# MediaChunks

chunk_text:
  visualization perspective, if we make the filter correctly, what we can do is we can make a connection back to the let's say user A made this commit on repository B and repository B eventually triggered the build C and that build C like I said goes back to the artifactory artifact A. So that's how we can build the relationship at this point of time from a filtering perspective, it just displays the one particular path. So going forward, obviously, the first part is the expansion on the technologies more. Like I said, the more technology solution will cover the better relationship it will be able to build. These are the few I have in pipeline. If you have any feedback, feel free to open up an issue or the pull request into the into the repository and then we can take it from there. I think but my personal focus is on the analysis part. The more technology we build, the more type of nodes we will have. And what I mean by that is that more analysis we have to build. The primary reason of making this project was to build on the analysis engine more, which means that parsing of the of the different components more and try to identify the relationship between them as well. For example, it could be if we consider any software based organization, let's go with the microservice architecture where multiple repositories are responsible for building one service. Can we find that relationship that service S is built by five different repositories? So if we are able to build that kind of relationship, we will eventually be able to connect that which users change triggered, which change in the service in the microservice architecture. Can we build a relation on the on the contributing to a particular microservice and all and second part is obviously the next part is the is the build the intuitive visualization which include making the search engine more effective. For example, all the metadata can be make a search engine on the basis of the all metadata. So these are the parts on the on the going forward way. Like I said, first of all, thank you for being here. And if you want to know more about the Netscope and the product in general, please feel free to reach out. So thank you for the


chunk_text:
  means that parsing of the of the different components more and try to identify the relationship between them as well. For example, it could be if we consider any software based organization, let's go with the microservice architecture where multiple repositories are responsible for building one service. Can we find that relationship that service S is built by five different repositories? So if we are able to build that kind of relationship, we will eventually be able to connect that which users change triggered, which change in the service in the microservice architecture. Can we build a relation on the on the contributing to a particular microservice and all and second part is obviously the next part is the is the build the intuitive visualization which include making the search engine more effective. For example, all the metadata can be make a search engine on the basis of the all metadata. So these are the parts on the on the going forward way. Like I said, first of all, thank you for being here. And if you want to know more about the Netscope and the product in general, please feel free to reach out. So thank you for the talk. Any questions? Yeah. Hey, thanks for the for the talk. So you said the project is open source, but the repository is actually empty right now. Yeah. Yeah. I am going to put the code after that. OK, cool. And so my question is like, how many or how different or what kind of detections do you have there? Like that's probably the main, main, main point of the tool, right? What do you mean? The technologies? No. Like what kind of vulnerabilities do you detect there? Oh, OK. So in terms of, so in terms of category of vulnerability, like there are different components. The first I'm trying to identify whether there are any basic and secure configuration, for example, default credentials, HTTPS enabled or not, what kind of users are there in the system. And it will vary from technologies to technology as well. So, for example, in case of GitHub Action, one of the findings is what are you using any well-known vulnerable version of the third party software? In case of Jenkins, for example, it could be like, are you using vulnerable version of plugins or outdated version of plugins? In case of GitHub, it


chunk_text:
  talk. Any questions? Yeah. Hey, thanks for the for the talk. So you said the project is open source, but the repository is actually empty right now. Yeah. Yeah. I am going to put the code after that. OK, cool. And so my question is like, how many or how different or what kind of detections do you have there? Like that's probably the main, main, main point of the tool, right? What do you mean? The technologies? No. Like what kind of vulnerabilities do you detect there? Oh, OK. So in terms of, so in terms of category of vulnerability, like there are different components. The first I'm trying to identify whether there are any basic and secure configuration, for example, default credentials, HTTPS enabled or not, what kind of users are there in the system. And it will vary from technologies to technology as well. So, for example, in case of GitHub Action, one of the findings is what are you using any well-known vulnerable version of the third party software? In case of Jenkins, for example, it could be like, are you using vulnerable version of plugins or outdated version of plugins? In case of GitHub, it will be, for example, do you have MF enabled or not? So because and so that is the library of the vulnerabilities I have in terms of each technologies. And with my tool, I'm going to also publish, you know, kind of knowledge base that which kind of vulnerability I'm detecting in our tool, irrespective whether it got detected or not. Make sense? OK, thanks. Any other question? Was it that good or that bad? You were that good. Oh, thanks. Good. But I have a question. What I really didn't get is where do you get the information? Are you looking at config files that are local or are you a super user who has access to all these tools? This solution is super user who has access to all the information. So basically it's an API call to the target technologies. So before that, we had individual components talking to each other, like in a limited environment. And now we're getting a super user who has access to everything. No. So in the architecture, I had the breakdown into, let's say, broadly two parts. The one is the scan engine part. The second part is the analysis. Scan


chunk_text:
  will be, for example, do you have MF enabled or not? So because and so that is the library of the vulnerabilities I have in terms of each technologies. And with my tool, I'm going to also publish, you know, kind of knowledge base that which kind of vulnerability I'm detecting in our tool, irrespective whether it got detected or not. Make sense? OK, thanks. Any other question? Was it that good or that bad? You were that good. Oh, thanks. Good. But I have a question. What I really didn't get is where do you get the information? Are you looking at config files that are local or are you a super user who has access to all these tools? This solution is super user who has access to all the information. So basically it's an API call to the target technologies. So before that, we had individual components talking to each other, like in a limited environment. And now we're getting a super user who has access to everything. No. So in the architecture, I had the breakdown into, let's say, broadly two parts. The one is the scan engine part. The second part is the analysis. Scan engine is again, can be used independently. So how it's going to work out in practical life is that you identify which technology you are using in your environment from the supported technology in the solution. For example, you might say, I'm using GitHub and I'm using Jenkins. I'm not using, let's say, JFrog at all. So you are going to configure those two scanners with the super user access for both. And then what it is going to do is it going to scan the independent technology. It's going to fetch all the information. And then the analysis engine is going to make the relationship from the database, from the local database of the solution. Make sense? Yeah. Makes sense. Other questions? Okay. Perfect. Thank you for the talk first. Is it possible to push those data into RDF database and not just graph? I'm sorry. I did not get the question. Is it possible to put it into ontologies and not just Neo4j graph database? In terms of database, it's going to put in Neo4j. What customization you can do is since in the command line, I have all the output in the JSON, you can redirect that


chunk_text:
  engine is again, can be used independently. So how it's going to work out in practical life is that you identify which technology you are using in your environment from the supported technology in the solution. For example, you might say, I'm using GitHub and I'm using Jenkins. I'm not using, let's say, JFrog at all. So you are going to configure those two scanners with the super user access for both. And then what it is going to do is it going to scan the independent technology. It's going to fetch all the information. And then the analysis engine is going to make the relationship from the database, from the local database of the solution. Make sense? Yeah. Makes sense. Other questions? Okay. Perfect. Thank you for the talk first. Is it possible to push those data into RDF database and not just graph? I'm sorry. I did not get the question. Is it possible to put it into ontologies and not just Neo4j graph database? In terms of database, it's going to put in Neo4j. What customization you can do is since in the command line, I have all the output in the JSON, you can redirect that JSON output into your choice of our technology. But on the fly, it's not going to it's it doesn't support anything else at this moment. Thank you. Other questions? Okay. So thank you again for the talk. Thank you. Thank you, everyone. Have a nice day. Thank you.


chunk_text:
  JSON output into your choice of our technology. But on the fly, it's not going to it's it doesn't support anything else at this moment. Thank you. Other questions? Okay. So thank you again for the talk. Thank you. Thank you, everyone. Have a nice day. Thank you.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=PosGarCGXRo", "title": "Which Models For Secure ICS Network Architectures To Adapt To New Usages? by Alexandrine Torrents", "description": "", "channel_url": "https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA", "duration": 2870, "channel": "scrt.insomnihack", "uploader": "scrt.insomnihack", "upload_date": "20230411" } This text was transcribed using whisper model: large-v2 Well, good afternoon, everyone. So today I will talk about secure ICS network architectures, and especially how they can be adapted to new usages such as cloud, IoT, or machine learning. But maybe a question to start with, how many of you have already worked in industrial control systems securely? OK, not a lot. And how many of you maybe know about the Purdue model? OK, not a lot. So I'm going to start with a small introduction about ICS, and so industrial control system. So first, where do we find industrial control systems? Well, pretty much in a lot of different industries and sectors, such as transport, aeronautics, car, automobile, military, defense, also utilities. But what is an industrial control system? So basically, it will have an interconnection with the physical world. So you will have sensors and actuators, which represents the actual physical world, and they will be interconnected with what we call the production network, and especially PLC, which stands for programmable logic controller. So they interact with the sensors and actuators, and they send command to open a valve, turn a motor, or something like that. Then the PLC would be connected to the supervision network, or the SCADA network. So basically here, you have the Windows world, because you have Windows workstations, Windows servers with a supervision application. So you have different consoles to supervise what you have on the plant, and you also find maintenance laptops to go and program the PLCs on the field, for example. And so this is a combination of these two networks, the supervision network on one hand, and the production network on the other hand, that we call the ICS, the industrial control system network. As you may know, the ICS would be interconnected most of the time to other networks, and starting with the corporate network of the company, and probably also be connected to the one of the company and have interconnections with the internet, or the cloud, or external partners. So that's it about the introduction, and let's deep dive in the presentation. So I will tell a story about two very different secure ICS


chunk_text:
  PLC, which stands for programmable logic controller. So they interact with the sensors and actuators, and they send command to open a valve, turn a motor, or something like that. Then the PLC would be connected to the supervision network, or the SCADA network. So basically here, you have the Windows world, because you have Windows workstations, Windows servers with a supervision application. So you have different consoles to supervise what you have on the plant, and you also find maintenance laptops to go and program the PLCs on the field, for example. And so this is a combination of these two networks, the supervision network on one hand, and the production network on the other hand, that we call the ICS, the industrial control system network. As you may know, the ICS would be interconnected most of the time to other networks, and starting with the corporate network of the company, and probably also be connected to the one of the company and have interconnections with the internet, or the cloud, or external partners. So that's it about the introduction, and let's deep dive in the presentation. So I will tell a story about two very different secure ICS architecture, but what is a secure architecture? Well, here, an introduction about the Purdue model. So basically, it's a conceptual model where we place the different components I've just presented. So different levels. Basically, at level zero, you have the sensors and the actuators. At level one, you will find the PLCs. At level two, you will have the Windows world, the supervision network with your SCADA servers, your engineering workstations, and your operator consoles. At level three, actually, it does not exist at each plant, but it's the kind of orchestrator of your system. You can find that in manufacturing plants, for example, when you have different production lines and you need to orchestrate a different production network. Then usually, depending on the Purdue model you are using, that can be a level 3.5, which is the BMZ, and then you have the enterprise network at level four. So basically, everything that is below level three is considered part of the industrial control system. So this is the Purdue model, and this is actually what we call a secure ICS architecture. And actually, in 2019, in a conference dedicated to industrial control system, there was a panel called, is


chunk_text:
  architecture, but what is a secure architecture? Well, here, an introduction about the Purdue model. So basically, it's a conceptual model where we place the different components I've just presented. So different levels. Basically, at level zero, you have the sensors and the actuators. At level one, you will find the PLCs. At level two, you will have the Windows world, the supervision network with your SCADA servers, your engineering workstations, and your operator consoles. At level three, actually, it does not exist at each plant, but it's the kind of orchestrator of your system. You can find that in manufacturing plants, for example, when you have different production lines and you need to orchestrate a different production network. Then usually, depending on the Purdue model you are using, that can be a level 3.5, which is the BMZ, and then you have the enterprise network at level four. So basically, everything that is below level three is considered part of the industrial control system. So this is the Purdue model, and this is actually what we call a secure ICS architecture. And actually, in 2019, in a conference dedicated to industrial control system, there was a panel called, is the Purdue model dead? Well, actually, some people thought it was still accurate today, and others thought it was not relevant anymore, especially when considering cloud. So traditionally, there has been a rigidity to what a secure architecture is. And here is an example of rigidity, the DMZ. So imagine you need an interconnection with your industrial control system, and so your OT network. Well, it's simple. You can put a proxy server in the DMZ and only allow incoming communication to the DMZ. So it used to work, but does it still make sense today? Well, maybe not in all cases. So let's see how we can think about the future of ICS network architecture, having in mind a specific motto, no limits. And so let's take an example. So I've been working for various companies that have a large variety of control systems, historical businesses such as power plants, so nuclear, chemical, or refineries, but also new businesses such as solar and wind farms. And now, these various businesses can be found within the same company. So for these companies, the existing ICS cybersecurity policy needs to be adapted to the new usages and businesses. But how can


chunk_text:
  the Purdue model dead? Well, actually, some people thought it was still accurate today, and others thought it was not relevant anymore, especially when considering cloud. So traditionally, there has been a rigidity to what a secure architecture is. And here is an example of rigidity, the DMZ. So imagine you need an interconnection with your industrial control system, and so your OT network. Well, it's simple. You can put a proxy server in the DMZ and only allow incoming communication to the DMZ. So it used to work, but does it still make sense today? Well, maybe not in all cases. So let's see how we can think about the future of ICS network architecture, having in mind a specific motto, no limits. And so let's take an example. So I've been working for various companies that have a large variety of control systems, historical businesses such as power plants, so nuclear, chemical, or refineries, but also new businesses such as solar and wind farms. And now, these various businesses can be found within the same company. So for these companies, the existing ICS cybersecurity policy needs to be adapted to the new usages and businesses. But how can we define cybersecurity requirements and rules that would apply to the same company? So in this presentation, we will compare and contrast the requirements and corresponding ICS network architecture of two different businesses within the same company. But first, an assumption. So in this presentation, I will only discuss about common and control system, because usually when we talk about ICS, we have three different kinds of, let's say, systems, monitoring systems, common and control systems, and safety systems. So to make my presentation easier, I will only talk here about common and control systems. So let's present in more details our two use cases. So first, the historical business, the power plants or refinery. So here, we usually have large plants that are on a single geographical location with many people working on sites. These systems are designed to operate locally, so on a single physical location, and autonomously. There are only a few interconnections, and usually they are not essentials to the industrial process itself. You have usually a high volume of assets on the network, and they are pretty standard assets like I just presented before, so PLCs, sensors, actuators, and Windows workstations and servers. And here,


chunk_text:
  we define cybersecurity requirements and rules that would apply to the same company? So in this presentation, we will compare and contrast the requirements and corresponding ICS network architecture of two different businesses within the same company. But first, an assumption. So in this presentation, I will only discuss about common and control system, because usually when we talk about ICS, we have three different kinds of, let's say, systems, monitoring systems, common and control systems, and safety systems. So to make my presentation easier, I will only talk here about common and control systems. So let's present in more details our two use cases. So first, the historical business, the power plants or refinery. So here, we usually have large plants that are on a single geographical location with many people working on sites. These systems are designed to operate locally, so on a single physical location, and autonomously. There are only a few interconnections, and usually they are not essentials to the industrial process itself. You have usually a high volume of assets on the network, and they are pretty standard assets like I just presented before, so PLCs, sensors, actuators, and Windows workstations and servers. And here, the industrial process is usually complex with many different common and control requests. Then we have our new business, the solar and wind farm. So here, we usually have a lot of very distributed industrial sites that are communicated through the internet. So these are really small sites without any human presence most of the time, and only a few assets on the network, mainly data loggers or inverters. And these systems are usually operated from the cloud. So concerning common and control, you will only have a few requests, and mainly start and stop requests remotely. And these systems are also mainly about energy management and optimization. So would you have the same architecture and the same cybersecurity requirements for both cases? Well, probably not. So let's start with the historical business and secure architecture. So here, for the power plant or refinery, we will have standard ICS network architecture, so following the Purdue model I presented earlier. So we have an industrial site on a single geographical location, and we have our OT network, which is a dedicated OT network, with the different assets I've already presented. So the sensors, actuators, PLCs, some HMIs, the SCADA servers, and


chunk_text:
  the industrial process is usually complex with many different common and control requests. Then we have our new business, the solar and wind farm. So here, we usually have a lot of very distributed industrial sites that are communicated through the internet. So these are really small sites without any human presence most of the time, and only a few assets on the network, mainly data loggers or inverters. And these systems are usually operated from the cloud. So concerning common and control, you will only have a few requests, and mainly start and stop requests remotely. And these systems are also mainly about energy management and optimization. So would you have the same architecture and the same cybersecurity requirements for both cases? Well, probably not. So let's start with the historical business and secure architecture. So here, for the power plant or refinery, we will have standard ICS network architecture, so following the Purdue model I presented earlier. So we have an industrial site on a single geographical location, and we have our OT network, which is a dedicated OT network, with the different assets I've already presented. So the sensors, actuators, PLCs, some HMIs, the SCADA servers, and the different workstations. You can also have segmentation within the ICS network, and actually it's recommended, but actually not always implemented on the field. And this OT network will need to have interconnections with the IT network. And so how do we do that? With the DMZ between the two networks, and we have two firewalls, one between the OT network and the IT network, and one, and the DMZ, sorry, and one between the DMZ and the IT network. And in this DMZ, what do we have? Well, for example, rebound server for remote access, an update server, an antivirus server, and maybe also some file exchange server or other application servers used as proxy. Then this industrial site is usually connected to the one, so the wide area network of the company, and connected to the data center of the company. And in this data center, we can find central services DMZ, and also an internet DMZ, and actually, most of the time, it's the main or even the only way to access the internet. So actually, the remote access will go through this architecture. So going through the data center of the company, then go on site


chunk_text:
  the different workstations. You can also have segmentation within the ICS network, and actually it's recommended, but actually not always implemented on the field. And this OT network will need to have interconnections with the IT network. And so how do we do that? With the DMZ between the two networks, and we have two firewalls, one between the OT network and the IT network, and one, and the DMZ, sorry, and one between the DMZ and the IT network. And in this DMZ, what do we have? Well, for example, rebound server for remote access, an update server, an antivirus server, and maybe also some file exchange server or other application servers used as proxy. Then this industrial site is usually connected to the one, so the wide area network of the company, and connected to the data center of the company. And in this data center, we can find central services DMZ, and also an internet DMZ, and actually, most of the time, it's the main or even the only way to access the internet. So actually, the remote access will go through this architecture. So going through the data center of the company, then go on site through the DMZ and access the OT network. So what are the ICS cybersecurity requirements for this architecture? Well, pretty standard DMZ between the IT and the OT network, protected by firewalls. So one firewall between OT and DMZ, and one firewall between DMZ and IT. We have no direct communication between the IT and the OT networks. We also have protocol break in the DMZ, so we use relay servers, for example. And lastly, we have no local internet access on the OT network. So the internet access goes through the IT network. So would this architecture work for the solar and wind farm case? So let's try to apply the same architecture principle for this use case. So what do we have here? We have our main operator sites with our OT network, but here on this network, we only have workstations, and the rest of the industrial process is actually elsewhere. And I will go back on that. But then you have actually the same interconnection with the network data center of the company and the same remote access solution. But where is the rest of the industrial network? Well, it's geographically distributed, and you have several


chunk_text:
  through the DMZ and access the OT network. So what are the ICS cybersecurity requirements for this architecture? Well, pretty standard DMZ between the IT and the OT network, protected by firewalls. So one firewall between OT and DMZ, and one firewall between DMZ and IT. We have no direct communication between the IT and the OT networks. We also have protocol break in the DMZ, so we use relay servers, for example. And lastly, we have no local internet access on the OT network. So the internet access goes through the IT network. So would this architecture work for the solar and wind farm case? So let's try to apply the same architecture principle for this use case. So what do we have here? We have our main operator sites with our OT network, but here on this network, we only have workstations, and the rest of the industrial process is actually elsewhere. And I will go back on that. But then you have actually the same interconnection with the network data center of the company and the same remote access solution. But where is the rest of the industrial network? Well, it's geographically distributed, and you have several remote industrial sites. And maybe here, a constraint before we go further. So actually, to interconnect those distant sites, we wanted to implement MPLS, pretty standard. But we met with telecom operators, and as I said, the MPLS was not technically possible for 20% of the sites. So actually here, we had to use the internet to interconnect our sites. So what do we have? Remember, in this example, we have small sites with only a couple of assets on the network. But if we follow the same principle as previously, we will have a DMZ to interconnect with the rest of the network, a firewall between the OT network and the DMZ, another firewall and internet gateway between the DMZ and the internet. We will have probably VPN IP sectionals connected to the data center of the company because it's the only way to reach the main operator site. And since we cannot allow direct communication, we will have relays in the DMZ. And actually, here we miss the SCADA servers. So imagine here, the SCADA servers are hosted in the cloud. So here are similar constraints, a DMZ, a first firewall, second firewall, IP sectional, and a relay.


