to actually verify if these claims are true or not or if they're just fabricating information, but in this case, it was eventually confirmed that indeed they managed to overflow the water tank. And if I look at what they're doing in that video, I really look at like, do you actually understand at all what you're doing, or is it just sheer luck you actually managed to overflow the water tank? But still, they are causing issues. Another group is Cyber Adventures linked to Iran that actually are targeting Unitronics PLCs for the very reason that those are Israeli PLCs. So, if you happen to have these devices connected to the internet, hopefully not, they will deface them. So, it's completely unrelated to your OT environment or your business. And then we have another group, which is quite hard to, I don't know, suspect or something like that, that's actually targeting Ukrainian telcos with wiperware. And that's what you also see. It's also where there's geopolitical tension, you see that there's actually these groups that pop up and may actually attack you. Spionage, more targeted, mostly targeted at critical infrastructure, because they want to have information about these environments. It's mostly about two things, gathering information about your OT environment, which is typically saved within your IT environment. So, they use either vulnerabilities or spear phishing to get a foothold, steal all the information they want, try to maintain that foothold, also the prepositioning to come back at a later time. One example of this is actually Fault Typhoon, who was in news before as well, but they have done a second attack where they actually target US critical infrastructure. So far, they have not reached the OT environment, but you see them targeting critical infrastructure. They actually use an unknown Fortinet exploit. In the past, I have also exploited ZeroDash, and they


chunk_text:
  not, they will deface them. So, it's completely unrelated to your OT environment or your business. And then we have another group, which is quite hard to, I don't know, suspect or something like that, that's actually targeting Ukrainian telcos with wiperware. And that's what you also see. It's also where there's geopolitical tension, you see that there's actually these groups that pop up and may actually attack you. Spionage, more targeted, mostly targeted at critical infrastructure, because they want to have information about these environments. It's mostly about two things, gathering information about your OT environment, which is typically saved within your IT environment. So, they use either vulnerabilities or spear phishing to get a foothold, steal all the information they want, try to maintain that foothold, also the prepositioning to come back at a later time. One example of this is actually Fault Typhoon, who was in news before as well, but they have done a second attack where they actually target US critical infrastructure. So far, they have not reached the OT environment, but you see them targeting critical infrastructure. They actually use an unknown Fortinet exploit. In the past, I have also exploited ZeroDash, and they have done a second attack where they do have ZeroDash. But once they are inside the network, so they start at the edge device, which is typically not very well monitored. But once they are within the network, you see the typical red teaming activity, living off the land. Yeah, quite detectable, I would say. But they try to maintain access for a long time, and I think it's because they want to preposition and come back at a later time. And that's actually what you see in the next group. So Sabotage, that's extremely targeted. And basically, you see it mostly being done by the Spinoz groups, or they might have a subgroup. So they first steal the information. They kind of work on some piece of malware, maybe specifically to that environment, and they come back at a later time. They already have the access to the IT environment. They still need to find their way into the OT environment. And from my own experience testing these environments, I know that's not that difficult. So once they're already prepositioned, they might come back. And the reason we don't see these kind of events that much is also it


chunk_text:
  have done a second attack where they do have ZeroDash. But once they are inside the network, so they start at the edge device, which is typically not very well monitored. But once they are within the network, you see the typical red teaming activity, living off the land. Yeah, quite detectable, I would say. But they try to maintain access for a long time, and I think it's because they want to preposition and come back at a later time. And that's actually what you see in the next group. So Sabotage, that's extremely targeted. And basically, you see it mostly being done by the Spinoz groups, or they might have a subgroup. So they first steal the information. They kind of work on some piece of malware, maybe specifically to that environment, and they come back at a later time. They already have the access to the IT environment. They still need to find their way into the OT environment. And from my own experience testing these environments, I know that's not that difficult. So once they're already prepositioned, they might come back. And the reason we don't see these kind of events that much is also it has political consequences, because these are state-sponsored actors, and you're targeting other countries. So what they mostly do till now is that they actually run those activism groups as a sort of front to do the, at least, you know, try to poke the bear a bit to see how people respond, and then don't do the full attack shit, although there have been some cases. And I actually put them in a timeline, and I'm really glad this screen is quite big, because I've struggled quite a bit to make this timeline, because some of the malware is a bit smaller, but I hope it's still readable. But till now, there are only nine pieces of malware that are known to specifically target ICS systems and protocols, and that's over a time span of 14 years. So just to give you an idea that, yes, if you get targeted by these malware samples, and you have an actor using it in your network, the consequences can be high. But what is the chance, actually? And if you're not critical infrastructure, maybe this is not your biggest concern. Compared to the numbers of one quarter of the cybercrime and the