chunk_text:
  remote industrial sites. And maybe here, a constraint before we go further. So actually, to interconnect those distant sites, we wanted to implement MPLS, pretty standard. But we met with telecom operators, and as I said, the MPLS was not technically possible for 20% of the sites. So actually here, we had to use the internet to interconnect our sites. So what do we have? Remember, in this example, we have small sites with only a couple of assets on the network. But if we follow the same principle as previously, we will have a DMZ to interconnect with the rest of the network, a firewall between the OT network and the DMZ, another firewall and internet gateway between the DMZ and the internet. We will have probably VPN IP sectionals connected to the data center of the company because it's the only way to reach the main operator site. And since we cannot allow direct communication, we will have relays in the DMZ. And actually, here we miss the SCADA servers. So imagine here, the SCADA servers are hosted in the cloud. So here are similar constraints, a DMZ, a first firewall, second firewall, IP sectional, and a relay. Well, does this really work? Let's consider maybe one of the main communication in this architecture. Obviously, the main operator site needs to communicate with the industrial sites. And the cloud with the SCADA server needs to communicate with the OT network. And they will probably use a Modbus communication. Modbus, I don't know if you know this protocol, but it's a well-known industrial protocol, but without any security, no authentication, no encryption. So this communication will have to go through all the IT network of the company. And it will have to go through also some DMZs. But can we really have a DMZ and implement a protocol breaker with a Modbus communication? And do we really need to use the IT network to make two industrial sites communicate with each other? Maybe not. And also, in this scenario, you may have noticed we have two different firewalls for each of the small sites. Well, maybe if we have only a couple of sites, it could be feasible. But imagine you would need to interconnect 300 small sites like this. Well, you see, it does not scale. So actually, let's try a blank page and see how we can


chunk_text:
  Well, does this really work? Let's consider maybe one of the main communication in this architecture. Obviously, the main operator site needs to communicate with the industrial sites. And the cloud with the SCADA server needs to communicate with the OT network. And they will probably use a Modbus communication. Modbus, I don't know if you know this protocol, but it's a well-known industrial protocol, but without any security, no authentication, no encryption. So this communication will have to go through all the IT network of the company. And it will have to go through also some DMZs. But can we really have a DMZ and implement a protocol breaker with a Modbus communication? And do we really need to use the IT network to make two industrial sites communicate with each other? Maybe not. And also, in this scenario, you may have noticed we have two different firewalls for each of the small sites. Well, maybe if we have only a couple of sites, it could be feasible. But imagine you would need to interconnect 300 small sites like this. Well, you see, it does not scale. So actually, let's try a blank page and see how we can think about another architecture that could be secure. So what do we have here? Our OT network geographically distributed. So several remote sites without any human presence. The main work sites with only workstations. And the SCADA servers hosted in the cloud. So remember, internet is used as a transport mean to make the assets communicate with each other. So one secure architecture solution would be to virtually create one, leveraging SD-WAN technology. So remember our meeting with the telecom operators, well, it was them who said that we could implement SD-WAN. But what is SD-WAN? Software Defined Wide Area Network. So you will virtually create your one through a network of VPN tunnels, mostly VPN IPsec tunnels, over any physical network. So you can have very different physical networks, internet, radio, satellites, different operators network, and still build virtually and logically your wide area network with this network of VPN IPsec tunnels. So with that in mind, we will have some SD-WAN edges at each location. So the sites, the remote sites, and also the cloud, which is the infrastructure as a service. So different VPN IPsec tunnels. And here, so you can make the main operator sites talk


chunk_text:
  think about another architecture that could be secure. So what do we have here? Our OT network geographically distributed. So several remote sites without any human presence. The main work sites with only workstations. And the SCADA servers hosted in the cloud. So remember, internet is used as a transport mean to make the assets communicate with each other. So one secure architecture solution would be to virtually create one, leveraging SD-WAN technology. So remember our meeting with the telecom operators, well, it was them who said that we could implement SD-WAN. But what is SD-WAN? Software Defined Wide Area Network. So you will virtually create your one through a network of VPN tunnels, mostly VPN IPsec tunnels, over any physical network. So you can have very different physical networks, internet, radio, satellites, different operators network, and still build virtually and logically your wide area network with this network of VPN IPsec tunnels. So with that in mind, we will have some SD-WAN edges at each location. So the sites, the remote sites, and also the cloud, which is the infrastructure as a service. So different VPN IPsec tunnels. And here, so you can make the main operator sites talk with the remote sites. The cloud talk with the remote industrial sites. But the remote sites are not supposed to talk with each other. So there won't be any direct VPN IPsec tunnel in this architecture. And then inside the VPN tunnels, of course, you can implement network filtering and only allow legitimate communication, such as Modbus flow I talked about earlier. And so with this SD-WAN edges, of course, you have the firewall embedded in these devices. And you can also implement detection by activating the IDS functionality on the firewall, for example. Then what do we have next on this architecture? We have a DMZ, hosted probably in the cloud. And you have different zones in this DMZ protected by different firewalls. And here, it's a DMZ directly between the OT network and the internet. So the remote access will go through this connection as well. And so if we take a look at the central OT DMZ, we will see the central services where we can find, as previously, the bastion server, update, and antivirus server. And actually here, for the updates and antivirus servers, they can be connected directly to the internet, to the official websites


chunk_text:
  with the remote sites. The cloud talk with the remote industrial sites. But the remote sites are not supposed to talk with each other. So there won't be any direct VPN IPsec tunnel in this architecture. And then inside the VPN tunnels, of course, you can implement network filtering and only allow legitimate communication, such as Modbus flow I talked about earlier. And so with this SD-WAN edges, of course, you have the firewall embedded in these devices. And you can also implement detection by activating the IDS functionality on the firewall, for example. Then what do we have next on this architecture? We have a DMZ, hosted probably in the cloud. And you have different zones in this DMZ protected by different firewalls. And here, it's a DMZ directly between the OT network and the internet. So the remote access will go through this connection as well. And so if we take a look at the central OT DMZ, we will see the central services where we can find, as previously, the bastion server, update, and antivirus server. And actually here, for the updates and antivirus servers, they can be connected directly to the internet, to the official websites of the vendor, probably by implementing a URL or a site listing with a proxy. And you could also have here and consider interconnections with external partners. And so you could add additional flow analysis and the restrictions in the central DMZ with, for example, relay of proxies for standard communications and protocols, such as HTTPS or SFTP. And if you need to interconnect with a partner and use industrial protocols, you can have a network probe for industrial protocol analysis. But where is the IT network in this architecture? Because we still need an interconnection with the IT network, but it won't be done on the main operator site. Here, the interconnection will be directly in the cloud with a dedicated firewall between the DMZ and the IT network. And you probably will have another dedicated network for the IT network. So basically, what are the main differences with this architecture with the previous one? We have the OT communications between the sites directly, and we do not go through the IT network anymore. We have a DMZ between the OT network and the internet directly. And we have only one global DMZ for the whole OT network. So


chunk_text:
  of the vendor, probably by implementing a URL or a site listing with a proxy. And you could also have here and consider interconnections with external partners. And so you could add additional flow analysis and the restrictions in the central DMZ with, for example, relay of proxies for standard communications and protocols, such as HTTPS or SFTP. And if you need to interconnect with a partner and use industrial protocols, you can have a network probe for industrial protocol analysis. But where is the IT network in this architecture? Because we still need an interconnection with the IT network, but it won't be done on the main operator site. Here, the interconnection will be directly in the cloud with a dedicated firewall between the DMZ and the IT network. And you probably will have another dedicated network for the IT network. So basically, what are the main differences with this architecture with the previous one? We have the OT communications between the sites directly, and we do not go through the IT network anymore. We have a DMZ between the OT network and the internet directly. And we have only one global DMZ for the whole OT network. So let's sum up the key requirements. So we have our VPN IP sectors between the industrial sites that are communicating through the internet, so using our SD-WAN network. We have a global DMZ between the OT network and the internet, and we do not need to go through the IT network anymore. We have firewalls with restricted firewall rules at each location. So the main sites, the different remote sites, as well as the cloud. And we have a network probe in the DMZ for flow analysis, especially for industrial protocols, which cannot be used with relay or proxies generally. So to sum up for the solar and wind farm architecture, we have a multi-connectivity using the internet. We are leveraging the SD-WAN technology to create a fully distributed industrial network over the internet with a large cloud strategy. And here we adapted the Purdue model, and we placed the components based on their functionality and not where they are physically. Because I don't know if you noticed earlier, but the internet tends to be represented as a level five in the Purdue model. However, be careful because this architecture is riskier than the previous one, and it will be


chunk_text:
  let's sum up the key requirements. So we have our VPN IP sectors between the industrial sites that are communicating through the internet, so using our SD-WAN network. We have a global DMZ between the OT network and the internet, and we do not need to go through the IT network anymore. We have firewalls with restricted firewall rules at each location. So the main sites, the different remote sites, as well as the cloud. And we have a network probe in the DMZ for flow analysis, especially for industrial protocols, which cannot be used with relay or proxies generally. So to sum up for the solar and wind farm architecture, we have a multi-connectivity using the internet. We are leveraging the SD-WAN technology to create a fully distributed industrial network over the internet with a large cloud strategy. And here we adapted the Purdue model, and we placed the components based on their functionality and not where they are physically. Because I don't know if you noticed earlier, but the internet tends to be represented as a level five in the Purdue model. However, be careful because this architecture is riskier than the previous one, and it will be important to maintain a good security level, but it's difficult and drifts can be observed over time, especially when you consider the SD-WAN edges. You could have a misconfiguration and have your site directly exposed on the internet. So you will need several requirements that need to be respected. So first, end-to-end control of the communication between the different industrial assets. And also you need to secure your communications based on the level and the business need. So do you need the VPN tunnel? Do you need network filtering and our fine grain filtering rules within your tunnel? Do you need relays? Do you need encryption for the communication? Do you need to add detection? But rigor is key in this architecture, and the cybersecurity basics will need to be respected finally for industrial control system. So to come back to our example, so we needed to have specific cybersecurity requirements for our company and apply to all architectures. So we've seen that this architecture can be considered as a secure one for the solar and wind farm. However, it might be too risky for our historical business of the power plants. And earlier we said that the other architecture


chunk_text:
  important to maintain a good security level, but it's difficult and drifts can be observed over time, especially when you consider the SD-WAN edges. You could have a misconfiguration and have your site directly exposed on the internet. So you will need several requirements that need to be respected. So first, end-to-end control of the communication between the different industrial assets. And also you need to secure your communications based on the level and the business need. So do you need the VPN tunnel? Do you need network filtering and our fine grain filtering rules within your tunnel? Do you need relays? Do you need encryption for the communication? Do you need to add detection? But rigor is key in this architecture, and the cybersecurity basics will need to be respected finally for industrial control system. So to come back to our example, so we needed to have specific cybersecurity requirements for our company and apply to all architectures. So we've seen that this architecture can be considered as a secure one for the solar and wind farm. However, it might be too risky for our historical business of the power plants. And earlier we said that the other architecture was a bit too much for the solar and wind farm use case. So could we build something around risks to build our strategy? And so let's try to build an ICS classification methodology. So here the goal would be to classify an industrial control system and not especially a site, because you may have different systems on a single site. So we will put each industrial control system on a risk matrix and try to differentiate their criticality. So we use a standard risk-based approach. And actually we took the ANSI, which is the French cybersecurity agency, ICS classification methodology as a base, and we adapted it to our context. So we have the impact and the likelihood. So regarding the impact, here we use the standard HEC impact scale of the company that is adapted to all businesses. And we have several types of consequences, such as human, environment, image, or financial. And we will use the global impact. The global impact will be the maximum of each of the type of consequence. Then we have the likelihood, and here we will have different factors to consider. First the attacker's level. So are we talking about a non-targeted


chunk_text:
  was a bit too much for the solar and wind farm use case. So could we build something around risks to build our strategy? And so let's try to build an ICS classification methodology. So here the goal would be to classify an industrial control system and not especially a site, because you may have different systems on a single site. So we will put each industrial control system on a risk matrix and try to differentiate their criticality. So we use a standard risk-based approach. And actually we took the ANSI, which is the French cybersecurity agency, ICS classification methodology as a base, and we adapted it to our context. So we have the impact and the likelihood. So regarding the impact, here we use the standard HEC impact scale of the company that is adapted to all businesses. And we have several types of consequences, such as human, environment, image, or financial. And we will use the global impact. The global impact will be the maximum of each of the type of consequence. Then we have the likelihood, and here we will have different factors to consider. First the attacker's level. So are we talking about a non-targeted attacker, a private organization, a state-sponsored organization? We will also consider the functionality. So are we talking about a monitoring system, a command and control system, a safety system? We will also consider the connectivity. So are we on a single geographical location? Are we using a distributed network, using a private network such as MPLS, or are we using public networks? And we will also consider the level of access control, so the level of identification and authentication. So for each of these factors, we will get a number, and then we have a formula to calculate the likelihood. And then we will have our risk metrics, and we will place the industrial control system on the metrics, and it will give us the classification. And in our example, we have four classes of classification. And it's important when you build such methodology to consider also regulations to have maybe some minimum classification depending on your systems. So let's try the classification on our two system examples. So first, the impacts for the power plant and the refinery here. We have, for example, a Seveso site with high HEC risks. So we have high impact, so let's say three.


chunk_text:
  attacker, a private organization, a state-sponsored organization? We will also consider the functionality. So are we talking about a monitoring system, a command and control system, a safety system? We will also consider the connectivity. So are we on a single geographical location? Are we using a distributed network, using a private network such as MPLS, or are we using public networks? And we will also consider the level of access control, so the level of identification and authentication. So for each of these factors, we will get a number, and then we have a formula to calculate the likelihood. And then we will have our risk metrics, and we will place the industrial control system on the metrics, and it will give us the classification. And in our example, we have four classes of classification. And it's important when you build such methodology to consider also regulations to have maybe some minimum classification depending on your systems. So let's try the classification on our two system examples. So first, the impacts for the power plant and the refinery here. We have, for example, a Seveso site with high HEC risks. So we have high impact, so let's say three. And for the solar and wind farm here, we have no HEC risks, and actually not a lot of risks. The highest impact would be a financial loss due to a production stop, for example. So maybe here, the impact will be only two. Then regarding the likelihood, so to ease the case, we will consider we have the same attacker levels, the same access level, and the same functionality, so it's the connectivity which will make the difference. And so regarding the connectivity on the power plant and refinery, we have a low connectivity because we have an industrial network on a single geographical location and only a few interconnections with the IT network. So with the formula, we will get a likelihood of two. And for the solar and wind farm, as you saw, we have a high connectivity because we have a geographically distributed industrial control system, and we are using a public network. So with the formula, we will get a likelihood of three. So with that, we can place our industrial control system on the matrix, and we get a class three system for the power plant and the refinery, and a class two system


chunk_text:
  And for the solar and wind farm here, we have no HEC risks, and actually not a lot of risks. The highest impact would be a financial loss due to a production stop, for example. So maybe here, the impact will be only two. Then regarding the likelihood, so to ease the case, we will consider we have the same attacker levels, the same access level, and the same functionality, so it's the connectivity which will make the difference. And so regarding the connectivity on the power plant and refinery, we have a low connectivity because we have an industrial network on a single geographical location and only a few interconnections with the IT network. So with the formula, we will get a likelihood of two. And for the solar and wind farm, as you saw, we have a high connectivity because we have a geographically distributed industrial control system, and we are using a public network. So with the formula, we will get a likelihood of three. So with that, we can place our industrial control system on the matrix, and we get a class three system for the power plant and the refinery, and a class two system for the solar and wind farm. So you see, we end up with two different classifications for our systems. And so we may consider different requirements depending on the class of the system. So for example, for a class three system, we could forbid the use of cloud. We could have only a private network used. And for class two network, we could allow, under certain circumstances, cloud communications, SD-WAN technology with a stronger VPN and network filtering with detection, et cetera. But can it be then simple? Unfortunately, no. But let's take a step back on our example. What was the main decision factor for the secure architecture? It was connectivity and impact. Because for the power plant and the refinery, we had a high HEC risk, so interconnections were limited, no cloud, no distributed network, and no public network. And for the solar and wind farm, we had low risk and high distributed network. But is there any additional factor that could be considered to help with the classification and our requirements? Well, we could consider, for example, multiple expositions. Because in my example, I only talked about the cloud. But we could also consider interconnections with applications


chunk_text:
  for the solar and wind farm. So you see, we end up with two different classifications for our systems. And so we may consider different requirements depending on the class of the system. So for example, for a class three system, we could forbid the use of cloud. We could have only a private network used. And for class two network, we could allow, under certain circumstances, cloud communications, SD-WAN technology with a stronger VPN and network filtering with detection, et cetera. But can it be then simple? Unfortunately, no. But let's take a step back on our example. What was the main decision factor for the secure architecture? It was connectivity and impact. Because for the power plant and the refinery, we had a high HEC risk, so interconnections were limited, no cloud, no distributed network, and no public network. And for the solar and wind farm, we had low risk and high distributed network. But is there any additional factor that could be considered to help with the classification and our requirements? Well, we could consider, for example, multiple expositions. Because in my example, I only talked about the cloud. But we could also consider interconnections with applications from the corporate network. And the systems need to be considered as a whole. And for example, since we are talking about the same company, you've seen that in the two scenarios, we have a global central services DMZ. Well, could we mutualize this DMZ for the whole company? Or is maybe the risk of compromising the power plant refinery through the solar and wind farm maybe too high? And we can also consider regulations, physical access, device access control, and data confidentiality as well. But in the end, be pragmatic and do not stick to a formula. You should consider key factors and make your classification accordingly. And also, another interesting thing would be to build architecture patterns. So for your company, you could identify several use cases, build reference architecture based on the risk analysis. And these architectures patterns will need to be regularly updated. Because business needs and technical capabilities evolve regularly. So you could have some global cybersecurity requirements to respect depending on your ICS classification, but then have different architecture patterns for each of your new use cases with some specific requirements. And so let's go further on that and with the architecture patterns. And