chunk_text:
  has political consequences, because these are state-sponsored actors, and you're targeting other countries. So what they mostly do till now is that they actually run those activism groups as a sort of front to do the, at least, you know, try to poke the bear a bit to see how people respond, and then don't do the full attack shit, although there have been some cases. And I actually put them in a timeline, and I'm really glad this screen is quite big, because I've struggled quite a bit to make this timeline, because some of the malware is a bit smaller, but I hope it's still readable. But till now, there are only nine pieces of malware that are known to specifically target ICS systems and protocols, and that's over a time span of 14 years. So just to give you an idea that, yes, if you get targeted by these malware samples, and you have an actor using it in your network, the consequences can be high. But what is the chance, actually? And if you're not critical infrastructure, maybe this is not your biggest concern. Compared to the numbers of one quarter of the cybercrime and the ransomware, you actually see there's a huge difference. And still, I see a lot of focus on this one. I actually quite recently was at an event, and I won't give any more details what it was exactly, but there somebody said, yeah, nature states, we can do nothing about it. And first question, of course, is nature states really your biggest concern? And second is, well, can you do something about it? I think there's still things you can do. Because if we look at the common vulnerabilities and weaknesses we see within these environments, it's not that shocking, actually. But first, a bit about security testing. So right now, I'm working as a CTI specialist, but I used to test these networks for a living. Not full time. But I spent quite some time developing, actually, a way to securely test these systems. Because one thing you might know, if you run an OT environment, typically you don't want somebody as one of the pen testers running around without any idea what he's testing, because he will actually take down your systems. Because they're less resistant to security testing. Why? Well, they haven't been exposed to security testing


chunk_text:
  ransomware, you actually see there's a huge difference. And still, I see a lot of focus on this one. I actually quite recently was at an event, and I won't give any more details what it was exactly, but there somebody said, yeah, nature states, we can do nothing about it. And first question, of course, is nature states really your biggest concern? And second is, well, can you do something about it? I think there's still things you can do. Because if we look at the common vulnerabilities and weaknesses we see within these environments, it's not that shocking, actually. But first, a bit about security testing. So right now, I'm working as a CTI specialist, but I used to test these networks for a living. Not full time. But I spent quite some time developing, actually, a way to securely test these systems. Because one thing you might know, if you run an OT environment, typically you don't want somebody as one of the pen testers running around without any idea what he's testing, because he will actually take down your systems. Because they're less resistant to security testing. Why? Well, they haven't been exposed to security testing that much. Sometimes they run on limited resources, specifically the more low level device like the PLCs, you can easily overflow them just by running mapp with the wrong parameters. It's that easy. And you could still say, well, availability is most important. So that's an interesting contradiction. But yeah, you don't want to do that in production. Also, there are almost no test environments. There's no spare parts. There's no redundancy. There's sometimes some redundancy within the process. But for instance, if a PLC breaks and they need to replace it, they need to go to their supplier. They don't have one in stock. They don't have a test environment. So how do you actually test your updates for your PLCs? Or maybe you just don't update them. Maybe that's easier in these cases. And that's why an OT security assessment, as I designed it, is actually a combination of an architectural and configuration review combined with some light security testing. Because it's too dangerous to do it in production. And if you want to have an idea, this is actually from Control Things IO. They provide this PDF, which has a great overview what scans are somewhat safe


chunk_text:
  that much. Sometimes they run on limited resources, specifically the more low level device like the PLCs, you can easily overflow them just by running mapp with the wrong parameters. It's that easy. And you could still say, well, availability is most important. So that's an interesting contradiction. But yeah, you don't want to do that in production. Also, there are almost no test environments. There's no spare parts. There's no redundancy. There's sometimes some redundancy within the process. But for instance, if a PLC breaks and they need to replace it, they need to go to their supplier. They don't have one in stock. They don't have a test environment. So how do you actually test your updates for your PLCs? Or maybe you just don't update them. Maybe that's easier in these cases. And that's why an OT security assessment, as I designed it, is actually a combination of an architectural and configuration review combined with some light security testing. Because it's too dangerous to do it in production. And if you want to have an idea, this is actually from Control Things IO. They provide this PDF, which has a great overview what scans are somewhat safe to run and what scans are highly dangerous to run in these environments. I would recommend to have a look at this presentation. Because you will be surprised that even a simple fingerprint from EMAP might already crash your device. So you really have to know what you're doing. And during the assessments, what we've done is that we actually used also the same monitoring appliances they use for monitoring these networks. So one thing we would do is actually connect our own system to the network, actually have a trunk port into the network. So you could actually hop between VLANs. Scan when in local VLANs, not through firewalls. And yeah, be very careful what you do. And then you find a lot of things. There's actually a lot of things wrong. It already starts with when you start requesting your information to actually do this properly. Because you do this in a white box fashion. You want as much information as possible. But you already notice that when you start asking about network drawings and assets overviews, that they're not there. Either you don't have a network drawing or you have a network drawing that's outdated. Or you