chunk_text:
  from the corporate network. And the systems need to be considered as a whole. And for example, since we are talking about the same company, you've seen that in the two scenarios, we have a global central services DMZ. Well, could we mutualize this DMZ for the whole company? Or is maybe the risk of compromising the power plant refinery through the solar and wind farm maybe too high? And we can also consider regulations, physical access, device access control, and data confidentiality as well. But in the end, be pragmatic and do not stick to a formula. You should consider key factors and make your classification accordingly. And also, another interesting thing would be to build architecture patterns. So for your company, you could identify several use cases, build reference architecture based on the risk analysis. And these architectures patterns will need to be regularly updated. Because business needs and technical capabilities evolve regularly. So you could have some global cybersecurity requirements to respect depending on your ICS classification, but then have different architecture patterns for each of your new use cases with some specific requirements. And so let's go further on that and with the architecture patterns. And let's build an OT use case catalog for the company with adapted cybersecurity frameworks. So use case catalog, why and how? So why do we need a catalog first? So I've already talked about it a bit, but let's deep dive here. So with this use case catalog, it would be more concrete than a simple cybersecurity policy. So I'm not saying it will replace entirely the cybersecurity policy. But actually, it will be concrete and answers business operational questions and provide operational guidelines directly to the industrial sites. And it's also important to provide ready to use tools to local teams, because usually they have limited time, sorry, resources, and also a few cybersecurity skills. And it will allow you also to have consistent architectures and cybersecurity solutions across your company. So it will avoid local initiatives and maybe build non-secure architectures. And then so how? So you will need to list first the different use cases for your company and build deep dives for each of the use case. And so you could have three different parts for each of the use case. First a description of the use case, then a network architecture diagram, and finally some


chunk_text:
  let's build an OT use case catalog for the company with adapted cybersecurity frameworks. So use case catalog, why and how? So why do we need a catalog first? So I've already talked about it a bit, but let's deep dive here. So with this use case catalog, it would be more concrete than a simple cybersecurity policy. So I'm not saying it will replace entirely the cybersecurity policy. But actually, it will be concrete and answers business operational questions and provide operational guidelines directly to the industrial sites. And it's also important to provide ready to use tools to local teams, because usually they have limited time, sorry, resources, and also a few cybersecurity skills. And it will allow you also to have consistent architectures and cybersecurity solutions across your company. So it will avoid local initiatives and maybe build non-secure architectures. And then so how? So you will need to list first the different use cases for your company and build deep dives for each of the use case. And so you could have three different parts for each of the use case. First a description of the use case, then a network architecture diagram, and finally some technical guidelines to respect. So let's take a few examples. So four here in my presentation. So first, let's consider remote control of industrial applications. So a bit like my previous example, let's imagine a geographically distributed industrial control system with different sites communicating through the internet with a central supervision site. A second use case here where you can have IoT sensors on your industrial network connected to an application in the cloud for monitoring and predictive maintenance, for example. A third case when you could have remote maintenance operations, so an external partner responsible for the maintenance and operations of your sites having to connect remotely to your industrial sites to perform some administration actions. And a fourth example here with maybe more machine learning with a cloud solution for energy optimization, for example. And so this application is hosted on the cloud and is directly connected to your industrial control system. But here not only for monitoring, well, first information that are gathered from the industrial site, but with the application from the cloud it analyses the data and is also capable to send command and control requests to your industrial control system. So today we will


chunk_text:
  technical guidelines to respect. So let's take a few examples. So four here in my presentation. So first, let's consider remote control of industrial applications. So a bit like my previous example, let's imagine a geographically distributed industrial control system with different sites communicating through the internet with a central supervision site. A second use case here where you can have IoT sensors on your industrial network connected to an application in the cloud for monitoring and predictive maintenance, for example. A third case when you could have remote maintenance operations, so an external partner responsible for the maintenance and operations of your sites having to connect remotely to your industrial sites to perform some administration actions. And a fourth example here with maybe more machine learning with a cloud solution for energy optimization, for example. And so this application is hosted on the cloud and is directly connected to your industrial control system. But here not only for monitoring, well, first information that are gathered from the industrial site, but with the application from the cloud it analyses the data and is also capable to send command and control requests to your industrial control system. So today we will focus on the first one and the fourth one, and I will present you what it could look like in the use case catalogue. So first example for the remote control of industrial installations. So a brief description. So we have geographically distributed industrial sites, and we have command and control which is managed from a central IoT site. So here we can consider that it's an extended IoT network. And a few technical characteristics. So here the sites communicate through the Internet, and we have OT to OT communications, so mostly industrial communications. I mentioned earlier Modbus, but we could find also OPC UA or any other industrial protocols between the central sites and the PLCs on the remote sites. And we have no local IT network on the remote sites. It's just a small network with only industrial assets. So then we could have our network diagrams. So here a bit like my SD-WAN example as previously, but a bit smaller with just a central site with their assets and only a couple of sites, but we still have a DMZ and VPN IPsec tunnels. And so then we could have some technical guidelines like this. So I


chunk_text:
  focus on the first one and the fourth one, and I will present you what it could look like in the use case catalogue. So first example for the remote control of industrial installations. So a brief description. So we have geographically distributed industrial sites, and we have command and control which is managed from a central IoT site. So here we can consider that it's an extended IoT network. And a few technical characteristics. So here the sites communicate through the Internet, and we have OT to OT communications, so mostly industrial communications. I mentioned earlier Modbus, but we could find also OPC UA or any other industrial protocols between the central sites and the PLCs on the remote sites. And we have no local IT network on the remote sites. It's just a small network with only industrial assets. So then we could have our network diagrams. So here a bit like my SD-WAN example as previously, but a bit smaller with just a central site with their assets and only a couple of sites, but we still have a DMZ and VPN IPsec tunnels. And so then we could have some technical guidelines like this. So I won't read everything, but you get an example. So we need a DMZ between the OT and the Internet. We will implement a network filtering over the different tunnels and only authorize a whitelist of data. We will have also IDS sensors and give some specific guidelines about the filtering that we are allowing between the sites. Then a second example, so with the energy optimization solution. So here, again, it's a cloud solution using machine learning to automatically send command and control requests to the SCADA server. And in terms of technical characteristics, so we have the application hosted on a partner cloud. It's not the company who has this application. It's an external partner. With this solution, we need to install somewhere in the company network a device that will be directly communicated to the OT network and actually communicate directly with the PLCs using, for example, Modbus protocol. And this partner device will also be connected to the partner cloud using a standard HTTPS communication. So again, network diagram with the device. So here you see that we decided in this example to have the partner device in the DMZ between the partner cloud and the OT


chunk_text:
  won't read everything, but you get an example. So we need a DMZ between the OT and the Internet. We will implement a network filtering over the different tunnels and only authorize a whitelist of data. We will have also IDS sensors and give some specific guidelines about the filtering that we are allowing between the sites. Then a second example, so with the energy optimization solution. So here, again, it's a cloud solution using machine learning to automatically send command and control requests to the SCADA server. And in terms of technical characteristics, so we have the application hosted on a partner cloud. It's not the company who has this application. It's an external partner. With this solution, we need to install somewhere in the company network a device that will be directly communicated to the OT network and actually communicate directly with the PLCs using, for example, Modbus protocol. And this partner device will also be connected to the partner cloud using a standard HTTPS communication. So again, network diagram with the device. So here you see that we decided in this example to have the partner device in the DMZ between the partner cloud and the OT network. We have an HTTPS proxy and some firewalls in the architecture. But then if we want to have the technical guidelines, we can have specific sites and requirements. So here we specify that the partner device needs to be installed in a DMZ between the industrial network and the internet. It states that we need a protocol break in the DMZ. And we need to filter the different communications using a firewall. So here we have HTTPS with the cloud and Modbus with industrial sites. So we consider that we have a protocol break with this partner device. Again, here, since we are talking about command and control, it's pretty dangerous. You might think to allow an application hosted in the cloud and especially an external partner application to send command and control requests to your industrial control system and actually directly to the PLC. So here you could have additional requirements to make sure that you cannot do anything too harmful to the industrial control system. And maybe here implement filtering at the application level by putting a dedicated firewall after your partner device before the communication with the OT site. And so if we take Modbus as


chunk_text:
  network. We have an HTTPS proxy and some firewalls in the architecture. But then if we want to have the technical guidelines, we can have specific sites and requirements. So here we specify that the partner device needs to be installed in a DMZ between the industrial network and the internet. It states that we need a protocol break in the DMZ. And we need to filter the different communications using a firewall. So here we have HTTPS with the cloud and Modbus with industrial sites. So we consider that we have a protocol break with this partner device. Again, here, since we are talking about command and control, it's pretty dangerous. You might think to allow an application hosted in the cloud and especially an external partner application to send command and control requests to your industrial control system and actually directly to the PLC. So here you could have additional requirements to make sure that you cannot do anything too harmful to the industrial control system. And maybe here implement filtering at the application level by putting a dedicated firewall after your partner device before the communication with the OT site. And so if we take Modbus as an example, we could, at the application level, make sure that, for example, no PLC programmation would be possible by blocking communication with the specific administration function. We could allow read requests on the all PLC address range. And regarding the write request, we could authorize only some specific addresses of the PLC to be written and also have some specific information about the data that can be written and have some specific thresholds for the data to be written. And then it's pretty basic encrypting communication with the internet and maybe again some detection mechanisms. So that was for the example, but what are the key success factors for such a catalogue? Well, three steps, in my opinion. First, the fact that it's really important to co-construct the catalogue with the business. It's also very important to communicate the catalogue and promote it at all levels within the company and make sure that people on site know about this catalogue. And of course, keep this catalogue updated regularly and add new use case if you have new use cases. Another important thing about such a catalogue, it's really important to have technical solutions to be provided. It's good to


chunk_text:
  an example, we could, at the application level, make sure that, for example, no PLC programmation would be possible by blocking communication with the specific administration function. We could allow read requests on the all PLC address range. And regarding the write request, we could authorize only some specific addresses of the PLC to be written and also have some specific information about the data that can be written and have some specific thresholds for the data to be written. And then it's pretty basic encrypting communication with the internet and maybe again some detection mechanisms. So that was for the example, but what are the key success factors for such a catalogue? Well, three steps, in my opinion. First, the fact that it's really important to co-construct the catalogue with the business. It's also very important to communicate the catalogue and promote it at all levels within the company and make sure that people on site know about this catalogue. And of course, keep this catalogue updated regularly and add new use case if you have new use cases. Another important thing about such a catalogue, it's really important to have technical solutions to be provided. It's good to have a catalogue, but we need to go from theory to practice and actually provide technical solutions to industrial sites, because like I said previously, they do not have always the resources and the skills. And these technical solutions need to be anticipated. So when you build such a catalogue, it's important that you have all stakeholders involved, and especially the architects, to make sure that it's feasible to implement such solutions. Otherwise, you will probably have to start everything from scratch. Then, how could we manage the different architecture patterns in our company, and especially which central infrastructures? Because many companies have chosen to centralise their resources and especially their OT solutions. And so as a centralised OT DMZ, it can be a different level, the entire company or sometimes it's a regional DMZ. So what do we have here in such central infrastructures? Like you've seen in the previous network diagrams, we can have antivirus, update servers, remote access solution, maybe an active directory as well to manage identities, proxies, etc. And the benefits of such centralisation is better knowledge and control of the industrial assets, and also the uniformity of the designs and solutions across the company.


chunk_text:
  have a catalogue, but we need to go from theory to practice and actually provide technical solutions to industrial sites, because like I said previously, they do not have always the resources and the skills. And these technical solutions need to be anticipated. So when you build such a catalogue, it's important that you have all stakeholders involved, and especially the architects, to make sure that it's feasible to implement such solutions. Otherwise, you will probably have to start everything from scratch. Then, how could we manage the different architecture patterns in our company, and especially which central infrastructures? Because many companies have chosen to centralise their resources and especially their OT solutions. And so as a centralised OT DMZ, it can be a different level, the entire company or sometimes it's a regional DMZ. So what do we have here in such central infrastructures? Like you've seen in the previous network diagrams, we can have antivirus, update servers, remote access solution, maybe an active directory as well to manage identities, proxies, etc. And the benefits of such centralisation is better knowledge and control of the industrial assets, and also the uniformity of the designs and solutions across the company. Then maybe a question about mutualisation, because when we talk about centralisation, it implies asking the questions of the mutualisation of the infrastructures. So going back to what I said earlier with our two examples, I've mentioned two different options. One option where the company would decide to have only one global central infrastructure for the whole company. And option B with two different zones depending on the site's criticality. Well, here we go back to our risk-based approach, because here you need maybe to build a decision tree for your company based on the different industrial sites and businesses you may have. So how many different zones you will need and how you would classify the different sites and decide which zone would be used for which industrial control system. So final takeaways for the presentation. So we've seen that control systems can be very different and just security rules and architectures can be different. So the historical ICS secure architecture is not specifically applicable to new usages and the Purdue model needs to be adapted. And so here are some key factors to have in mind for an architecture decision. First, what does the control system do and


chunk_text:
  Then maybe a question about mutualisation, because when we talk about centralisation, it implies asking the questions of the mutualisation of the infrastructures. So going back to what I said earlier with our two examples, I've mentioned two different options. One option where the company would decide to have only one global central infrastructure for the whole company. And option B with two different zones depending on the site's criticality. Well, here we go back to our risk-based approach, because here you need maybe to build a decision tree for your company based on the different industrial sites and businesses you may have. So how many different zones you will need and how you would classify the different sites and decide which zone would be used for which industrial control system. So final takeaways for the presentation. So we've seen that control systems can be very different and just security rules and architectures can be different. So the historical ICS secure architecture is not specifically applicable to new usages and the Purdue model needs to be adapted. And so here are some key factors to have in mind for an architecture decision. First, what does the control system do and what are the business needs? Then what would be the impact and especially in terms of HEC if there was any attack on this system? And maybe a third key factor, which is my level of exposition. So in terms of transport means, for example, but also in terms of applications and other systems connected to this application. So it would be really important to document your use case for your company because it will help your classification and architecture decisions. And so I think it's good for companies to consider launching a task force to support project and industrial sites and build secure architectures for new usages because they will happen whether you're here or not. And maybe a final thought, how can we find the right balance? Because having different secure architectures for each of your use cases within the company is good, but only up to a certain level of manageability because you will have to maintain all these architectures and solutions. So unfortunately, you cannot have as many architectures as control systems. Thank you. Will. Do we have any questions? Hello. Hey, thank you for the presentation. It was very interesting. I really liked it. I


chunk_text:
  what are the business needs? Then what would be the impact and especially in terms of HEC if there was any attack on this system? And maybe a third key factor, which is my level of exposition. So in terms of transport means, for example, but also in terms of applications and other systems connected to this application. So it would be really important to document your use case for your company because it will help your classification and architecture decisions. And so I think it's good for companies to consider launching a task force to support project and industrial sites and build secure architectures for new usages because they will happen whether you're here or not. And maybe a final thought, how can we find the right balance? Because having different secure architectures for each of your use cases within the company is good, but only up to a certain level of manageability because you will have to maintain all these architectures and solutions. So unfortunately, you cannot have as many architectures as control systems. Thank you. Will. Do we have any questions? Hello. Hey, thank you for the presentation. It was very interesting. I really liked it. I have two concerns about your model with one central DMZ. Imagine a company that has multiple sites all over the world, like U.S., South America, China, Europe, you name it. Have you considered if having one central DMZ doesn't mean a lot of latency in communication with that? Wouldn't a model with, I don't know, one DMZ per continent be a better idea in here? Plus, I see one advantage of traditional Purdue model over your model, because if you have sites all over the world and you have one DMZ per site, then if there is a connection breakdown, then there is a chance the site can still operate. In your model, it can't. So actually, in my presentation, I'm not saying that I don't like the Purdue model. I'm saying that there can be very different architectures, depending on the industry, for example, because here I mentioned solar and wind farm, but we have also other kind of distributed ICS in utilities, for example. And maybe it's not the same risk, and so you won't allow what I've just presented for other kind of industry. And maybe to answer your first question as well, so yes, of course,


chunk_text:
  have two concerns about your model with one central DMZ. Imagine a company that has multiple sites all over the world, like U.S., South America, China, Europe, you name it. Have you considered if having one central DMZ doesn't mean a lot of latency in communication with that? Wouldn't a model with, I don't know, one DMZ per continent be a better idea in here? Plus, I see one advantage of traditional Purdue model over your model, because if you have sites all over the world and you have one DMZ per site, then if there is a connection breakdown, then there is a chance the site can still operate. In your model, it can't. So actually, in my presentation, I'm not saying that I don't like the Purdue model. I'm saying that there can be very different architectures, depending on the industry, for example, because here I mentioned solar and wind farm, but we have also other kind of distributed ICS in utilities, for example. And maybe it's not the same risk, and so you won't allow what I've just presented for other kind of industry. And maybe to answer your first question as well, so yes, of course, it depends on the company to have either one big central DMZ or several spread across different continents. But also what's important here to have in mind is that usually what you have in the DMZ is not essential to the production. So if you lose the DMZ, it's not supposed to block your production. And so that's why also in my design with the solar and wind farm case, I really wanted to have the OT sites directly in communication with each other without going through a big architecture. So if sites need to communicate with each other, they will have a direct tunnel between the two to avoid what you just said. Yeah. I have a question. I'm more on the left-hand side, oil and gas companies, which I'm not working for oil and gas, but my organization has lots and lots of control systems. And I see more and more demands that even your engineering stations, your operator stations are provisioned like with standard IT. We see that we're running control system in docker containers. We see that we're running virtual machines for control systems. We see that we program PLCs from Git repositories and so on.


chunk_text:
  it depends on the company to have either one big central DMZ or several spread across different continents. But also what's important here to have in mind is that usually what you have in the DMZ is not essential to the production. So if you lose the DMZ, it's not supposed to block your production. And so that's why also in my design with the solar and wind farm case, I really wanted to have the OT sites directly in communication with each other without going through a big architecture. So if sites need to communicate with each other, they will have a direct tunnel between the two to avoid what you just said. Yeah. I have a question. I'm more on the left-hand side, oil and gas companies, which I'm not working for oil and gas, but my organization has lots and lots of control systems. And I see more and more demands that even your engineering stations, your operator stations are provisioned like with standard IT. We see that we're running control system in docker containers. We see that we're running virtual machines for control systems. We see that we program PLCs from Git repositories and so on. So we're using machine learning for predictive maintenance and so on. So how does this fit into your model? It does not fit in the Purdue model because it's no more or less bridging all layers. How does it fit in yours? Yeah, it can fit as well. And for example, if you take soft PLCs where you do not have the hardware device anymore, but it's virtualized using a codesis, for example, it will still be put in my model at the level one of the Purdue model. It will just have a different device. So you need to adapt the Purdue model with the new solutions that exist on the market. But in the end, it does the same thing. Your protective means don't work anymore. If I'm talking about docker containers, nobody in my organization will rewrite a docker container from scratch. They will come from outside. So they downloaded from docker maybe, or the virtual machines come from outside. So how does that fit in? Yeah, so actually here, if you are using IT solutions, you can also use IT cybersecurity good practices also for OT. It will do the same thing. Because people tend to


chunk_text:
  So we're using machine learning for predictive maintenance and so on. So how does this fit into your model? It does not fit in the Purdue model because it's no more or less bridging all layers. How does it fit in yours? Yeah, it can fit as well. And for example, if you take soft PLCs where you do not have the hardware device anymore, but it's virtualized using a codesis, for example, it will still be put in my model at the level one of the Purdue model. It will just have a different device. So you need to adapt the Purdue model with the new solutions that exist on the market. But in the end, it does the same thing. Your protective means don't work anymore. If I'm talking about docker containers, nobody in my organization will rewrite a docker container from scratch. They will come from outside. So they downloaded from docker maybe, or the virtual machines come from outside. So how does that fit in? Yeah, so actually here, if you are using IT solutions, you can also use IT cybersecurity good practices also for OT. It will do the same thing. Because people tend to think that OT cybersecurity is really different from IT security, but not that much, in my opinion. However, you can have very automation solution to prevent an attack. For example, having controls directly on PLC and make sure that even if someone is in the network, you cannot directly reprogram the PLC and having good practices developing the PLC. But for the rest, I mean, most of the protocols are still unencrypted and unauthenticated. So one of the best way to protect industrial control system is by the network. But if you change all the devices and use more IT systems, maybe you will get rid of the old industrial protocols that are unsecured by design, and you won't have these issues anymore. I'm not offering other questions because we don't have much time left. So thank you very much, Alexandrine.