chunk_text:
  to run and what scans are highly dangerous to run in these environments. I would recommend to have a look at this presentation. Because you will be surprised that even a simple fingerprint from EMAP might already crash your device. So you really have to know what you're doing. And during the assessments, what we've done is that we actually used also the same monitoring appliances they use for monitoring these networks. So one thing we would do is actually connect our own system to the network, actually have a trunk port into the network. So you could actually hop between VLANs. Scan when in local VLANs, not through firewalls. And yeah, be very careful what you do. And then you find a lot of things. There's actually a lot of things wrong. It already starts with when you start requesting your information to actually do this properly. Because you do this in a white box fashion. You want as much information as possible. But you already notice that when you start asking about network drawings and assets overviews, that they're not there. Either you don't have a network drawing or you have a network drawing that's outdated. Or you have a network drawing that's outdated. I've had network drawings that were literally the place where the 19-inch rack and where the servers were or where the physical network connections were, but no logical layer two, layer three network design. Or it was really fragmented and the vendor only or supplier only drawn their own part of the network. But there was no overview. And that's really shocking to me. Because these environments are pretty static. They don't change that. But of course, there is some upgrades. There are vendors coming in and out. But compared to an IT environment, it's really static. And still, they don't have an asset overview. So how can you secure if you don't know what you have? And then, of course, there's the firewall network switch configurations. As you may know, there is a firewall between IT and OT. And sometimes two even, back to back, different vendors, things like that. But does it really matter if you have one or two if they're really badly configured? Because that is what I've seen in practice. I went through all those firewall rules. And there's a lot of any-any's. There's a lot of like testing


chunk_text:
  have a network drawing that's outdated. I've had network drawings that were literally the place where the 19-inch rack and where the servers were or where the physical network connections were, but no logical layer two, layer three network design. Or it was really fragmented and the vendor only or supplier only drawn their own part of the network. But there was no overview. And that's really shocking to me. Because these environments are pretty static. They don't change that. But of course, there is some upgrades. There are vendors coming in and out. But compared to an IT environment, it's really static. And still, they don't have an asset overview. So how can you secure if you don't know what you have? And then, of course, there's the firewall network switch configurations. As you may know, there is a firewall between IT and OT. And sometimes two even, back to back, different vendors, things like that. But does it really matter if you have one or two if they're really badly configured? Because that is what I've seen in practice. I went through all those firewall rules. And there's a lot of any-any's. There's a lot of like testing rules and I'll fix to be later, to be fixed later. And nobody dares to touch them anymore. Because they don't have a clue on the protocol level how these networks work. So yeah, in a network where you want to have high availability, or availability is most important, you don't touch it as long as it works. And then you accumulate over the years a very large rule base. But after about 50 rules, you can basically say, OK, this is sort of like an any-any-any rule. So it's not that useful anymore. Another thing is remote access. Because you have a large dependency on suppliers coming in or doing remote maintenance. And you actually are really dependent on them. Because typically the asset owner don't know anymore how to run these networks themselves. So if the vendor demands they want to have remote access, they get remote access. And how do they get remote access? Well, quite literally VPNing somewhere in the network. Literally directly into your OT network. Or they nowadays have these boxes that make reverse connection to a sort of cloud. So then you don't have to configure a firewall anymore. You can actually connect


chunk_text:
  rules and I'll fix to be later, to be fixed later. And nobody dares to touch them anymore. Because they don't have a clue on the protocol level how these networks work. So yeah, in a network where you want to have high availability, or availability is most important, you don't touch it as long as it works. And then you accumulate over the years a very large rule base. But after about 50 rules, you can basically say, OK, this is sort of like an any-any-any rule. So it's not that useful anymore. Another thing is remote access. Because you have a large dependency on suppliers coming in or doing remote maintenance. And you actually are really dependent on them. Because typically the asset owner don't know anymore how to run these networks themselves. So if the vendor demands they want to have remote access, they get remote access. And how do they get remote access? Well, quite literally VPNing somewhere in the network. Literally directly into your OT network. Or they nowadays have these boxes that make reverse connection to a sort of cloud. So then you don't have to configure a firewall anymore. You can actually connect that way. But you still see that these networks are managed by suppliers that connect on the network level. So basically, if they run the wrong command or they are infected with malware, it might actually spread into your OT network. So that's quite dangerous as well. I haven't discussed the network switches that much. I forgot those. What you typically see with the network switches is that they are shared between IT and OT. So they do use different VLANs. But I had situations where actually the management interface with a very weak password was exposed to the IT side. So I once actually phoned a customer and said, OK, now connect to this IP address, log in with this password. And you're actually on the switch. And you're actually on the switch. And I said, well, now you can also see your OT networks. You might be able to reconfigure it if you have the experience and the knowledge. And of course, this is a little bit more advanced tech. But we also see some actors actually hacking into firewalls and VPN devices. I'm sure they might be able to configure a Cisco switch. And the same thing