chunk_text:
  think that OT cybersecurity is really different from IT security, but not that much, in my opinion. However, you can have very automation solution to prevent an attack. For example, having controls directly on PLC and make sure that even if someone is in the network, you cannot directly reprogram the PLC and having good practices developing the PLC. But for the rest, I mean, most of the protocols are still unencrypted and unauthenticated. So one of the best way to protect industrial control system is by the network. But if you change all the devices and use more IT systems, maybe you will get rid of the old industrial protocols that are unsecured by design, and you won't have these issues anymore. I'm not offering other questions because we don't have much time left. So thank you very much, Alexandrine.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=Jdhg1Tx8CjQ", "title": "Permissionless Android Universal Overlays by Dimitrios Valsamaras", "description": "", "channel_url": "https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA", "duration": 2988, "channel": "scrt.insomnihack", "uploader": "scrt.insomnihack", "upload_date": "20230411" } This text was transcribed using whisper model: large-v2 So hi, everyone. And thank you for joining. My name is Dimitrios. I'm from Greece. And here are a few things about me. So I'm engaged in computer security since 2002. I was actually a member of one of the first reverse engineering groups back in Greece. And I started my career as a network security engineer. Then I moved into developing for about five years. And the last five years, I focused mainly on security. Before I joined Microsoft's threat intelligence team as a senior security researcher, I was leading a team which was conducting malware reviews for the Google Play Store. And besides that, I'm a father of two. Boy and a girl. My free time, I play music, guitar, piano. I also sing. Although there is a debate with my wife regarding this one. So I didn't put it here. All right. So before we start, I just want to address a question which I get quite often when I do my talks. And this is how come a Microsoft security engineer talks about Android, you know, this kind of stuff, how these things are connected. So as I said, I'm, let's say, I'm following up with security, computer security for quite a long time. And I guess you would also agree with the fact that today's threats need a more holistic approach, right? So a breach in your mobile might affect even your corporate network right now. And I strongly believe that companies should, let's say, follow, I mean, improve their security solutions in order to protect their clients across all platforms. So I'm very proud of being a part of, let's say, such an initiative. And with that being said, we can jump right to the outline of this briefing, which consists of the following topics. So first of all, we're going to talk about the Android user interface, just a brief overview of the main components and things that we're going to use during our presentation. And then we're going to go to, let's say, first main part, which is going confusion attacks. What is the story so far? We're going to see quite a lot of, let's say, techniques which have


chunk_text:
  is how come a Microsoft security engineer talks about Android, you know, this kind of stuff, how these things are connected. So as I said, I'm, let's say, I'm following up with security, computer security for quite a long time. And I guess you would also agree with the fact that today's threats need a more holistic approach, right? So a breach in your mobile might affect even your corporate network right now. And I strongly believe that companies should, let's say, follow, I mean, improve their security solutions in order to protect their clients across all platforms. So I'm very proud of being a part of, let's say, such an initiative. And with that being said, we can jump right to the outline of this briefing, which consists of the following topics. So first of all, we're going to talk about the Android user interface, just a brief overview of the main components and things that we're going to use during our presentation. And then we're going to go to, let's say, first main part, which is going confusion attacks. What is the story so far? We're going to see quite a lot of, let's say, techniques which have been presented during the last years when it comes to Android operating system. And then we're going to discuss about the behavior out of which this attack was, let's say, inspired. Okay, then universal overlays addressed by the specific CVE. Actually, the title is permissionless, universal overlays, but it's quite far. I couldn't add it here. And yeah, we're not going to use any kind of permission. This is the difference, actually, with the attacks that have been presented so far. And finally, we're going to see some defensive takeaways, how we can protect Android apps from these or even similar type of attacks. Okay, so let's start with, let's say, the Android graphics architecture, focusing on the components that we said we're going to discuss. And I'm not sure how many of you have created an Android app so far, but we may all agree on the fact that one of its most important features is the ability to interact with the user, right? So that being said, almost every modern development environment facilitates this process by providing tools to make this process easier, right? So this way, Android developer with just a few clicks can add or remove


chunk_text:
  been presented during the last years when it comes to Android operating system. And then we're going to discuss about the behavior out of which this attack was, let's say, inspired. Okay, then universal overlays addressed by the specific CVE. Actually, the title is permissionless, universal overlays, but it's quite far. I couldn't add it here. And yeah, we're not going to use any kind of permission. This is the difference, actually, with the attacks that have been presented so far. And finally, we're going to see some defensive takeaways, how we can protect Android apps from these or even similar type of attacks. Okay, so let's start with, let's say, the Android graphics architecture, focusing on the components that we said we're going to discuss. And I'm not sure how many of you have created an Android app so far, but we may all agree on the fact that one of its most important features is the ability to interact with the user, right? So that being said, almost every modern development environment facilitates this process by providing tools to make this process easier, right? So this way, Android developer with just a few clicks can add or remove buttons, views, images, and so on without need to dive deep into their implementation details. Now, system wise, when an app is created, a window is going to be attached to it, which is actually a container for what we call view objects that are backed up by surface objects. And since we may have more than one app running at the same time in an Android device, what comes next is the surface flinger, which will gather all these surfaces and try to composite them on the display. After talking with the hardware composer, which is a hardware abstraction layer, we will gather all these surfaces and do the final composition display. Now, what I intentionally didn't mention so far is the role of the window manager, so for whom, let's say, is to decide the order, the focus, the position of the windows in Android display. And this is the window manager, where the window manager comes into play, which will gather all this info, will send them to the surface flinger, and will do the final composition, as we said before. Now, when it comes to window manager, it's an Android system service, which is, let's say,


chunk_text:
  buttons, views, images, and so on without need to dive deep into their implementation details. Now, system wise, when an app is created, a window is going to be attached to it, which is actually a container for what we call view objects that are backed up by surface objects. And since we may have more than one app running at the same time in an Android device, what comes next is the surface flinger, which will gather all these surfaces and try to composite them on the display. After talking with the hardware composer, which is a hardware abstraction layer, we will gather all these surfaces and do the final composition display. Now, what I intentionally didn't mention so far is the role of the window manager, so for whom, let's say, is to decide the order, the focus, the position of the windows in Android display. And this is the window manager, where the window manager comes into play, which will gather all this info, will send them to the surface flinger, and will do the final composition, as we said before. Now, when it comes to window manager, it's an Android system service, which is, let's say, responsible for the look, the behavior, but also the behavior of the windows, and also the transition, the animation of them when we open a window, when we close one, or we're simply rotating something. Although, despite the rich functionality of this system service, third-party apps don't have access to their own IDL, and they can actually, let's say, access specific properties using some classes like the window, window manager, or the Fugue configuration class. And here I have an example of, let's say, how you can acquire an instance of the window manager, then access this property, as I said before. Now, another important aspect, which is related to our research, is what we call Z-order, and refers to the order across an imaginary axis, which starts from the bottom of the screen up to what the user sees on top of the screen, right? And the position of a window in this axis depends on its type, and every Android app can request a window type, any window type, by just creating a window manager instance, acquiring window manager instance, using the layout parameters, and then just setting the window type that it wants, right? Finally, you can


chunk_text:
  responsible for the look, the behavior, but also the behavior of the windows, and also the transition, the animation of them when we open a window, when we close one, or we're simply rotating something. Although, despite the rich functionality of this system service, third-party apps don't have access to their own IDL, and they can actually, let's say, access specific properties using some classes like the window, window manager, or the Fugue configuration class. And here I have an example of, let's say, how you can acquire an instance of the window manager, then access this property, as I said before. Now, another important aspect, which is related to our research, is what we call Z-order, and refers to the order across an imaginary axis, which starts from the bottom of the screen up to what the user sees on top of the screen, right? And the position of a window in this axis depends on its type, and every Android app can request a window type, any window type, by just creating a window manager instance, acquiring window manager instance, using the layout parameters, and then just setting the window type that it wants, right? Finally, you can use that view in order to add the view to the newly created window. What is now strange here is that, let's say, privileged window types, and by privileged, I mean the ones which are on the top of this imaginary axis, come with special, let's say, with high price. Let's put it this way. So in order to get approved such a window, for example, the type alert window, you need the system window permission, so the user has to go to a specific menu, enable this, let's say, permission for your app in order to get this permission approved. Now, what happens here is that before Android 23, this permission was approved by default, sorry, SDK 23 was approved by default, and what is even more interesting is the fact that if an app targets an SDK which is lower than 23, gets permission approved by default even in newest Android versions, and this brings me to the figure which I have here on the right side where you can see the various window types and their position across this axis that I talked to you about, and despite the fact that most of these window types have


chunk_text:
  use that view in order to add the view to the newly created window. What is now strange here is that, let's say, privileged window types, and by privileged, I mean the ones which are on the top of this imaginary axis, come with special, let's say, with high price. Let's put it this way. So in order to get approved such a window, for example, the type alert window, you need the system window permission, so the user has to go to a specific menu, enable this, let's say, permission for your app in order to get this permission approved. Now, what happens here is that before Android 23, this permission was approved by default, sorry, SDK 23 was approved by default, and what is even more interesting is the fact that if an app targets an SDK which is lower than 23, gets permission approved by default even in newest Android versions, and this brings me to the figure which I have here on the right side where you can see the various window types and their position across this axis that I talked to you about, and despite the fact that most of these window types have been deprecated or aggregated under a single window type, they can still be used by apps which are targeting, let's say, these are versions up to Android 8, okay? All right, so we talked about the shape of a window, the shape and all these things, but there is also another interesting, let's say, aspect when it comes to windows, and this is the behavior of a window, and what I mean by that is how it will, let's say, react on various events that take place on an Android screen, so the common, let's say, behavior in that case is that the window will consume the specific event, so what this event can be is, let's say, a user click or a user touch, a swipe, so what will happen usually is that the window will consume this event, will perform some kind of functionality, and that's it, but you can change that using various flags like the one, the first one that I have here, which is the flag not touchable, so what you can do with that, you can simply let your window dispatch the touch to the window which is below, right, so we give this


chunk_text:
  been deprecated or aggregated under a single window type, they can still be used by apps which are targeting, let's say, these are versions up to Android 8, okay? All right, so we talked about the shape of a window, the shape and all these things, but there is also another interesting, let's say, aspect when it comes to windows, and this is the behavior of a window, and what I mean by that is how it will, let's say, react on various events that take place on an Android screen, so the common, let's say, behavior in that case is that the window will consume the specific event, so what this event can be is, let's say, a user click or a user touch, a swipe, so what will happen usually is that the window will consume this event, will perform some kind of functionality, and that's it, but you can change that using various flags like the one, the first one that I have here, which is the flag not touchable, so what you can do with that, you can simply let your window dispatch the touch to the window which is below, right, so we give this way click through capability to our window, that's so simple, and to use this flag, you don't need any kind of permission, right, just to make clear. All right, so we said about the look, we said about the behavior, and there is also another interesting, let's say, feature when it comes to these windows, which we'll call them free-floating windows, so they depend solely on the process that they belong to, so what that means is that even if you have created your window within your activity, an activity, and you dismiss this activity, this window will remain there as long as the process is still active, and the other way around, and this is actually something which a lot of malware families are using in various ways, for example, around somewhere, they're using this type of windows to cover the screen so the user loses access to the actual user interface, and like I said, this is just one way to abuse this type of feature when it comes to this type of windows. All right, so let's make a pause here and try to identify what is the main issue, right, so we said that actually, yeah,


chunk_text:
  way click through capability to our window, that's so simple, and to use this flag, you don't need any kind of permission, right, just to make clear. All right, so we said about the look, we said about the behavior, and there is also another interesting, let's say, feature when it comes to these windows, which we'll call them free-floating windows, so they depend solely on the process that they belong to, so what that means is that even if you have created your window within your activity, an activity, and you dismiss this activity, this window will remain there as long as the process is still active, and the other way around, and this is actually something which a lot of malware families are using in various ways, for example, around somewhere, they're using this type of windows to cover the screen so the user loses access to the actual user interface, and like I said, this is just one way to abuse this type of feature when it comes to this type of windows. All right, so let's make a pause here and try to identify what is the main issue, right, so we said that actually, yeah, the Android operating system where more than one app can run at the same time, right, in the background, and we said that each time, only one app will be the one that will be interacting with the user. We have a couple of protections when it comes to the origin of an APK, we have the signature, which can be used to authenticate an app and, you know, ensure that it comes from the same developer, and we have also what we call the trusted sources, which can ensure that an app, let's say, meets some specific criteria, although there is no explicit information showing to the user about the user interface that interacts with and the application that it belongs to, so this is the main problem, and this way, any app can imitate the user interface of another app and claim its identity or claim its privacy, so in most cases, the victims of this, let's say, type of behavior are banking apps or apps in more general which handle some kind of financial data, private info and so on, all right? Okay, so this brings me to the main, let's say, to the first main topic


chunk_text:
  the Android operating system where more than one app can run at the same time, right, in the background, and we said that each time, only one app will be the one that will be interacting with the user. We have a couple of protections when it comes to the origin of an APK, we have the signature, which can be used to authenticate an app and, you know, ensure that it comes from the same developer, and we have also what we call the trusted sources, which can ensure that an app, let's say, meets some specific criteria, although there is no explicit information showing to the user about the user interface that interacts with and the application that it belongs to, so this is the main problem, and this way, any app can imitate the user interface of another app and claim its identity or claim its privacy, so in most cases, the victims of this, let's say, type of behavior are banking apps or apps in more general which handle some kind of financial data, private info and so on, all right? Okay, so this brings me to the main, let's say, to the first main topic when it comes to this type of attack, and we are going to start from the main issues, a GUI confusion attack needs some user interaction, which needs sometimes social engineering, and in general, attacks which depend on this type of, let's say, vulnerabilities, they are considered as low-hanging fruits when they are compared with attacks which depend on memory corruption types and so on, but this is kind of unfair if you think about it, almost every modern malware campaign like, let's say, Flubot, Cerberus, all this, let's say, modern, in a way, families are using this type of attacks in order to achieve their targets, right? For example, the ones that I mentioned, they're using overlays in order to perform phishing or something. So despite the fact that many, let's say, techniques have been presented quite the last few years when it comes to GUI confusion attacks, we may, let's say, classify them in three main categories. So we have the first one, which we're talking about attacks that they are using overlays, and then we have the ones they are using task hijacking, and finally we have the ones which are using what we call activity switching.


chunk_text:
  when it comes to this type of attack, and we are going to start from the main issues, a GUI confusion attack needs some user interaction, which needs sometimes social engineering, and in general, attacks which depend on this type of, let's say, vulnerabilities, they are considered as low-hanging fruits when they are compared with attacks which depend on memory corruption types and so on, but this is kind of unfair if you think about it, almost every modern malware campaign like, let's say, Flubot, Cerberus, all this, let's say, modern, in a way, families are using this type of attacks in order to achieve their targets, right? For example, the ones that I mentioned, they're using overlays in order to perform phishing or something. So despite the fact that many, let's say, techniques have been presented quite the last few years when it comes to GUI confusion attacks, we may, let's say, classify them in three main categories. So we have the first one, which we're talking about attacks that they are using overlays, and then we have the ones they are using task hijacking, and finally we have the ones which are using what we call activity switching. So starting with the first one, the main idea is to conceal a part or all of the message which is communicated to the user via a graphical user interface in order to alter the message, to alter the meaning of this message, and trick the user to take an action that wouldn't normally take. For example, imagine that we have a processor which offers a service, offers a product, and sends a request to the user, a top-up, let's say, pops up from a banking app. The user sees the amount which might be very large, extra large, and the user will reject because the amount was, let's say, insane. If the same attack will be performed from a malware which can't create overlays, then the amount can be simply concealed so the user can be tricked and, let's say, approve the request. So as you understand from what I've said so far, they're all the malware should, must be able to control the position of a window in this imaginary access that I talked to you about in the beginning of this briefing. And one way of doing that is using what we call a type toast window.