chunk_text:
  that way. But you still see that these networks are managed by suppliers that connect on the network level. So basically, if they run the wrong command or they are infected with malware, it might actually spread into your OT network. So that's quite dangerous as well. I haven't discussed the network switches that much. I forgot those. What you typically see with the network switches is that they are shared between IT and OT. So they do use different VLANs. But I had situations where actually the management interface with a very weak password was exposed to the IT side. So I once actually phoned a customer and said, OK, now connect to this IP address, log in with this password. And you're actually on the switch. And you're actually on the switch. And I said, well, now you can also see your OT networks. You might be able to reconfigure it if you have the experience and the knowledge. And of course, this is a little bit more advanced tech. But we also see some actors actually hacking into firewalls and VPN devices. I'm sure they might be able to configure a Cisco switch. And the same thing is true for virtualization. Also, virtualization solutions, they are used quite heavily now in OT environments as well for the Windows systems or the higher layer systems. But again, it's shared between IT and OT. And one step further, it's also integrated with their active directory. So now you have an actor, even ransomware actor, that is domain admin in your IT environment. Guess what? He also controls your complete OT environment. Because if he does a simple shutdown, well, good luck. So there are these things that you see over and over again. And then we talk a little bit more about the network design. And who is familiar with the Purdue model here? Ooh, not that many people. Okay. The Purdue model is a model that is more like a layered model, how you can actually organize your IT and OT networks. So it starts at the top, level five, which is actually your internet DMZ, as you would have in your IT environment. Then the enterprise zone, level four, is your internal network, your IT environment. And then you have a firewall between IT and OT, which I mentioned previously. There's not one version of the Purdue


chunk_text:
  is true for virtualization. Also, virtualization solutions, they are used quite heavily now in OT environments as well for the Windows systems or the higher layer systems. But again, it's shared between IT and OT. And one step further, it's also integrated with their active directory. So now you have an actor, even ransomware actor, that is domain admin in your IT environment. Guess what? He also controls your complete OT environment. Because if he does a simple shutdown, well, good luck. So there are these things that you see over and over again. And then we talk a little bit more about the network design. And who is familiar with the Purdue model here? Ooh, not that many people. Okay. The Purdue model is a model that is more like a layered model, how you can actually organize your IT and OT networks. So it starts at the top, level five, which is actually your internet DMZ, as you would have in your IT environment. Then the enterprise zone, level four, is your internal network, your IT environment. And then you have a firewall between IT and OT, which I mentioned previously. There's not one version of the Purdue model. That's a bit unfortunate because there are versions with or without level three and a half, which is the DMZ. Sometimes it's called level three, and then there's still DMZ. But yeah, there are some different versions. But actually, as you have a DMZ between the internet and your internal network, you would also have a DMZ between your internal network and the OT network. What I see mostly is that that firewall is there, but there is no DMZ. So through that firewall, we allow direct connections between IT and OT, sometimes both ways. And over here, a little bit less easy to see, but here between level three and two, you also see firewalls. And you have these zones, which actually could be different factories. So those are also separated. What I typically see is that there might be a firewall between IT and OT, but the rest of the network is almost flat, or there's some VLANs, but there's never a firewall in between anymore. So between level three and two, I don't see that being used at all. And I've also had a situation where I looked at network designs and looked at what it


chunk_text:
  model. That's a bit unfortunate because there are versions with or without level three and a half, which is the DMZ. Sometimes it's called level three, and then there's still DMZ. But yeah, there are some different versions. But actually, as you have a DMZ between the internet and your internal network, you would also have a DMZ between your internal network and the OT network. What I see mostly is that that firewall is there, but there is no DMZ. So through that firewall, we allow direct connections between IT and OT, sometimes both ways. And over here, a little bit less easy to see, but here between level three and two, you also see firewalls. And you have these zones, which actually could be different factories. So those are also separated. What I typically see is that there might be a firewall between IT and OT, but the rest of the network is almost flat, or there's some VLANs, but there's never a firewall in between anymore. So between level three and two, I don't see that being used at all. And I've also had a situation where I looked at network designs and looked at what it looked in practice. And I also found loopholes around firewalls, like extra connections they forgot to remove and all sorts of things. So people really don't seem to understand how to use this model in the correct way and how to architecture your network using this design. And why is this so important? Well, as you may know, some of the OT protocols that are being used are by design insecure. They don't use encryption. They use either no authentication or weak authentication. So having a layered network design is actually a very important defense mechanism. And if you don't have that, well, there's not that much that can protect you in some cases. And also, if you want to do this right, basically, you want to have no direct connections between IT and OT or the internet. And you might think, internet? I have actually seen situations where maintenance was allowed directly in from the vendor, all the way straight to your devices, sometimes even into the lower levels, like level 2 or even level 1. So yeah, that's not the way to do it. You actually have a DMZ. You should also have intermediate systems in there. And


chunk_text:
  looked in practice. And I also found loopholes around firewalls, like extra connections they forgot to remove and all sorts of things. So people really don't seem to understand how to use this model in the correct way and how to architecture your network using this design. And why is this so important? Well, as you may know, some of the OT protocols that are being used are by design insecure. They don't use encryption. They use either no authentication or weak authentication. So having a layered network design is actually a very important defense mechanism. And if you don't have that, well, there's not that much that can protect you in some cases. And also, if you want to do this right, basically, you want to have no direct connections between IT and OT or the internet. And you might think, internet? I have actually seen situations where maintenance was allowed directly in from the vendor, all the way straight to your devices, sometimes even into the lower levels, like level 2 or even level 1. So yeah, that's not the way to do it. You actually have a DMZ. You should also have intermediate systems in there. And typically, you also want to pull the data from the systems in your planned DMZ. So the systems in your OT environment should actually connect towards level 3.5 and get the information and not vice versa. So you don't want to have incoming connections from level 3.5 downwards towards your process. One thing I forgot to mention is this is basically as close to the process you can get. So this is actually your sensors, your activators, your field devices that actually control and measure your process. Level 3 is where you find the Windows systems, the Windows-based systems. So there, your Active Directory could live, your engineering workstation, which is also very important because that is the system where you have the software installed to actually program your PLCs. So where will attackers go? If they are really targeting your environment, they will go to your engineering workstation or they might hit your domain controller, which is also there, depending on if it's a separate domain or not. And then, of course, like I mentioned, we have these Windows systems and we have the Active Directory being shared or trusted, but we also have the systems itself. And there


chunk_text:
  typically, you also want to pull the data from the systems in your planned DMZ. So the systems in your OT environment should actually connect towards level 3.5 and get the information and not vice versa. So you don't want to have incoming connections from level 3.5 downwards towards your process. One thing I forgot to mention is this is basically as close to the process you can get. So this is actually your sensors, your activators, your field devices that actually control and measure your process. Level 3 is where you find the Windows systems, the Windows-based systems. So there, your Active Directory could live, your engineering workstation, which is also very important because that is the system where you have the software installed to actually program your PLCs. So where will attackers go? If they are really targeting your environment, they will go to your engineering workstation or they might hit your domain controller, which is also there, depending on if it's a separate domain or not. And then, of course, like I mentioned, we have these Windows systems and we have the Active Directory being shared or trusted, but we also have the systems itself. And there are a lot of vulnerabilities because these systems are either not patched or not regularly patched. And that's a difficult thing because, yeah, sometimes processes run 24-7. So there are not that many Windows to patch. However, I've seen systems that have not been patched for 10 years. And I'm quite sure that in most processes, there is somewhere a maintenance window. And also, because some of the software running on these systems is very dependent on the configuration of the system, you cannot patch these systems yourself because the supplier will demand how the system should be configured. And most of the times, it's not very secure. And I think this is also an area where a lot of cooperation is needed with your suppliers to also stimulate them a bit to come up with more secure configurations, actually build like a golden image, which is securely configured because we do use virtualization a lot. So that actually means you can build secure templates in cooperation with your supplier and use those. And also, the hardening of the systems. Typically, if you look at these systems, every piece of software that they might need for support and everything else