chunk_text:
  So starting with the first one, the main idea is to conceal a part or all of the message which is communicated to the user via a graphical user interface in order to alter the message, to alter the meaning of this message, and trick the user to take an action that wouldn't normally take. For example, imagine that we have a processor which offers a service, offers a product, and sends a request to the user, a top-up, let's say, pops up from a banking app. The user sees the amount which might be very large, extra large, and the user will reject because the amount was, let's say, insane. If the same attack will be performed from a malware which can't create overlays, then the amount can be simply concealed so the user can be tricked and, let's say, approve the request. So as you understand from what I've said so far, they're all the malware should, must be able to control the position of a window in this imaginary access that I talked to you about in the beginning of this briefing. And one way of doing that is using what we call a type toast window. This is an old attack, old type attack, and it uses this type of a window, which window by, let's say, construction was created in order to be on top of other apps. Why? Because it has to send a message to the user to take a quick action or something is happening, some kind of an event, so the user has somehow to take an action. So this type of a window, as I said before, should be on top of others. And this is something that this attack, let's say, abuses. Again, create a window manager instance, layout parameters, and this time just use a type toast window, click through capability, change transparency, position, and finally perform the final overlay. The same thing, the same result, different type of window. This actually was used by the clock and anger, let's say, technique. Use a type system alert window or the newest version of it, which is the type application overlay, although, again, the user has to navigate to this specific menu and enable it in order for an app to be able to do that. Yeah, this is this. Another attack, which is not that widely known, it


chunk_text:
  This is an old attack, old type attack, and it uses this type of a window, which window by, let's say, construction was created in order to be on top of other apps. Why? Because it has to send a message to the user to take a quick action or something is happening, some kind of an event, so the user has somehow to take an action. So this type of a window, as I said before, should be on top of others. And this is something that this attack, let's say, abuses. Again, create a window manager instance, layout parameters, and this time just use a type toast window, click through capability, change transparency, position, and finally perform the final overlay. The same thing, the same result, different type of window. This actually was used by the clock and anger, let's say, technique. Use a type system alert window or the newest version of it, which is the type application overlay, although, again, the user has to navigate to this specific menu and enable it in order for an app to be able to do that. Yeah, this is this. Another attack, which is not that widely known, it was actually my first zero day, this one, so this is why I mention that. So it was first found in the Flav99 adware, and what this adware was doing was just loading a library, a native library, and was giving a couple of constants, which was in a function which was implemented in the native layer. So these constants were found to be, to represent window types. The one was the type presentation, the other one was the type toast. The type toast I talked to you about, but the type presentation was, let's say, something like an overlooked type of a window. Someone didn't notice something, so I don't know. And it could create overlays without any kind of permission. So it was giving these values in, let's say, some native implementation of it, and then it was creating, again, a window manager instance, checking if the SDK version was lower or equal to 24 in order to create a type toast window or a type presentation. So that was it, how it was using that. So in Android 10, there was a restriction which says that an app can't start an activity from the background if it


chunk_text:
  was actually my first zero day, this one, so this is why I mention that. So it was first found in the Flav99 adware, and what this adware was doing was just loading a library, a native library, and was giving a couple of constants, which was in a function which was implemented in the native layer. So these constants were found to be, to represent window types. The one was the type presentation, the other one was the type toast. The type toast I talked to you about, but the type presentation was, let's say, something like an overlooked type of a window. Someone didn't notice something, so I don't know. And it could create overlays without any kind of permission. So it was giving these values in, let's say, some native implementation of it, and then it was creating, again, a window manager instance, checking if the SDK version was lower or equal to 24 in order to create a type toast window or a type presentation. So that was it, how it was using that. So in Android 10, there was a restriction which says that an app can't start an activity from the background if it doesn't have some specific, let's say, if some specific conditions apply. One of these conditions was if the app has a visible window in the foreground, then it can start an activity. So this one was using exactly for this way, it was using this, let's say, window type. So it was creating a window which was invisible, all right? So it was not visible to the user, but it was visible for the system. And it was using this window in order to start spamming the user with advertisement. So that was the main, let's say, way of using that. And you can understand by using just zero day in order to spam the user for what kind of revenue we're talking about when it comes to this type of malware. All right. Next one is task hijacking. And in computing, when we're talking about multitasking, we refer to a state where more than one process can run at the same time, right? Although when it comes to Android operating system, a task has a slightly different meaning. So a task is not an app, it's not a process. It's a set of activities that the user interacts with


chunk_text:
  doesn't have some specific, let's say, if some specific conditions apply. One of these conditions was if the app has a visible window in the foreground, then it can start an activity. So this one was using exactly for this way, it was using this, let's say, window type. So it was creating a window which was invisible, all right? So it was not visible to the user, but it was visible for the system. And it was using this window in order to start spamming the user with advertisement. So that was the main, let's say, way of using that. And you can understand by using just zero day in order to spam the user for what kind of revenue we're talking about when it comes to this type of malware. All right. Next one is task hijacking. And in computing, when we're talking about multitasking, we refer to a state where more than one process can run at the same time, right? Although when it comes to Android operating system, a task has a slightly different meaning. So a task is not an app, it's not a process. It's a set of activities that the user interacts with in order to do some kind of a job, right? That's the meaning of it. Now, these activities may belong to different apps, and activities may belong to different tasks. So that's the idea. And these, let's say, attack abuses state transition conditions like task affinity and allow task reparenting in order to do that. So how it does that, imagine we have the victim app, which is a secure app. So the malware, whatever, will create an activity which will set the task affinity to the package name of the app. It will create, it will set actually the flag of this activity, allow task reparenting to true, and then it will try to, let's say, inject itself to the task that the user interacts with when it comes to the specific app, right? That was the idea about this one. And the last one, which is very interesting, although it's very, very simple, abuses APIs which are used in order to bring an activity on top on the foreground, right? So the idea is, again, simple, observe the foreground. If the activity which is currently on top belongs to our target list, then start our own activity and


chunk_text:
  in order to do some kind of a job, right? That's the meaning of it. Now, these activities may belong to different apps, and activities may belong to different tasks. So that's the idea. And these, let's say, attack abuses state transition conditions like task affinity and allow task reparenting in order to do that. So how it does that, imagine we have the victim app, which is a secure app. So the malware, whatever, will create an activity which will set the task affinity to the package name of the app. It will create, it will set actually the flag of this activity, allow task reparenting to true, and then it will try to, let's say, inject itself to the task that the user interacts with when it comes to the specific app, right? That was the idea about this one. And the last one, which is very interesting, although it's very, very simple, abuses APIs which are used in order to bring an activity on top on the foreground, right? So the idea is, again, simple, observe the foreground. If the activity which is currently on top belongs to our target list, then start our own activity and hijack the user session. That's it. We have a couple of exceptions, sorry, a couple of restrictions when it comes to this, let's say, attack. So we don't have visibility of the activity which is on top, right? We have the sandbox. We have a lot of things when it comes to Android. So we don't have visibility regarding that. And we can't start an activity from the background, as I said before. Exceptions, accessibility service, the powerful accessibility service which can be used actually to get your app opt out from almost any kind of UI restriction. We have the user stats when it comes to the first one, the system alert, for which I talked to you about. And we have the full screen intent, which never works. I don't know why. But I added here just for the sake of completeness. Now, we are going to see the first demo. I have quite a few because we're talking about UI. So I created the ROG APK, which performs this task. So what it does, it will observe the foreground. If the app in the foreground belongs to a very, very well-known, let's say, banking app, it will


chunk_text:
  hijack the user session. That's it. We have a couple of exceptions, sorry, a couple of restrictions when it comes to this, let's say, attack. So we don't have visibility of the activity which is on top, right? We have the sandbox. We have a lot of things when it comes to Android. So we don't have visibility regarding that. And we can't start an activity from the background, as I said before. Exceptions, accessibility service, the powerful accessibility service which can be used actually to get your app opt out from almost any kind of UI restriction. We have the user stats when it comes to the first one, the system alert, for which I talked to you about. And we have the full screen intent, which never works. I don't know why. But I added here just for the sake of completeness. Now, we are going to see the first demo. I have quite a few because we're talking about UI. So I created the ROG APK, which performs this task. So what it does, it will observe the foreground. If the app in the foreground belongs to a very, very well-known, let's say, banking app, it will start its own activity. So I hope it will play. Yeah. That was it. Anyway. So not much. Just a few things about the context here. So first of all, as you may notice, there is a small window here. Yeah. On the left side, which is a free floating window, which is used exactly for the reason that I talked to you about. It's a foothold. So it uses this foothold, observes the activity which is on top, and if the activity belongs to the banking app, it will start its own activity. So the user will start, let's say, interacting with the malware instead of the banking app. That's the idea behind this one. All right. So we said that we can use a start activity method in order to start an activity, obviously, and this can start another activity, the new activity can start another one, and so on. But the question here is how these activities are arranged on the screen? And the answer is that they are using what we call a back stack. So imagine something like a last-in, first-out stack where the user can simply add or remove activities from the top of


chunk_text:
  start its own activity. So I hope it will play. Yeah. That was it. Anyway. So not much. Just a few things about the context here. So first of all, as you may notice, there is a small window here. Yeah. On the left side, which is a free floating window, which is used exactly for the reason that I talked to you about. It's a foothold. So it uses this foothold, observes the activity which is on top, and if the activity belongs to the banking app, it will start its own activity. So the user will start, let's say, interacting with the malware instead of the banking app. That's the idea behind this one. All right. So we said that we can use a start activity method in order to start an activity, obviously, and this can start another activity, the new activity can start another one, and so on. But the question here is how these activities are arranged on the screen? And the answer is that they are using what we call a back stack. So imagine something like a last-in, first-out stack where the user can simply add or remove activities from the top of this, let's say, stack by simply interacting with the user interface. Now, what is interesting here is the fact that when an activity is pushed in this stack, it will retain its graphical user interface. And what is even more interesting is the fact that if the user starts another task, let's call it task B, task A will go in the background, and the back stack will remain intact. So when the user removes task B, task A will get again the foreground, and the back stack will be restored. So what I just described can be exceptionally visualized by using a transparent activity. And how we can create one, we just create a theme which has, sorry, a transparent window, the background is the color. Actually, it is also transparent. We don't want the shadowing title. A window is floating means that the window is not anchored, so it can be moved freely. And finally, we have the background theme enabled set to false in order not to blur the activity which is below. That's the only thing that this flag is doing. The next thing was just to choose an app which has some kind of emotion,


chunk_text:
  this, let's say, stack by simply interacting with the user interface. Now, what is interesting here is the fact that when an activity is pushed in this stack, it will retain its graphical user interface. And what is even more interesting is the fact that if the user starts another task, let's call it task B, task A will go in the background, and the back stack will remain intact. So when the user removes task B, task A will get again the foreground, and the back stack will be restored. So what I just described can be exceptionally visualized by using a transparent activity. And how we can create one, we just create a theme which has, sorry, a transparent window, the background is the color. Actually, it is also transparent. We don't want the shadowing title. A window is floating means that the window is not anchored, so it can be moved freely. And finally, we have the background theme enabled set to false in order not to blur the activity which is below. That's the only thing that this flag is doing. The next thing was just to choose an app which has some kind of emotion, right? We wanted to understand the level of intactness, what they mean by intactness. Will the app still keep playing the video, for example? That was the question. All right. And this was the result of the second, I guess. Anyone notice something? Yeah. Yeah. Actually, the result was so good that I myself had to add some kind of a mark in order to understand with which app I was interacting. Was it the YouTube app or was it my app? I mean, so I added this one, and then my next, let's say, thought was to do something a little bit more, let's say, malicious. And I did this one. So if you desperately wanted, let's say, a YouTube premium account, would you click on this one? This is a question here. I don't know. Any feedback? Yeah. Anyway, yeah, I don't think that you like a YouTube premium account. But in any case, I think that the main idea here is that you can integrate the user interface of the activity which is on top with the activity which is below. And by adding, let's say, some specific, let's say, views or effects or something, you can


chunk_text:
  right? We wanted to understand the level of intactness, what they mean by intactness. Will the app still keep playing the video, for example? That was the question. All right. And this was the result of the second, I guess. Anyone notice something? Yeah. Yeah. Actually, the result was so good that I myself had to add some kind of a mark in order to understand with which app I was interacting. Was it the YouTube app or was it my app? I mean, so I added this one, and then my next, let's say, thought was to do something a little bit more, let's say, malicious. And I did this one. So if you desperately wanted, let's say, a YouTube premium account, would you click on this one? This is a question here. I don't know. Any feedback? Yeah. Anyway, yeah, I don't think that you like a YouTube premium account. But in any case, I think that the main idea here is that you can integrate the user interface of the activity which is on top with the activity which is below. And by adding, let's say, some specific, let's say, views or effects or something, you can even alter the user interface of the activity which is below. So that's the main idea behind, let's say, this attack. But there are, okay, there are a lot of restrictions again, right? We don't have visibility. We talked about that. We can't start activities. We talked about that. And we don't have click-through capability. Of course, we can bypass all these things. To put it better, we can get our app opt out from these restrictions by using permissions. But our attack wouldn't be permissionless if we had permissions. All right. So before I explain how we managed to amplify what we had so far in order to get a practical, let's say, create a practical attack and get some security impact regarding this attack, let me first describe our target. So we're targeting critical important screens which can be used in order to request from the user to take some kind of critical decision. So when it comes to third-party apps, we're talking about apps which can be used in order to approve a payment request, a remote login, or some kind of an authorization or something. When it comes to system screens, which is the most interesting


chunk_text:
  even alter the user interface of the activity which is below. So that's the main idea behind, let's say, this attack. But there are, okay, there are a lot of restrictions again, right? We don't have visibility. We talked about that. We can't start activities. We talked about that. And we don't have click-through capability. Of course, we can bypass all these things. To put it better, we can get our app opt out from these restrictions by using permissions. But our attack wouldn't be permissionless if we had permissions. All right. So before I explain how we managed to amplify what we had so far in order to get a practical, let's say, create a practical attack and get some security impact regarding this attack, let me first describe our target. So we're targeting critical important screens which can be used in order to request from the user to take some kind of critical decision. So when it comes to third-party apps, we're talking about apps which can be used in order to approve a payment request, a remote login, or some kind of an authorization or something. When it comes to system screens, which is the most interesting in this case, we're talking about the screens which can be used in order to approve permissions, dangerous or no, system services, privileged access to system, privileged services, or change some kind of a setting. And we may classify those screens in two main categories. So the first category is the single-step decision screens. Simply said, a window will pop up. The user will click on the window, and a decision will be made. And we have the multi-step decision screens where the user has to follow, let's say, some steps and some wizard in the Windows OS in order to get to the final, let's say, screen and click something in order to get the final decision made, right? So let's start with the first one, which is the first line of defense of the Android operating system when it comes to private user info. And this is the permission screens. And when I say about permission screens, we are talking about the ones which control access to user private info like SMS calls, call logs, you name it, the contacts, anything. Or even devices like the microphone, camera, location, right? A lot, a lot of things. So this


chunk_text:
  in this case, we're talking about the screens which can be used in order to approve permissions, dangerous or no, system services, privileged access to system, privileged services, or change some kind of a setting. And we may classify those screens in two main categories. So the first category is the single-step decision screens. Simply said, a window will pop up. The user will click on the window, and a decision will be made. And we have the multi-step decision screens where the user has to follow, let's say, some steps and some wizard in the Windows OS in order to get to the final, let's say, screen and click something in order to get the final decision made, right? So let's start with the first one, which is the first line of defense of the Android operating system when it comes to private user info. And this is the permission screens. And when I say about permission screens, we are talking about the ones which control access to user private info like SMS calls, call logs, you name it, the contacts, anything. Or even devices like the microphone, camera, location, right? A lot, a lot of things. So this is the main idea. That was the main idea behind the first, let's say, the single-step decision dialogues. These dialogues before Android 11, Android 10 belonged to this package here. And they moved to an Apex as many more. They moved to an Apex in Android 11. Although OEMs can customize this user interface, these dialogues using a runtime resource overlays. But what we are most interested in that case is what type of window this permission dialogue is using. And let's say it was surprised to see that it was using a simple base application window, but it had some very interesting flags. One flag is the dim behind, which can be used in order to blur the window which is below this one. And the other one was the high known system overlay windows. And this one is a little bit, let's say, interesting, and I'm going to elaborate a little bit more. So it can be used in order to protect an app from type alert or system alert window type. Okay? And that's the good news. The bad news, up to Android 12 at least, it was that in order to use the flag, the specific


chunk_text:
  is the main idea. That was the main idea behind the first, let's say, the single-step decision dialogues. These dialogues before Android 11, Android 10 belonged to this package here. And they moved to an Apex as many more. They moved to an Apex in Android 11. Although OEMs can customize this user interface, these dialogues using a runtime resource overlays. But what we are most interested in that case is what type of window this permission dialogue is using. And let's say it was surprised to see that it was using a simple base application window, but it had some very interesting flags. One flag is the dim behind, which can be used in order to blur the window which is below this one. And the other one was the high known system overlay windows. And this one is a little bit, let's say, interesting, and I'm going to elaborate a little bit more. So it can be used in order to protect an app from type alert or system alert window type. Okay? And that's the good news. The bad news, up to Android 12 at least, it was that in order to use the flag, the specific flag, you need the high known system overlay windows permission, which is a signature privilege, so it can be used only by system apps. And then this was moved to the high overlay windows, and now you can use also from third-party apps. Okay. But if you think about it, if you think about the activity that I show you, the transparent activity that I show you, it doesn't use any kind of special window, right? Special type or something. We use a humble base application window. So the next step was embarrassingly simple. It was just to add a click-through capability, no rocket science here. You get a handle of the window, set the flags to the not touchable, arrange the view in some way that you can cover the parts that you are interested about, and you have the following result. So here you have the permission dialog on the left side, and on the right side you have the permissionless overlay. So that was the idea, and that was how it worked. To give you some context, our app starts with zero permissions approved. Yeah, and it ends up with all the permissions approved. All right. So


chunk_text:
  flag, you need the high known system overlay windows permission, which is a signature privilege, so it can be used only by system apps. And then this was moved to the high overlay windows, and now you can use also from third-party apps. Okay. But if you think about it, if you think about the activity that I show you, the transparent activity that I show you, it doesn't use any kind of special window, right? Special type or something. We use a humble base application window. So the next step was embarrassingly simple. It was just to add a click-through capability, no rocket science here. You get a handle of the window, set the flags to the not touchable, arrange the view in some way that you can cover the parts that you are interested about, and you have the following result. So here you have the permission dialog on the left side, and on the right side you have the permissionless overlay. So that was the idea, and that was how it worked. To give you some context, our app starts with zero permissions approved. Yeah, and it ends up with all the permissions approved. All right. So that was the, let's say, the main points out of it. I guess a good viewer may notice the short delay when it comes to the overlay and the permission dialog, but this can be adjusted. This actually belongs to a loop. We just use the loop in order to ask the permissions, but you can adjust the time that you request the permission so you can put your overlay on the right time. All right. So I guess permissions dialogs are cool. They can be used in order to get any kind of info when it has private user information, but can we do something better? And the next, let's say, challenge was the multistep decision dialogs, which can be used in order to approve access to very interesting services like the accessibility service or give you access to the files of the device, the external directory after the introduction of the scoped, let's say, storage. Then you can get access to, you can get your app as a device administrator. You can get the system alert window, notification access, premium SMS, and, of course, to install unknown apps. So all these things are, as you understand, quite privileged


chunk_text:
  that was the, let's say, the main points out of it. I guess a good viewer may notice the short delay when it comes to the overlay and the permission dialog, but this can be adjusted. This actually belongs to a loop. We just use the loop in order to ask the permissions, but you can adjust the time that you request the permission so you can put your overlay on the right time. All right. So I guess permissions dialogs are cool. They can be used in order to get any kind of info when it has private user information, but can we do something better? And the next, let's say, challenge was the multistep decision dialogs, which can be used in order to approve access to very interesting services like the accessibility service or give you access to the files of the device, the external directory after the introduction of the scoped, let's say, storage. Then you can get access to, you can get your app as a device administrator. You can get the system alert window, notification access, premium SMS, and, of course, to install unknown apps. So all these things are, as you understand, quite privileged when it comes to Android. All right. So the first challenge when it comes to this type of, let's say, dialogs was to minimize the steps that the user has to take in order to approve access, to give access, right? So we have to minimize the steps to get to this button there and make the user to click on this button. But there is a convenient way of doing that. You can just create an intent, set the actual action to the corresponding menu that you are interested about, and you can start the activity in order to navigate the user to the menu that you want. For example, you want to get the user to the manage overlay display on top. You can just create the first one, accessibility service the second one, and so on. All right. So that was easy. But we still have two steps. The first step, the user has to choose our app between a list, actually, with apps which request the same type of access. And the second step is, of course, to trick the user to click on this button there. But if you notice the first list, the activities,


chunk_text:
  when it comes to Android. All right. So the first challenge when it comes to this type of, let's say, dialogs was to minimize the steps that the user has to take in order to approve access, to give access, right? So we have to minimize the steps to get to this button there and make the user to click on this button. But there is a convenient way of doing that. You can just create an intent, set the actual action to the corresponding menu that you are interested about, and you can start the activity in order to navigate the user to the menu that you want. For example, you want to get the user to the manage overlay display on top. You can just create the first one, accessibility service the second one, and so on. All right. So that was easy. But we still have two steps. The first step, the user has to choose our app between a list, actually, with apps which request the same type of access. And the second step is, of course, to trick the user to click on this button there. But if you notice the first list, the activities, actually, the packages there are arranged in an alphabetical way, right? They are ordered alphabetically. So the only thing that you have to do is just to name your app, I guess, with some A's like we did here, AA, so that explains the name, in order to predict the position of our app in this specific list because it's very important, right? So the next step was to create a ROG APK, which will simply start the first menu, this one that you see here, and then start an activity which will cover the parts that we're interested about. So we can just focus the user only on our own app. So that was the first step. And then use a trampoline activity. I will explain why I named it like this. In order to start another overlay which will cover, again, the parts of the dialogue, of the second dialogue that can be used in order to, let's say, communicate to the user that, you know, you are approving something which might be bad. All right. So this was the result. I told you we're going to see quite a lot of short clips. And this is to


chunk_text:
  actually, the packages there are arranged in an alphabetical way, right? They are ordered alphabetically. So the only thing that you have to do is just to name your app, I guess, with some A's like we did here, AA, so that explains the name, in order to predict the position of our app in this specific list because it's very important, right? So the next step was to create a ROG APK, which will simply start the first menu, this one that you see here, and then start an activity which will cover the parts that we're interested about. So we can just focus the user only on our own app. So that was the first step. And then use a trampoline activity. I will explain why I named it like this. In order to start another overlay which will cover, again, the parts of the dialogue, of the second dialogue that can be used in order to, let's say, communicate to the user that, you know, you are approving something which might be bad. All right. So this was the result. I told you we're going to see quite a lot of short clips. And this is to get the system alert window. Yeah. Our app starts again with zero. I mean, with no permission approved. So the message is totally, of course, you can change the message, but this is something which is far from the actual message. Yeah. And we have this permission approved. Right? So simple. Okay. All right. So how we did that, let's go to the technical part. All right. Which, like I said, is pretty much simple. So we're starting with our main activity with our create method where we're creating an intent. We're just adding this action here that I talked to you about in the previous slides. And the first thing is to start the display on top. Right? Which is going to trigger the Android settings app and start the display on top access menu. That's the first step. Then we're starting immediately another activity which we call trampoline and will make sense after you see this. Which will, again, in the create method, will start the second instance of display on top access menu. So what this will do is to bring our trampoline activity in the on pose state. So it will just try to remove our


chunk_text:
  get the system alert window. Yeah. Our app starts again with zero. I mean, with no permission approved. So the message is totally, of course, you can change the message, but this is something which is far from the actual message. Yeah. And we have this permission approved. Right? So simple. Okay. All right. So how we did that, let's go to the technical part. All right. Which, like I said, is pretty much simple. So we're starting with our main activity with our create method where we're creating an intent. We're just adding this action here that I talked to you about in the previous slides. And the first thing is to start the display on top. Right? Which is going to trigger the Android settings app and start the display on top access menu. That's the first step. Then we're starting immediately another activity which we call trampoline and will make sense after you see this. Which will, again, in the create method, will start the second instance of display on top access menu. So what this will do is to bring our trampoline activity in the on pose state. So it will just try to remove our activity from the top of the back stack and we'll try to set it on the on pose state. But instead of staying there, we are going to start another activity which we'll call overlay trampoline that will do the following. So in the first step, it will modify user interface in order to cover the first menu dialog. So the user will click. So this will trigger the second step. But bring our own activity in the on pose state. So we can now modify our user interface. Then, again, cover the second part of the dialog. And when the user clicks again, we can navigate the user somewhere else. So why we did that, why we are using that instead of something else? We are using that because, as I said before, we don't have our app doesn't get notified about the touch, the user's touch. So we can't know, there's no way to know if the user clicked on this menu. So we identify that by the life cycle of the activity. We can see that when the activity goes on the on pose state, this means that the user clicked on the menu. So our activity


chunk_text:
  activity from the top of the back stack and we'll try to set it on the on pose state. But instead of staying there, we are going to start another activity which we'll call overlay trampoline that will do the following. So in the first step, it will modify user interface in order to cover the first menu dialog. So the user will click. So this will trigger the second step. But bring our own activity in the on pose state. So we can now modify our user interface. Then, again, cover the second part of the dialog. And when the user clicks again, we can navigate the user somewhere else. So why we did that, why we are using that instead of something else? We are using that because, as I said before, we don't have our app doesn't get notified about the touch, the user's touch. So we can't know, there's no way to know if the user clicked on this menu. So we identify that by the life cycle of the activity. We can see that when the activity goes on the on pose state, this means that the user clicked on the menu. So our activity went on the on pose state. And we can just, let's say, change and do all these things that we did before. So what I didn't cover so far is how we identify the current step that we are currently with in, sorry. So we're just using an intent, an extra. We name it step. And then a simple switch case just to check in which step we are. So then we just modifying the message that we are showing to the user. We are modifying some parameters like the XY parameter that I showed you in the beginning. And we are creating the overlay. So this is the idea. Get the intent. Get the window manager instance. As you see, we are not using any kind of special window type. We're just using a type application window. No permissions, nothing here. We just modify the settings like XY with this kind of stuff. And we are covering the parts of the dialogue that we are interested about. This is for the first step. And then we go to the on pose state. We just increase our step one, let's say, like one step more. And we're going to the


chunk_text:
  went on the on pose state. And we can just, let's say, change and do all these things that we did before. So what I didn't cover so far is how we identify the current step that we are currently with in, sorry. So we're just using an intent, an extra. We name it step. And then a simple switch case just to check in which step we are. So then we just modifying the message that we are showing to the user. We are modifying some parameters like the XY parameter that I showed you in the beginning. And we are creating the overlay. So this is the idea. Get the intent. Get the window manager instance. As you see, we are not using any kind of special window type. We're just using a type application window. No permissions, nothing here. We just modify the settings like XY with this kind of stuff. And we are covering the parts of the dialogue that we are interested about. This is for the first step. And then we go to the on pose state. We just increase our step one, let's say, like one step more. And we're going to the second one, which we are covering the other parts, right? Like we saw in the demo. All right. So that was the main idea of the attack. But what we managed to take out of it, which screens were vulnerable. So we managed to get all the dangerous permissions like i talked to you about, like SMS, call logs, everything. Then we managed to get all file access. We managed to set our app as a device admin. As you understand, i couldn't bring a demo for each one of them. But, yeah, we managed to get the device admin access, display on top of other apps, modify system settings, install unknown apps and get users access. So as you understand, when it comes to Android operating system, this thing is quite powerful. If you manage to get all these permissions for your app, then you have something which is, i would say, something like malware and steroids. So it's quite big. What we didn't manage to get in this case was notification access and accessibility service. That would be wonderful, but we didn't. Anyway. So, okay. Let's summarize what we have. So we said that the main idea, i


chunk_text:
  second one, which we are covering the other parts, right? Like we saw in the demo. All right. So that was the main idea of the attack. But what we managed to take out of it, which screens were vulnerable. So we managed to get all the dangerous permissions like i talked to you about, like SMS, call logs, everything. Then we managed to get all file access. We managed to set our app as a device admin. As you understand, i couldn't bring a demo for each one of them. But, yeah, we managed to get the device admin access, display on top of other apps, modify system settings, install unknown apps and get users access. So as you understand, when it comes to Android operating system, this thing is quite powerful. If you manage to get all these permissions for your app, then you have something which is, i would say, something like malware and steroids. So it's quite big. What we didn't manage to get in this case was notification access and accessibility service. That would be wonderful, but we didn't. Anyway. So, okay. Let's summarize what we have. So we said that the main idea, i mean, the design issue here is that the user can identify with which app, let's say, interacts with. Right? That's the first issue. And the other one was when the activity is pushed in this back stack, it will retain the graphical user interface. The main idea was to integrate the user interface of the activity which is on top with the user interface of the activity which is below and add click-through capability in order to hijack single-step decision dialogues, multi-step decision dialogues and also third-party apps. All right. So that's how we can protect apps from this type of attacks. And the only way to protect an app from this type of attack, and this is actually what was the mitigation regarding the system dialogues, is to check if the motion event which creates a click is partially or fully obscured. That's the only way to do that. So you get this flag. You see if this flag is, let's say, set, and if it is partially obscured or if it's obscured, then you can just reject the specific click or touch. There is another way, but no, it can't protect you from this type of attack, but


chunk_text:
  mean, the design issue here is that the user can identify with which app, let's say, interacts with. Right? That's the first issue. And the other one was when the activity is pushed in this back stack, it will retain the graphical user interface. The main idea was to integrate the user interface of the activity which is on top with the user interface of the activity which is below and add click-through capability in order to hijack single-step decision dialogues, multi-step decision dialogues and also third-party apps. All right. So that's how we can protect apps from this type of attacks. And the only way to protect an app from this type of attack, and this is actually what was the mitigation regarding the system dialogues, is to check if the motion event which creates a click is partially or fully obscured. That's the only way to do that. So you get this flag. You see if this flag is, let's say, set, and if it is partially obscured or if it's obscured, then you can just reject the specific click or touch. There is another way, but no, it can't protect you from this type of attack, but it can protect you from system alert window which is the hide overlay windows that I talked to you about, and it was imported in Android 12. So you can use this one and use the set hide overlay windows methods to protect your, let's say, activity from these kinds of attacks, but again with special type of windows. And with that being said, that was the last one. Thank you very much for viewing this. If you have any questions, I will be happy to answer. Thank you. Thank you. Okay. Thank you. Any questions? Yeah. If you can go to the second to last slide, what does it mean if it's obscured? Obscured means that it's discovered from another window. Okay. So there is a flag for this. Yeah. It's a flag. It's not used normally then. What do you mean it's not used? It's a property of the motion event which identifies if this motion event, let's say, comes from, it comes using a dispatch, to put it this way. So you are dispatching. It was dispatched. Okay. So that's what it means, simply said. Thank you. Here, your top right. So thanks for the presentation. Very


chunk_text:
  it can protect you from system alert window which is the hide overlay windows that I talked to you about, and it was imported in Android 12. So you can use this one and use the set hide overlay windows methods to protect your, let's say, activity from these kinds of attacks, but again with special type of windows. And with that being said, that was the last one. Thank you very much for viewing this. If you have any questions, I will be happy to answer. Thank you. Thank you. Okay. Thank you. Any questions? Yeah. If you can go to the second to last slide, what does it mean if it's obscured? Obscured means that it's discovered from another window. Okay. So there is a flag for this. Yeah. It's a flag. It's not used normally then. What do you mean it's not used? It's a property of the motion event which identifies if this motion event, let's say, comes from, it comes using a dispatch, to put it this way. So you are dispatching. It was dispatched. Okay. So that's what it means, simply said. Thank you. Here, your top right. So thanks for the presentation. Very nice. This mitigation would imply that every single developer needs to do on every single touch event this kind of mitigation. When it comes, yeah, of course, when it comes to, like I said, to critical decision screens, not everywhere, right? Yeah. But still, this would not really protect you against the type of vulnerabilities that you showed which were at the OS level for approving permissions, right? When it comes to approving permissions, this thing has already mitigated, right? There is a fix. It has been applied. So there's no, I mean, if you try to run the same thing on the newest Android versions, it won't work. But when it comes to third-party apps, yeah, there is still an issue with that. You can use that in order, let's say, to create this kind of permissions. Although, I mean, you need again to bypass some restrictions. So you have to get your app, let's say, some kind of permissions in order to do that. But, yeah, it still works. I mean, if your app doesn't have this flag set, yeah, it works. So I was wondering, given that Google fixed this in the OS itself, are they planning


chunk_text:
  nice. This mitigation would imply that every single developer needs to do on every single touch event this kind of mitigation. When it comes, yeah, of course, when it comes to, like I said, to critical decision screens, not everywhere, right? Yeah. But still, this would not really protect you against the type of vulnerabilities that you showed which were at the OS level for approving permissions, right? When it comes to approving permissions, this thing has already mitigated, right? There is a fix. It has been applied. So there's no, I mean, if you try to run the same thing on the newest Android versions, it won't work. But when it comes to third-party apps, yeah, there is still an issue with that. You can use that in order, let's say, to create this kind of permissions. Although, I mean, you need again to bypass some restrictions. So you have to get your app, let's say, some kind of permissions in order to do that. But, yeah, it still works. I mean, if your app doesn't have this flag set, yeah, it works. So I was wondering, given that Google fixed this in the OS itself, are they planning to also fix it for third-party applications? I don't think so from the point that, I mean, they can't make you use these flags, right? It's something which is not, it doesn't stand from this point. This is actually something which I have been discussing within my company. There are, let's say, some cases where you can't apply these flags because it breaks a lot, a lot of things, right? You know, when you're developing something and you're just changing a small flag which was used for something else, then it can break a chain of things, and this can be a disaster. So like I said, you can't use these flags when you have really important decision screens. Really, you can add them in your view, let's say, your button, your tangle, or whatever, in order to protect it from this type of attack. That's the only thing you can do, I guess. Yeah, but maybe the inverse should be applied. Maybe these flags should be the default, and then if you have a name... Yeah, I don't know. I mean, that's, you have to, you know the triangle, right? You have functionality, you have, yeah, but... Convenience. Yeah,


chunk_text:
  to also fix it for third-party applications? I don't think so from the point that, I mean, they can't make you use these flags, right? It's something which is not, it doesn't stand from this point. This is actually something which I have been discussing within my company. There are, let's say, some cases where you can't apply these flags because it breaks a lot, a lot of things, right? You know, when you're developing something and you're just changing a small flag which was used for something else, then it can break a chain of things, and this can be a disaster. So like I said, you can't use these flags when you have really important decision screens. Really, you can add them in your view, let's say, your button, your tangle, or whatever, in order to protect it from this type of attack. That's the only thing you can do, I guess. Yeah, but maybe the inverse should be applied. Maybe these flags should be the default, and then if you have a name... Yeah, I don't know. I mean, that's, you have to, you know the triangle, right? You have functionality, you have, yeah, but... Convenience. Yeah, so, yeah, I mean, it's something that, I guess, they leave it up to the developer to decide how they, I mean, how they can arrange that thing there. Yeah, okay, thanks. All right. Thank you. Any other questions? Yeah, there. Hi. Hello. I wonder how could you make an application, a phishing application, that uses the Heavy Lantern presented in the first slides, the Heavy Lantern mechanism without the user noticing the app while navigating between apps? The first one, I mean, the task switching, right? Yeah. Yeah, so this attack leverages the fact that the human eye can't, let's say, perceive the transition state from one activity to another due to the short transition time. So there's a very short transition time in order to identify, to see this. I mean, so the human eye can't perceive that. If we go back and go very, very slowly, you can see the transition, actually. But, no, when it normally works, no, there's no way. So this is what this attack actually leverages. And, actually, this is something which is used by a lot of malware families in order to do such a thing. They're using this switch, activity switch,


chunk_text:
  so, yeah, I mean, it's something that, I guess, they leave it up to the developer to decide how they, I mean, how they can arrange that thing there. Yeah, okay, thanks. All right. Thank you. Any other questions? Yeah, there. Hi. Hello. I wonder how could you make an application, a phishing application, that uses the Heavy Lantern presented in the first slides, the Heavy Lantern mechanism without the user noticing the app while navigating between apps? The first one, I mean, the task switching, right? Yeah. Yeah, so this attack leverages the fact that the human eye can't, let's say, perceive the transition state from one activity to another due to the short transition time. So there's a very short transition time in order to identify, to see this. I mean, so the human eye can't perceive that. If we go back and go very, very slowly, you can see the transition, actually. But, no, when it normally works, no, there's no way. So this is what this attack actually leverages. And, actually, this is something which is used by a lot of malware families in order to do such a thing. They're using this switch, activity switch, in order to do that. So it is something which is valid. That's what I mean. Because while you showed the video about the evidence mechanism, we could see the malicious app in the background while navigating between apps. So I wonder... Yeah, if you push it in the background. Yeah. Yeah, that's a way to do that. But how many times you do that? I mean, you have your banking app, right? You're just clicking on your banking app. I don't know. Yeah, maybe. I don't know. If you are sometimes, let's say, very security-focused, yeah, I agree with you. We will do that. But, honestly, I prefer not to install something. That's my first rule when it comes to security. But, yeah, when you push the app back in the back stack, you can see which, actually, in which app it belongs to. But, like I said, you don't see that. But I wonder, is there a mechanism to phantomize, maybe, to... There are a lot of things that have been, let's say, introduced in order to show the user that you are interacting with this app. There are some papers about it. But, you know, when it


chunk_text:
  in order to do that. So it is something which is valid. That's what I mean. Because while you showed the video about the evidence mechanism, we could see the malicious app in the background while navigating between apps. So I wonder... Yeah, if you push it in the background. Yeah. Yeah, that's a way to do that. But how many times you do that? I mean, you have your banking app, right? You're just clicking on your banking app. I don't know. Yeah, maybe. I don't know. If you are sometimes, let's say, very security-focused, yeah, I agree with you. We will do that. But, honestly, I prefer not to install something. That's my first rule when it comes to security. But, yeah, when you push the app back in the back stack, you can see which, actually, in which app it belongs to. But, like I said, you don't see that. But I wonder, is there a mechanism to phantomize, maybe, to... There are a lot of things that have been, let's say, introduced in order to show the user that you are interacting with this app. There are some papers about it. But, you know, when it comes to this stuff, I think that, I mean, I think so. I'm not sure. But I think that Google has to, let's say, put a balance between usability. They don't want to interrupt the user experience with... Because, okay, you can... There are some cases. There are some papers. They're showing some things, like, you know, we can add a bar here which says that you are interacting with this app. Like we have in Windows, for example, right? You know with which app you are interacting with. But, no, here, I mean, there's no nothing. At least for now, nothing. As far as I know. Yeah. Thank you. Thank you very much. I still have one question here. Hi. Hello. Thanks for the presentation. It was very interesting. So, the last slide, I mean, not the last, but the one presenting speaks about mitigation. Yeah. What about common users mitigation or protection apart from good IGN and not installing everything on Google App, on Google Play? Yeah. Unfortunately, that's something, yeah, that has to do with... When it comes to Android, I mean, there are some specific, let's say, steps that you have to follow when it comes


chunk_text:
  comes to this stuff, I think that, I mean, I think so. I'm not sure. But I think that Google has to, let's say, put a balance between usability. They don't want to interrupt the user experience with... Because, okay, you can... There are some cases. There are some papers. They're showing some things, like, you know, we can add a bar here which says that you are interacting with this app. Like we have in Windows, for example, right? You know with which app you are interacting with. But, no, here, I mean, there's no nothing. At least for now, nothing. As far as I know. Yeah. Thank you. Thank you very much. I still have one question here. Hi. Hello. Thanks for the presentation. It was very interesting. So, the last slide, I mean, not the last, but the one presenting speaks about mitigation. Yeah. What about common users mitigation or protection apart from good IGN and not installing everything on Google App, on Google Play? Yeah. Unfortunately, that's something, yeah, that has to do with... When it comes to Android, I mean, there are some specific, let's say, steps that you have to follow when it comes to security. Never, of course, the first one, the first rule, never trust an app which is off market. We never install an app from any source. You never know what... You know why. I mean, when it comes to Play Store, at least they have some rules. You can't upload your app and request accessibility service without have some kind of, you know, let's say, reasoning about it, right? When it comes to off market, you can do whatever you want. There's no... Although there are mitigations. I mean, in Android 13, you can't access the... You can't request accessibility service when you are off market. Anyway, but what I want to say is that make sure that the sources from which you are installing your apps are, first of all, trusted, and then what kind of permissions you are approving. For example, the system alert window, for me, it's powerful, right? It can bypass a lot of restrictions. And people, you know, just, yeah, approve it. There's nothing... Yeah, because they don't know about it. So just approve this permission. It can, you know, it can give a lot of privilege to an app, right? And it can