chunk_text:
  are a lot of vulnerabilities because these systems are either not patched or not regularly patched. And that's a difficult thing because, yeah, sometimes processes run 24-7. So there are not that many Windows to patch. However, I've seen systems that have not been patched for 10 years. And I'm quite sure that in most processes, there is somewhere a maintenance window. And also, because some of the software running on these systems is very dependent on the configuration of the system, you cannot patch these systems yourself because the supplier will demand how the system should be configured. And most of the times, it's not very secure. And I think this is also an area where a lot of cooperation is needed with your suppliers to also stimulate them a bit to come up with more secure configurations, actually build like a golden image, which is securely configured because we do use virtualization a lot. So that actually means you can build secure templates in cooperation with your supplier and use those. And also, the hardening of the systems. Typically, if you look at these systems, every piece of software that they might need for support and everything else is stalled. And it ranges from old flash versions to the full office suite, all sorts of software which they may not need. So removing all that extra software actually limits your attack service a lot. And then if we look at the lower level devices, it's even easier. If you want to hack those, the first thing you do is look up the manual of these devices. In there, you will find the default password. 9 out of 10 these work. And not always do you see those network or those management interfaces exposed to the rest of the network. I mean, it might be the local network segment, you only can access these. But I've seen also situations due to misconfiguration, you could actually access these from the IT environment. And once you log in, it's as simple as doing a shutdown or reset the configuration and just reconfigure the IP address. Remember, availability gone. And then we, of course, have also vulnerabilities in these devices. And patching is, like I mentioned, is always difficult. But again, once you know about these vulnerabilities, if you don't have the layered network design in place, you don't have another option


chunk_text:
  is stalled. And it ranges from old flash versions to the full office suite, all sorts of software which they may not need. So removing all that extra software actually limits your attack service a lot. And then if we look at the lower level devices, it's even easier. If you want to hack those, the first thing you do is look up the manual of these devices. In there, you will find the default password. 9 out of 10 these work. And not always do you see those network or those management interfaces exposed to the rest of the network. I mean, it might be the local network segment, you only can access these. But I've seen also situations due to misconfiguration, you could actually access these from the IT environment. And once you log in, it's as simple as doing a shutdown or reset the configuration and just reconfigure the IP address. Remember, availability gone. And then we, of course, have also vulnerabilities in these devices. And patching is, like I mentioned, is always difficult. But again, once you know about these vulnerabilities, if you don't have the layered network design in place, you don't have another option to patch, I think, because you don't have any protections. Because if, for instance, there is a vulnerability in a specific ICS protocol, which is only exposed in the local network segment and not accessible from remote, you could say, okay, I have this protection in place, I can patch at a later time. But if you don't have that network design and everything is open, you will have to patch or not and hope for the best. And then there's this interesting thing about the management protocols. So typically, PLCs or whatever devices, they might have management software. And this is something you typically do in a test environment. So sometimes you have a specific device you can test within a test environment. What I 9 out of 10 do first is get the management software. Why? Because they have all these mechanisms to actually log in without authentication. And you will find the weirdest serial protocols stacked on top of UDP packets on a random high port you never heard about. And you can actually access these devices without any vulnerabilities. And remember that if we do talk a bit about APTs, that there is, there are quite


chunk_text:
  to patch, I think, because you don't have any protections. Because if, for instance, there is a vulnerability in a specific ICS protocol, which is only exposed in the local network segment and not accessible from remote, you could say, okay, I have this protection in place, I can patch at a later time. But if you don't have that network design and everything is open, you will have to patch or not and hope for the best. And then there's this interesting thing about the management protocols. So typically, PLCs or whatever devices, they might have management software. And this is something you typically do in a test environment. So sometimes you have a specific device you can test within a test environment. What I 9 out of 10 do first is get the management software. Why? Because they have all these mechanisms to actually log in without authentication. And you will find the weirdest serial protocols stacked on top of UDP packets on a random high port you never heard about. And you can actually access these devices without any vulnerabilities. And remember that if we do talk a bit about APTs, that there is, there are quite some resources on that end as well. What do you think what they will do? Of course, they will read the manual. They will look at existing vulnerabilities. And they will also look at those management protocols. And this is also if we see as well. So I go back a bit because I forgot to mention something on this slide. If we look at some of the more recent malware, you actually see they abuse the legitimate ICS protocols to actually just control systems. So for instance, we start with the latest one, Frosty Goop. That was actually just a piece of software that had a Modbus library implemented that could talk to a certain PLC. And just by knowing what registries and values to read or write, you could actually shut down these systems. And that were actually, yeah, were actually a management system for buildings. So building management systems in Ukraine, and they actually shut those down. So my conclusions, there's still a lot of room for improving security for the environment, at least in my experience. And I have to say that that depends a bit on what industry you're in. Because some industries like oil