chunk_text:
  to security. Never, of course, the first one, the first rule, never trust an app which is off market. We never install an app from any source. You never know what... You know why. I mean, when it comes to Play Store, at least they have some rules. You can't upload your app and request accessibility service without have some kind of, you know, let's say, reasoning about it, right? When it comes to off market, you can do whatever you want. There's no... Although there are mitigations. I mean, in Android 13, you can't access the... You can't request accessibility service when you are off market. Anyway, but what I want to say is that make sure that the sources from which you are installing your apps are, first of all, trusted, and then what kind of permissions you are approving. For example, the system alert window, for me, it's powerful, right? It can bypass a lot of restrictions. And people, you know, just, yeah, approve it. There's nothing... Yeah, because they don't know about it. So just approve this permission. It can, you know, it can give a lot of privilege to an app, right? And it can do all this kind of stuff, all this magic with the user interface. So, yeah, you have to engage. You have to be careful with that. You have to check your sources. Yeah, that's the only thing you can do, I guess. All right? Thank you. Other questions? Oh, okay. Still another one. Yeah, I was wondering, first of all, thanks for the great talk. Thank you. I was wondering if there are any actual use cases for overlays that you know about or... Like I said, I mean, when it comes to overlays, when it comes to great confusion attacks in general, like I said, most modern malware families are using this kind of stuff. For example, you have Cerberus, right, which is very well-known. It just starts screeching. When it comes to this attack, no. So far, no. The one that I talked to you about, no. There's no, I mean, evidence, at least, that uses this type of attack, right? The ones that I showed you. My question was not about attacks, but more legitimate apps having actual use cases for being overlaid. Overlays. Yeah, I mean, of course. I think that, not I think, actually, you


chunk_text:
  do all this kind of stuff, all this magic with the user interface. So, yeah, you have to engage. You have to be careful with that. You have to check your sources. Yeah, that's the only thing you can do, I guess. All right? Thank you. Other questions? Oh, okay. Still another one. Yeah, I was wondering, first of all, thanks for the great talk. Thank you. I was wondering if there are any actual use cases for overlays that you know about or... Like I said, I mean, when it comes to overlays, when it comes to great confusion attacks in general, like I said, most modern malware families are using this kind of stuff. For example, you have Cerberus, right, which is very well-known. It just starts screeching. When it comes to this attack, no. So far, no. The one that I talked to you about, no. There's no, I mean, evidence, at least, that uses this type of attack, right? The ones that I showed you. My question was not about attacks, but more legitimate apps having actual use cases for being overlaid. Overlays. Yeah, I mean, of course. I think that, not I think, actually, you know, the bubbles that you see in your device, like the messengers and stuff, they are using this alert type system, alert window, in order to do that. Actually, there are two ways in order to do that. It's picture-in-picture, which creates a small window like the maps. You use a maps app. You just minimize it so it will go. This is picture-in-picture. And the other one is using a system alert, which is a legitimate way, yeah. That's for the legitimate way to use it, to be on top of other apps. Yeah. So it's useless. It's useless. Anyway, yeah. Other questions? Okay. Perfect. So thank you again for your presentation. Thank you very much. Thank you. Thank you.


chunk_text:
  know, the bubbles that you see in your device, like the messengers and stuff, they are using this alert type system, alert window, in order to do that. Actually, there are two ways in order to do that. It's picture-in-picture, which creates a small window like the maps. You use a maps app. You just minimize it so it will go. This is picture-in-picture. And the other one is using a system alert, which is a legitimate way, yeah. That's for the legitimate way to use it, to be on top of other apps. Yeah. So it's useless. It's useless. Anyway, yeah. Other questions? Okay. Perfect. So thank you again for your presentation. Thank you very much. Thank you. Thank you.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=88dIdx3PXFQ", "title": "Attacking And Defending GraphQL: The Ultimate Guide by Leo Juszkiewicz", "description": "", "channel_url": "https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA", "duration": 2959, "channel": "scrt.insomnihack", "uploader": "scrt.insomnihack", "upload_date": "20230411" } This text was transcribed using whisper model: large-v2 Okay, so first of all, as usual, I want to thank Insomniac, ICRT, basically everyone that organized this great event, I'm really excited to be here, this is my first time in Switzerland, you have a great country, specifically here in Lausanne, right, France as well, I guess. So let's start with this, we have attacking and defending GraphQL, the ultimate guide, my name is Leo Joskowicz, so let's start. First of all, you don't know me, so let's start with a quick who am I, so I'm originally from Mexico, yeah, I can prove that, basically because I love chili, I love spicy, if you see me somewhere around just pouring some chili on my soup, don't worry, I was born like that, also other hobbies that I have as well, Swiss chocolate, not because I'm here, I'm telling you, I always love the Swiss chocolate, soccer or football, whatever you call it. I used to get certified, I wasn't sure if I was supposed to say that or not, but I have all these OSCP, OSCE, CPPT, EMAP, EWPT, PTX, so on, but not anymore. I work as an application security architect in Dario Health, which is, as its name implies, it's a healthcare company based in New York, I do a lot of stuff, you know, like design reviews and making sure the code and processes, everything is as secure as possible, I used to be in my previous jobs, security researcher, but mainly in the web security area. And also, when I have time, I'm pursuing my MSc, my master's, in cybersecurity from the University of London, and basically that's all about me for now. So the agenda for today is going to be just a quick overview about what is GraphQL, maybe some of you are familiar with, maybe not, so we'll just give a quick recap and we'll start gradually moving on to more topics, more operations, directives, and more less common stuff, actually. We're going to see also some terminology, because we need to understand that in order to understand attacks and how to defend ourselves. We'll do also a comparison with other APIs, so the RESTful API,


chunk_text:
  supposed to say that or not, but I have all these OSCP, OSCE, CPPT, EMAP, EWPT, PTX, so on, but not anymore. I work as an application security architect in Dario Health, which is, as its name implies, it's a healthcare company based in New York, I do a lot of stuff, you know, like design reviews and making sure the code and processes, everything is as secure as possible, I used to be in my previous jobs, security researcher, but mainly in the web security area. And also, when I have time, I'm pursuing my MSc, my master's, in cybersecurity from the University of London, and basically that's all about me for now. So the agenda for today is going to be just a quick overview about what is GraphQL, maybe some of you are familiar with, maybe not, so we'll just give a quick recap and we'll start gradually moving on to more topics, more operations, directives, and more less common stuff, actually. We're going to see also some terminology, because we need to understand that in order to understand attacks and how to defend ourselves. We'll do also a comparison with other APIs, so the RESTful API, which is the most widely known technology, and we will see also real exploit scenarios, so we can see how things go in real life, but also we will see other attack vectors, other places where we can be hacked or attacked if we are not aware or we don't care enough. And lastly, of course, we're going to see some remediations or ways to mitigate those, how we can defend ourselves, how we can make sure that if we adopt or if we adopted already this technology, so we are safe. So let's start with a quick overview, but before that I would like just to clarify, I don't know, just somebody saw me downstairs and he was like, oh, you're a hacker, so you're probably on drugs. I'm like, no, I'm not, dude, I just have red eyes, I just went to the doctor, so I'm not on drugs. Okay, so API basics. So you already know what an API is, or if not, it just allows you to exchange data or information with different applications. Usually you follow some rules, some header, some token, key, password that you need to share with the service provider or the


chunk_text:
  which is the most widely known technology, and we will see also real exploit scenarios, so we can see how things go in real life, but also we will see other attack vectors, other places where we can be hacked or attacked if we are not aware or we don't care enough. And lastly, of course, we're going to see some remediations or ways to mitigate those, how we can defend ourselves, how we can make sure that if we adopt or if we adopted already this technology, so we are safe. So let's start with a quick overview, but before that I would like just to clarify, I don't know, just somebody saw me downstairs and he was like, oh, you're a hacker, so you're probably on drugs. I'm like, no, I'm not, dude, I just have red eyes, I just went to the doctor, so I'm not on drugs. Okay, so API basics. So you already know what an API is, or if not, it just allows you to exchange data or information with different applications. Usually you follow some rules, some header, some token, key, password that you need to share with the service provider or the service provider actually provides you. Let's say we want to query the weather information for today, so we set a set of rules, a few fields that you need to provide in order to get the full weather or just one piece. But APIs became really crucial just last year because they bring a lot of benefits. This is the way of exchanging data between my app and the rest of the applications, okay? We see them basically all over. If you know YouTube, if you know Facebook, basically almost every single application in the world, mostly the public ones, they share some kind of information or API for you to reuse and query their data. If you want to get, let's say, your video and you don't want to go and click on your video link every time you want to get the viewers or you want to get some other information, you usually do this through an API provided by the service provider, but as well if you want your service to be used by other users in the world, other services, so you need to provide that also as well. So almost 70% expect to rely more,


chunk_text:
  service provider actually provides you. Let's say we want to query the weather information for today, so we set a set of rules, a few fields that you need to provide in order to get the full weather or just one piece. But APIs became really crucial just last year because they bring a lot of benefits. This is the way of exchanging data between my app and the rest of the applications, okay? We see them basically all over. If you know YouTube, if you know Facebook, basically almost every single application in the world, mostly the public ones, they share some kind of information or API for you to reuse and query their data. If you want to get, let's say, your video and you don't want to go and click on your video link every time you want to get the viewers or you want to get some other information, you usually do this through an API provided by the service provider, but as well if you want your service to be used by other users in the world, other services, so you need to provide that also as well. So almost 70% expect to rely more, even more, on APIs on 2023. That's according to statefulstateoffpis.com, but that's just a number, okay? It could be, you know, millions of users and millions of applications as well. So we used to have something called the traditional REST API or RESTful APIs, and that used to be the standard. We know we have several methods, HTTP post or put to create or modify data, delete if you want to remove some items, something on the server, get if you want just to retrieve data or you want to read data from the server, and we used to have many endpoints, okay? We'll talk about this later. And also the way of interacting with the server, it was by using JSON or XML. XML may be less common, but if you know Google Cloud or one of these services, so they still use kind of like an XML API where you can actually use XML as part of the, I mean, to call the API service. But we used to have many endpoints, like if you want to query for orders, you want to query for users, history, logs, every service or every component of the application is just


chunk_text:
  even more, on APIs on 2023. That's according to statefulstateoffpis.com, but that's just a number, okay? It could be, you know, millions of users and millions of applications as well. So we used to have something called the traditional REST API or RESTful APIs, and that used to be the standard. We know we have several methods, HTTP post or put to create or modify data, delete if you want to remove some items, something on the server, get if you want just to retrieve data or you want to read data from the server, and we used to have many endpoints, okay? We'll talk about this later. And also the way of interacting with the server, it was by using JSON or XML. XML may be less common, but if you know Google Cloud or one of these services, so they still use kind of like an XML API where you can actually use XML as part of the, I mean, to call the API service. But we used to have many endpoints, like if you want to query for orders, you want to query for users, history, logs, every service or every component of the application is just another slash something, sometimes a few slashes. That was just basically the RESTful or the old or the traditional method that we know. So the economy just to reinforce a little bit more about this, they said, I think it's in 2017, I'm not affiliated with them, okay? So they said that the world's most valuable resource is no longer oil, is data, okay? And when we talk about data is the API, because this is the way of exchanging the data between you and the application, okay? So if you want to invest, maybe this is your opportunity. I'm not sure, yeah, if REST actually stands for Relaxation REST, RESTful APIs. So let's see a few GraphQL fundamentals now. What is GraphQL? So GraphQL is an open source data query and manipulation technology that is used for APIs. It was mainly created by Facebook or Meta back in, I think it was in 2012, and they released this to the public in 2015. Why they did it or what's so great about GraphQL? So first of all, it's flexible, okay? You can change pieces in amount of just seconds or minutes. You don't need to change your whole architecture


chunk_text:
  another slash something, sometimes a few slashes. That was just basically the RESTful or the old or the traditional method that we know. So the economy just to reinforce a little bit more about this, they said, I think it's in 2017, I'm not affiliated with them, okay? So they said that the world's most valuable resource is no longer oil, is data, okay? And when we talk about data is the API, because this is the way of exchanging the data between you and the application, okay? So if you want to invest, maybe this is your opportunity. I'm not sure, yeah, if REST actually stands for Relaxation REST, RESTful APIs. So let's see a few GraphQL fundamentals now. What is GraphQL? So GraphQL is an open source data query and manipulation technology that is used for APIs. It was mainly created by Facebook or Meta back in, I think it was in 2012, and they released this to the public in 2015. Why they did it or what's so great about GraphQL? So first of all, it's flexible, okay? You can change pieces in amount of just seconds or minutes. You don't need to change your whole architecture in the front end or in other places. And it's very efficient, okay? Because we will see later where, how you can just query only or basically send only one request with many queries instead of sending dozens of queries for that. Also one of the problems, we'll see that by comparing them. So one of the problems with REST APIs is that you get everything, you query for orders, you get all the orders. Okay, you can query for the ID, but you get sometimes all the details, not really necessarily at this moment, but you get everything in the same packet. With GraphQL, you specify what exactly you want, okay? So in many cases where you are, you need compliance, HIPAA, GDPR or whatever, and any other regulation, and you are requested not to, I mean, everyone basically, but specifically these companies, much more. So they reduce drastically with GraphQL, just with the disclosure of PII or PHI, personal identifiable information, or PHI, which is the same acronym just for health information, like diagnostics and stuff like that. So when you query the API, you get the exact information. You get the name, because that's what you requested.


chunk_text:
  in the front end or in other places. And it's very efficient, okay? Because we will see later where, how you can just query only or basically send only one request with many queries instead of sending dozens of queries for that. Also one of the problems, we'll see that by comparing them. So one of the problems with REST APIs is that you get everything, you query for orders, you get all the orders. Okay, you can query for the ID, but you get sometimes all the details, not really necessarily at this moment, but you get everything in the same packet. With GraphQL, you specify what exactly you want, okay? So in many cases where you are, you need compliance, HIPAA, GDPR or whatever, and any other regulation, and you are requested not to, I mean, everyone basically, but specifically these companies, much more. So they reduce drastically with GraphQL, just with the disclosure of PII or PHI, personal identifiable information, or PHI, which is the same acronym just for health information, like diagnostics and stuff like that. So when you query the API, you get the exact information. You get the name, because that's what you requested. You get also the phone, if that's what you requested, but you don't get the phone name, address, and also different information that you didn't even ask for. Another advantage here is that it's a strongly typed language, otherwise errors will be thrown. That means that, as opposed to, I mean, you could do it also in RESTful APIs, but you need to have some work done in the backend. What you need to do is just to query specifically for that type of data, whether it's an int, a string, there are also some scalar types or built-in types that are called scalar types, we will see it shortly, which is like an ID. And that's what you request. If there is an error, so you won't get anything, which is differently with RESTful APIs. Now regarding the HTTP status codes. So in RESTful APIs, usually we need to deal with, you know, the 200, and then in the body you put some other HTTP status codes, 405, 404, 401, whatever it is. Here, mainly, we don't care about errors, I mean, we always get 200, and that also makes it a little bit harder for an attacker to


chunk_text:
  You get also the phone, if that's what you requested, but you don't get the phone name, address, and also different information that you didn't even ask for. Another advantage here is that it's a strongly typed language, otherwise errors will be thrown. That means that, as opposed to, I mean, you could do it also in RESTful APIs, but you need to have some work done in the backend. What you need to do is just to query specifically for that type of data, whether it's an int, a string, there are also some scalar types or built-in types that are called scalar types, we will see it shortly, which is like an ID. And that's what you request. If there is an error, so you won't get anything, which is differently with RESTful APIs. Now regarding the HTTP status codes. So in RESTful APIs, usually we need to deal with, you know, the 200, and then in the body you put some other HTTP status codes, 405, 404, 401, whatever it is. Here, mainly, we don't care about errors, I mean, we always get 200, and that also makes it a little bit harder for an attacker to realize whether this is an error or not. Of course, if there is an error, so there will be like a short field, JSON field, called error with the message specifying what went wrong. But we don't need to get, I mean, not with any other status codes. So let's just jump about some more terminology about GraphQL. So first of all, we need something called a schema. The schema is what actually defines what we want to query. It's kind of like defining our database, how it's going to look like, what fields we're going to have, what type of queries we're going to have, okay? Because we have something called STL, which is the schema definition language, it's just defined by, I mean, actually, it was originally by Facebook, now it's by the GraphQL Foundation, which is, we'll see something similar to, has some similarities to JSON. So the schema is just like, let's say, the big picture, like the database. Now on top of that, we have something called the object. So the object is kind of like the type of operation that we want to retrieve, we want to deliver to the user. And inside each


chunk_text:
  realize whether this is an error or not. Of course, if there is an error, so there will be like a short field, JSON field, called error with the message specifying what went wrong. But we don't need to get, I mean, not with any other status codes. So let's just jump about some more terminology about GraphQL. So first of all, we need something called a schema. The schema is what actually defines what we want to query. It's kind of like defining our database, how it's going to look like, what fields we're going to have, what type of queries we're going to have, okay? Because we have something called STL, which is the schema definition language, it's just defined by, I mean, actually, it was originally by Facebook, now it's by the GraphQL Foundation, which is, we'll see something similar to, has some similarities to JSON. So the schema is just like, let's say, the big picture, like the database. Now on top of that, we have something called the object. So the object is kind of like the type of operation that we want to retrieve, we want to deliver to the user. And inside each object, we have the field. Now the field is what specifies the values for an object. So here we have a very, very easy example here. So the schema is of type user. Now we have an ID, the ID is the field of type ID, ID is a built-in type of GraphQL, but also we have the name. And the name is, as usual, a string. And all this makes the object. Now we have another object, which is the type order, orders. And here is kind of like a table if you want to assimilate this to like a SQL database. And you have also a user ID. Now a user ID here in this case is of a type user. Now user is a type that we created. So this is called basically an edge, or it's just a relationship, we can create relationships in the GraphQL. Because at the end, if you remember, what we want to do is we want to query once and get all the necessary information that we want. So in this case, we could do, we could get orders, and we could get also the user that order that. We could


chunk_text:
  object, we have the field. Now the field is what specifies the values for an object. So here we have a very, very easy example here. So the schema is of type user. Now we have an ID, the ID is the field of type ID, ID is a built-in type of GraphQL, but also we have the name. And the name is, as usual, a string. And all this makes the object. Now we have another object, which is the type order, orders. And here is kind of like a table if you want to assimilate this to like a SQL database. And you have also a user ID. Now a user ID here in this case is of a type user. Now user is a type that we created. So this is called basically an edge, or it's just a relationship, we can create relationships in the GraphQL. Because at the end, if you remember, what we want to do is we want to query once and get all the necessary information that we want. So in this case, we could do, we could get orders, and we could get also the user that order that. We could do it even more complex and create a bidirectional relationship between the orders and users, and we can query either to get the rest. But this just gets more complicated. It's one possibility, but this is just a very simple example of a GraphQL schema. Now we mentioned about the schema. We have this information that can be queried. So what does that mean? What can we do with that? So there are three main operations in GraphQL. One of them, or probably the first one, is the query. Query is just a read-only, it's just like a GET request, okay? What we do here is just read-only information about the server, about some endpoint. I want to get all the users that recently signed up to my application. I want to get all the last 10 orders that were ordered in my application. Nothing else. So if you try by a query, if you try to write data, if you try to change data, that's not going to work. And it doesn't matter if you are the developer, it's not going to work. Now another one is the mutation. Now the mutation is where things start to get a