chunk_text:
  some resources on that end as well. What do you think what they will do? Of course, they will read the manual. They will look at existing vulnerabilities. And they will also look at those management protocols. And this is also if we see as well. So I go back a bit because I forgot to mention something on this slide. If we look at some of the more recent malware, you actually see they abuse the legitimate ICS protocols to actually just control systems. So for instance, we start with the latest one, Frosty Goop. That was actually just a piece of software that had a Modbus library implemented that could talk to a certain PLC. And just by knowing what registries and values to read or write, you could actually shut down these systems. And that were actually, yeah, were actually a management system for buildings. So building management systems in Ukraine, and they actually shut those down. So my conclusions, there's still a lot of room for improving security for the environment, at least in my experience. And I have to say that that depends a bit on what industry you're in. Because some industries like oil and gas, and maybe the electricity companies may have a higher security standard. But still, I've seen a lot of things go wrong. And actually, threat intel may help you to focus your efforts and actually determine what your risk is. And it's not hard, but it does require effort. Yeah, I think I mentioned most things already. So a couple of quick wins. Also start with an asset inventory, work together with your vendor, and improve your network architecture. And now, if you still worry about nation states, and I put in some memes there. The guy over there is Rob Joyce. He used to be the Director of Tailored Access Operations from the NSA. He actually did a brilliant presentation already in 2016, where he explains how nation states attack and what they actually do. And they say, well, they adapt to the target. They won't use zero days if they don't need to. They will invest the time and money to really know your systems. And actually, the security measures I just mentioned, if you take these, like network segmentation, you make their life hard as well. And if you don't believe me, watch his presentation. That's


chunk_text:
  and gas, and maybe the electricity companies may have a higher security standard. But still, I've seen a lot of things go wrong. And actually, threat intel may help you to focus your efforts and actually determine what your risk is. And it's not hard, but it does require effort. Yeah, I think I mentioned most things already. So a couple of quick wins. Also start with an asset inventory, work together with your vendor, and improve your network architecture. And now, if you still worry about nation states, and I put in some memes there. The guy over there is Rob Joyce. He used to be the Director of Tailored Access Operations from the NSA. He actually did a brilliant presentation already in 2016, where he explains how nation states attack and what they actually do. And they say, well, they adapt to the target. They won't use zero days if they don't need to. They will invest the time and money to really know your systems. And actually, the security measures I just mentioned, if you take these, like network segmentation, you make their life hard as well. And if you don't believe me, watch his presentation. That's it.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=p-KPJjTOum4", "title": "Protecting Organizations Against AITM: Lessons Learned - Rik Van Duijn & Wesley", "description": "", "channel_url": "https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA", "duration": 1777, "channel": "OrangeCon", "uploader": "OrangeCon", "upload_date": "20240909" } This text was transcribed using whisper model: large-v2 Well, let's get started. Today we would like to share some security research we did on ATM, phishing attacks. The problem, how big it is, prevention, detection, just things we found out since January we started with this security research. So who are we? My name is Westin Eylek. My colleague is Rik van Duin. We are both co-founders of Zolder, a cybersecurity company. And we have mainly experience in pen testing over 10 years. So we've seen a lot of companies checking out the vulnerabilities they have and advising them on solving those issues. But since the start of Zolder, we also started creating more defensive solutions such as our app called Attic, which we use to protect Microsoft 365 environments. And that's also why we did security research on this part. So our goal with Attic is to protect a lot of companies on a big scale. So just the basic stuff, not a nation state attack, but just the confirmation of your MFA, monitoring with Azure Sentinel. We want to protect a lot of companies once and have a big impact like that. Well, the problem we've seen is that we've seen a big increase of MFA ATM attacks. And the issue is here that they are bypassing the MFA on your Microsoft 365 account. And the interesting part is that we as a cybersecurity community pushed a lot of companies to use MFA because that would solve any phishing attacks. But now the cybercriminals are moving to ATM, which allows them to bypass MFA. For example, the push notification on your phone or a text message is pretty easy to bypass using ATM. Just some history. Well, in the early days, it was pretty simple, just phishing username, password. You could just spray a lot of emails, spray a lot of text messages, and you could sleep and then just wait until the results came in. So at that time, phishing was pretty easy because you only needed the username and the password. Well, that's why a lot of companies introduced things like MFA, a second factor, which makes it harder for you to break into the accounts. Well,


chunk_text:
  of your MFA, monitoring with Azure Sentinel. We want to protect a lot of companies once and have a big impact like that. Well, the problem we've seen is that we've seen a big increase of MFA ATM attacks. And the issue is here that they are bypassing the MFA on your Microsoft 365 account. And the interesting part is that we as a cybersecurity community pushed a lot of companies to use MFA because that would solve any phishing attacks. But now the cybercriminals are moving to ATM, which allows them to bypass MFA. For example, the push notification on your phone or a text message is pretty easy to bypass using ATM. Just some history. Well, in the early days, it was pretty simple, just phishing username, password. You could just spray a lot of emails, spray a lot of text messages, and you could sleep and then just wait until the results came in. So at that time, phishing was pretty easy because you only needed the username and the password. Well, that's why a lot of companies introduced things like MFA, a second factor, which makes it harder for you to break into the accounts. Well, a next step we've seen is, for example, uAdmin, which was used by a lot of Dutch cybercriminals to do the Marktplaatsfraude or WhatsApp fraude. This was the next step. For example, they were trying to phish the ING bank, which also used some second factors, and they were luring the victim into the phish, for example, on the left page. And when the victim fills in the username and password, the victim will wait and the real criminal will log in at ING with your credentials and just give the response back to you as a victim. So this was a manual way of bypassing the extra steps, the multi-factor authentication. This is, by the way, still being used by the Dutch criminals because this phishing panel is sold all on Telegram, shared for 50 euro or something. So this is still used and doesn't require a lot of technical knowledge, and it's still effective. But in 2017, 2018, this tool was released, Evil Jinx. I remember it. We were pen testing, so we, of course, dived into the tool. But still, at that time, it was quite small. It wasn't really becoming big at once. But at this


chunk_text:
  a next step we've seen is, for example, uAdmin, which was used by a lot of Dutch cybercriminals to do the Marktplaatsfraude or WhatsApp fraude. This was the next step. For example, they were trying to phish the ING bank, which also used some second factors, and they were luring the victim into the phish, for example, on the left page. And when the victim fills in the username and password, the victim will wait and the real criminal will log in at ING with your credentials and just give the response back to you as a victim. So this was a manual way of bypassing the extra steps, the multi-factor authentication. This is, by the way, still being used by the Dutch criminals because this phishing panel is sold all on Telegram, shared for 50 euro or something. So this is still used and doesn't require a lot of technical knowledge, and it's still effective. But in 2017, 2018, this tool was released, Evil Jinx. I remember it. We were pen testing, so we, of course, dived into the tool. But still, at that time, it was quite small. It wasn't really becoming big at once. But at this time, we've seen a big grow in the usage of this tool, but also the usage of the technique that this tool is using. So this is a tool that performs ATM attacks, and you have, of course, many more. But this one is open source and available to everyone. So we asked ourselves the question, why now? So we've seen a huge increase in attacks against Microsoft 365. We've seen a huge increase in similar phishing attacks against other services like Booking.com. But the technique and the tools have been available since 2017, and we've been using them a bit, and it's been used in pen testing services. And for us, the main thing is there are SaaS services that provide the tooling, that provide modification, if you require it. You pay each week or each month, and you get a nice phishing panel. Another reason is obviously more and more MFA, which is great. It forces these types of attackers to change their tactics, which at least costs some effort. But since it's all SaaS-ified now, yeah, that introduces quite a problem. And more importantly, it just works on large scale. So where initially we could phish 1,000


chunk_text:
  time, we've seen a big grow in the usage of this tool, but also the usage of the technique that this tool is using. So this is a tool that performs ATM attacks, and you have, of course, many more. But this one is open source and available to everyone. So we asked ourselves the question, why now? So we've seen a huge increase in attacks against Microsoft 365. We've seen a huge increase in similar phishing attacks against other services like Booking.com. But the technique and the tools have been available since 2017, and we've been using them a bit, and it's been used in pen testing services. And for us, the main thing is there are SaaS services that provide the tooling, that provide modification, if you require it. You pay each week or each month, and you get a nice phishing panel. Another reason is obviously more and more MFA, which is great. It forces these types of attackers to change their tactics, which at least costs some effort. But since it's all SaaS-ified now, yeah, that introduces quite a problem. And more importantly, it just works on large scale. So where initially we could phish 1,000 or 10,000 users and just go to sleep, wake up, and get like username, password, and then later you could use that, then you go to like the banking-style fraud where you're manually like a mule, copy and pasting everything. And now you can go back to sleep again. Well, not entirely. You still need to act like semi-quick, but it allows you to do things at scale, which is always interesting and important for criminals. And it's what they do. The attacks we see are like, yeah, not to be unfriendly towards those types of people, but most of the problem creators are not the people that are really skilled. They learn a trick, and they just keep doing it until it doesn't work anymore. And with these SaaS-ified services, this creates that problem. The current threats, of course. So, current threats. My slides. Well, as I've said before, there's been a huge increase in, especially Microsoft 365 AATM attacks, phishing at a large scale, allowing backfraud to be more successful. Microsoft announced like a 111% increase in token replay. Well, that's both reverse proxy attacks and just malware stealing tokens from the browser or your system. But yeah,