chunk_text:
  do it even more complex and create a bidirectional relationship between the orders and users, and we can query either to get the rest. But this just gets more complicated. It's one possibility, but this is just a very simple example of a GraphQL schema. Now we mentioned about the schema. We have this information that can be queried. So what does that mean? What can we do with that? So there are three main operations in GraphQL. One of them, or probably the first one, is the query. Query is just a read-only, it's just like a GET request, okay? What we do here is just read-only information about the server, about some endpoint. I want to get all the users that recently signed up to my application. I want to get all the last 10 orders that were ordered in my application. Nothing else. So if you try by a query, if you try to write data, if you try to change data, that's not going to work. And it doesn't matter if you are the developer, it's not going to work. Now another one is the mutation. Now the mutation is where things start to get a little bit fun because mutation means that you're going to change data, okay? This is like if we compare back again to REST. So the mutation is kind of write, which means create, add, change data, or even delete data, but also at the same time we can read data from the server. And lastly, we have a third operation, which is the subscription. Now the subscription is kind of, if you are familiar with WebSockets, so it's basically kind of push notifications with the client. It could be only directional from the server to the client or vice versa, or it could be bidirectional between both. Let's say we're waiting for the user to upload a file, so once we get a file, then the server gets some sort of notification, and so then the server will send an email. I'm saying it's commonly with WebSockets, but it could work with different technologies. Now here, what we do is we first of all define the schema, so the schema says I want to query. So the query is, in this case, just a user. It means if you want to read data based on my schema, so you can


chunk_text:
  little bit fun because mutation means that you're going to change data, okay? This is like if we compare back again to REST. So the mutation is kind of write, which means create, add, change data, or even delete data, but also at the same time we can read data from the server. And lastly, we have a third operation, which is the subscription. Now the subscription is kind of, if you are familiar with WebSockets, so it's basically kind of push notifications with the client. It could be only directional from the server to the client or vice versa, or it could be bidirectional between both. Let's say we're waiting for the user to upload a file, so once we get a file, then the server gets some sort of notification, and so then the server will send an email. I'm saying it's commonly with WebSockets, but it could work with different technologies. Now here, what we do is we first of all define the schema, so the schema says I want to query. So the query is, in this case, just a user. It means if you want to read data based on my schema, so you can do it as of this example only to the user's object, okay? If I try to read, let's say, to the orders by using this example, so nobody will be able to do so because there is no permission, actually there is no indication that a user can actually read the object until we put it inside here. So GraphQL is very cool. Oh, my bad. Okay. So let's just dive a little bit deeper into this, what exactly or how we can do a query. So if we want to get a user's name, okay? So we do this syntax, which I don't know if you are a fan of Python or maybe not. If you like JavaScript, JSON, Java, you will like this as well. So we have a query here, okay, which is like the main operation in this case, and then we have what is called a top-level field, which is users. It's kind of the name of the endpoint, let's say, comparing this to RESTful, and the field that we want to get, okay? A user could have a name, it could have an age, email, ID, many other information. So in this case, we


chunk_text:
  do it as of this example only to the user's object, okay? If I try to read, let's say, to the orders by using this example, so nobody will be able to do so because there is no permission, actually there is no indication that a user can actually read the object until we put it inside here. So GraphQL is very cool. Oh, my bad. Okay. So let's just dive a little bit deeper into this, what exactly or how we can do a query. So if we want to get a user's name, okay? So we do this syntax, which I don't know if you are a fan of Python or maybe not. If you like JavaScript, JSON, Java, you will like this as well. So we have a query here, okay, which is like the main operation in this case, and then we have what is called a top-level field, which is users. It's kind of the name of the endpoint, let's say, comparing this to RESTful, and the field that we want to get, okay? A user could have a name, it could have an age, email, ID, many other information. So in this case, we want to get only the name. So this is on the left side, we write our request. On the right side, we have our response, okay? So the name here, I hope I pronounce it well, is Alain Berset, right? Swiss president. This is not by coincidence. And this is just a very simple query, okay? From here, you could just put more and more fields, okay? I mean, there's nothing from the client perspective that avoids or prevents me as a user to put more and more fields, okay? So we'll see that later. This is maybe an attack surface for GraphQL. Now what about the mutation? So the mutation, first of all, as you can see here, we need to add that to the schema. We need to say, hey, I want to use, because at the end, we can have in a complex environment like, you know, big companies, you might have different schemas, which is very powerful in GraphQL. You might have a schema for development. You might have a schema for different applications. So for this schema, I want to say, hey, yeah, here I want a mutation, okay? Let's say if we go back


chunk_text:
  want to get only the name. So this is on the left side, we write our request. On the right side, we have our response, okay? So the name here, I hope I pronounce it well, is Alain Berset, right? Swiss president. This is not by coincidence. And this is just a very simple query, okay? From here, you could just put more and more fields, okay? I mean, there's nothing from the client perspective that avoids or prevents me as a user to put more and more fields, okay? So we'll see that later. This is maybe an attack surface for GraphQL. Now what about the mutation? So the mutation, first of all, as you can see here, we need to add that to the schema. We need to say, hey, I want to use, because at the end, we can have in a complex environment like, you know, big companies, you might have different schemas, which is very powerful in GraphQL. You might have a schema for development. You might have a schema for different applications. So for this schema, I want to say, hey, yeah, here I want a mutation, okay? Let's say if we go back to the weather example. So I don't want any user to change the weather, right? Because you're going to say now in Switzerland, it's really hot. No, here it's not Dubai. So I want users to only query, to only read the data from my server. So in this case, because I need to explicitly do that and put the mutation, and it's just very simple mutation, colon mutation. And then at the bottom, we can see the mutation itself. So in this case, it looks a little bit daunty. Basically, these are arguments that we put on just like with any function there. So we have our create user function with the ID. The ID is provided by the front end. In this case, it's number one. So what we want to do here is we want to replace some fields or the name of a user. So here we have the password. The password, I just made it up, is swissinbase64. You can check it out. And with the name of Victor Rossi. I don't want to kill the president, so don't worry. And what we want to do is just specify the three fields, the ID, the


chunk_text:
  to the weather example. So I don't want any user to change the weather, right? Because you're going to say now in Switzerland, it's really hot. No, here it's not Dubai. So I want users to only query, to only read the data from my server. So in this case, because I need to explicitly do that and put the mutation, and it's just very simple mutation, colon mutation. And then at the bottom, we can see the mutation itself. So in this case, it looks a little bit daunty. Basically, these are arguments that we put on just like with any function there. So we have our create user function with the ID. The ID is provided by the front end. In this case, it's number one. So what we want to do here is we want to replace some fields or the name of a user. So here we have the password. The password, I just made it up, is swissinbase64. You can check it out. And with the name of Victor Rossi. I don't want to kill the president, so don't worry. And what we want to do is just specify the three fields, the ID, the password, and the name, okay? Just in case the ID was something completely different. So the response on the right, we just get this, which means that it was updated, okay? So usually what you request is what you see on the response, okay? So these are the two main operations that we mostly be playing with, the query for read and the mutation for changing, deleting, or adding more data. Now there's another thing, because GraphQL is a full language here that was created. There is something called directives, okay? If you come from Python and you know, like, decorators, it's something similar here. So what if you want, you know, you have your BigQuery. But by using this kind of directives, you can change actually the whole behavior or how the response is going to look like. Why? Because in some cases you want to ignore data. You want to say, hey, but give me this space just in case this is not true. So by this example, what we see is we have the list of users and we want to get the ID. We want to get the name as well. But we want to say,


chunk_text:
  password, and the name, okay? Just in case the ID was something completely different. So the response on the right, we just get this, which means that it was updated, okay? So usually what you request is what you see on the response, okay? So these are the two main operations that we mostly be playing with, the query for read and the mutation for changing, deleting, or adding more data. Now there's another thing, because GraphQL is a full language here that was created. There is something called directives, okay? If you come from Python and you know, like, decorators, it's something similar here. So what if you want, you know, you have your BigQuery. But by using this kind of directives, you can change actually the whole behavior or how the response is going to look like. Why? Because in some cases you want to ignore data. You want to say, hey, but give me this space just in case this is not true. So by this example, what we see is we have the list of users and we want to get the ID. We want to get the name as well. But we want to say, hey, if the basics only checkmark is true, okay, which can be retrieved from the front end, let's say the user wants to see how many users are in their database. So just skip the URL, okay? Skip the link from that response. Because they all want to get just the ID and the name, nothing more, okay? So there's a few directives that we can use. Skip, include. And just a few others. I think there are like five or seven, maybe, we can refer to the RFC for that. You will see later on why this is important, again, because in this case this is skip. But if you have include, so you might include the password in some queries as well. Also, we have something called fragments. I have no idea why they use this word. I don't know. Fragments for me, I don't know. I come from Android. So something completely different. So fragments is the way of reusing the same piece of code, or in this case the same field for different queries. Let's say you have a query, again, for retrieving the user, the username. You don't want to type 30 times user, right?


chunk_text:
  hey, if the basics only checkmark is true, okay, which can be retrieved from the front end, let's say the user wants to see how many users are in their database. So just skip the URL, okay? Skip the link from that response. Because they all want to get just the ID and the name, nothing more, okay? So there's a few directives that we can use. Skip, include. And just a few others. I think there are like five or seven, maybe, we can refer to the RFC for that. You will see later on why this is important, again, because in this case this is skip. But if you have include, so you might include the password in some queries as well. Also, we have something called fragments. I have no idea why they use this word. I don't know. Fragments for me, I don't know. I come from Android. So something completely different. So fragments is the way of reusing the same piece of code, or in this case the same field for different queries. Let's say you have a query, again, for retrieving the user, the username. You don't want to type 30 times user, right? Because there is some principle called DRY, or dry, don't repeat yourself. So what we do is just we put these three dots, which is called a spread operator. We define just some name. In this case, it's called same fields. And we do fragment. We say, OK, what the same fields or the common names that you want to include in every query. So we do ID, username, email. So every query that includes this spread operator dot, dot, dot, same fields. So automatically, it's going to include these fields. So in this case, again, this is just very simple. We have just three fields. But imagine if you had 12, and you were doing 15 queries. So that will really save us a lot of time. OK, and we have one more thing here. There's something called introspection, OK? What is introspection? So by introspection, we can query the server and discover, we can find out about the underlying schema types, operations. If there's a query, mutations, subscription, directives, everything, basically, OK? It's mainly for debugging purposes. I mean, I wouldn't recommend this in a production environment. But the problem is that it's enabled by default, OK, all


chunk_text:
  Because there is some principle called DRY, or dry, don't repeat yourself. So what we do is just we put these three dots, which is called a spread operator. We define just some name. In this case, it's called same fields. And we do fragment. We say, OK, what the same fields or the common names that you want to include in every query. So we do ID, username, email. So every query that includes this spread operator dot, dot, dot, same fields. So automatically, it's going to include these fields. So in this case, again, this is just very simple. We have just three fields. But imagine if you had 12, and you were doing 15 queries. So that will really save us a lot of time. OK, and we have one more thing here. There's something called introspection, OK? What is introspection? So by introspection, we can query the server and discover, we can find out about the underlying schema types, operations. If there's a query, mutations, subscription, directives, everything, basically, OK? It's mainly for debugging purposes. I mean, I wouldn't recommend this in a production environment. But the problem is that it's enabled by default, OK, all over, OK? You can use no matter what kind of implementation. And it's going to be enabled by default. The problem is even worse with some implementations, specifically in Java and Go, because you cannot even disable it. What do you do? There are some workarounds there. So just in case you are using Java and Go, make sure you disable this. But what exactly is the introspection? So introspection is defining the query. And we have our magic field here, underscore, underscore, schema. In this case, what we want to get is the whole schema, namely, the whole database. And we want to get, specifically, the names, the name field here. Now, what we get, I mean, this is just an example. But we get a full schema here on the right. We get a query. We get user, which is the name of the field. And we see, at the bottom, we see the password field, OK? So if we manipulate this a little bit more, we'll see later that we can even query and get the password for different users, of course, if there is not the proper configuration in the back end. But this is just


chunk_text:
  over, OK? You can use no matter what kind of implementation. And it's going to be enabled by default. The problem is even worse with some implementations, specifically in Java and Go, because you cannot even disable it. What do you do? There are some workarounds there. So just in case you are using Java and Go, make sure you disable this. But what exactly is the introspection? So introspection is defining the query. And we have our magic field here, underscore, underscore, schema. In this case, what we want to get is the whole schema, namely, the whole database. And we want to get, specifically, the names, the name field here. Now, what we get, I mean, this is just an example. But we get a full schema here on the right. We get a query. We get user, which is the name of the field. And we see, at the bottom, we see the password field, OK? So if we manipulate this a little bit more, we'll see later that we can even query and get the password for different users, of course, if there is not the proper configuration in the back end. But this is just their part of GraphQL. So it's OK. That was probably a lot of information. So don't stress. This is just art. Because there is something called GraphQL Voyager. This is kind of a UML, like kind of a graph mode of your whole schema types and everything. It actually draws all the relationships between the different objects as well. This is a little bit complex. That's what it looks like. But it's just to reinforce that if, for any reason, we have a database, I mean, either we are defending or attacking. So we have a way of visualize that in a much more convenient way, OK? And it's not just, you know, kind of having all text. It could be much easier. Of course, we'll need to manually look at all this and find the relationships between the dangerous objects. And this is free, actually. You can just download it from GitHub. A few endpoints, a few ways where we can find GraphQL is, of course, on the slash, on the root path, just because. But there are a few more. We can see this, of course, on the slash GraphQL. There's a slightly different version, GraphQL. We have


chunk_text:
  their part of GraphQL. So it's OK. That was probably a lot of information. So don't stress. This is just art. Because there is something called GraphQL Voyager. This is kind of a UML, like kind of a graph mode of your whole schema types and everything. It actually draws all the relationships between the different objects as well. This is a little bit complex. That's what it looks like. But it's just to reinforce that if, for any reason, we have a database, I mean, either we are defending or attacking. So we have a way of visualize that in a much more convenient way, OK? And it's not just, you know, kind of having all text. It could be much easier. Of course, we'll need to manually look at all this and find the relationships between the dangerous objects. And this is free, actually. You can just download it from GitHub. A few endpoints, a few ways where we can find GraphQL is, of course, on the slash, on the root path, just because. But there are a few more. We can see this, of course, on the slash GraphQL. There's a slightly different version, GraphQL. We have the v1, you know, version 1, version 2, version 3, slash GraphQL. We have slash API, GraphQL, slash API GraphQL, slash console, OK? I have no idea why they made it up this way, but it works. Slash playground. Yeah, that sounds very cool. Slash GQL, slash query. And it's not really for only queries, OK? This is the GraphQL endpoint. Or simply index.php and question mark GraphQL. This means that, again, if we are trying to defend ourselves, just make sure that only the right people, or from the right sources, they have access to your endpoint, OK? And for any reason you don't have any app, debugging app, IDE, or something else running in the background. So now we saw everything about GraphQL. We need to compare now GraphQL and see more advantages versus the REST API. So as we mentioned earlier, we have the ability of just query one single endpoint in GraphQL. Just name any, slash GraphQL. And by REST APIs, you probably have many of them, OK? If we just Google quickly for the weather forecast app, AccuWeather, YouTube, you probably have dozens, if not hundreds, of them. And each one with different specifications. So


chunk_text:
  the v1, you know, version 1, version 2, version 3, slash GraphQL. We have slash API, GraphQL, slash API GraphQL, slash console, OK? I have no idea why they made it up this way, but it works. Slash playground. Yeah, that sounds very cool. Slash GQL, slash query. And it's not really for only queries, OK? This is the GraphQL endpoint. Or simply index.php and question mark GraphQL. This means that, again, if we are trying to defend ourselves, just make sure that only the right people, or from the right sources, they have access to your endpoint, OK? And for any reason you don't have any app, debugging app, IDE, or something else running in the background. So now we saw everything about GraphQL. We need to compare now GraphQL and see more advantages versus the REST API. So as we mentioned earlier, we have the ability of just query one single endpoint in GraphQL. Just name any, slash GraphQL. And by REST APIs, you probably have many of them, OK? If we just Google quickly for the weather forecast app, AccuWeather, YouTube, you probably have dozens, if not hundreds, of them. And each one with different specifications. So this makes it a little bit harder because, first of all, maintaining all of this. You forgot this is internal, this is not. Who has access to this one? How many fields if you're required to have authorization? If it's just SSO, if not. So this makes things a little bit more complicated. And if we talk about, let's say, GraphQL, so it's just much simpler. I mean, for sure we can have more than one endpoint, but usually it's enough with one. Second of all, as we mentioned earlier, with GraphQL we use only POST methods. There is a way actually to use GET methods, but it's not recommended because that will lead to some CSRF stacks. But technically you can, but you are using usually POST methods. But by using REST, again, you need to deal with DELETE, PUT, PATCH, HEAD, GET, OPTIONS. Just too many HTTP methods there. Another advantage of GraphQL is it's called over- or under-fetching, which means either you get more information that you requested or you get less information. So you don't get the exact information in RESTful APIs. So by GraphQL, you get exactly what you need. You ask for the user,


chunk_text:
  this makes it a little bit harder because, first of all, maintaining all of this. You forgot this is internal, this is not. Who has access to this one? How many fields if you're required to have authorization? If it's just SSO, if not. So this makes things a little bit more complicated. And if we talk about, let's say, GraphQL, so it's just much simpler. I mean, for sure we can have more than one endpoint, but usually it's enough with one. Second of all, as we mentioned earlier, with GraphQL we use only POST methods. There is a way actually to use GET methods, but it's not recommended because that will lead to some CSRF stacks. But technically you can, but you are using usually POST methods. But by using REST, again, you need to deal with DELETE, PUT, PATCH, HEAD, GET, OPTIONS. Just too many HTTP methods there. Another advantage of GraphQL is it's called over- or under-fetching, which means either you get more information that you requested or you get less information. So you don't get the exact information in RESTful APIs. So by GraphQL, you get exactly what you need. You ask for the user, you get the user. You ask for the name only, so you get only the name. You don't get the full description or the user with all the details as well. And the frontend, yeah, it's on a crown here. So the frontend must match exactly of the changes that you do with the backend. And in GraphQL, probably you have your PM, you have your customers. They want to do some changes specifically to the API. They don't want to be called ORDERS. They want to be called ALL. So what do you do now? You need to change everything in the frontend. You need to change everything in the backend as well. It's just time-consuming. In GraphQL, it's just going to be the same endpoint, GraphQL. And only you change specifically in the backend, or maybe just in the frontend, about what your customer, your PM, wanted to change. If it's just a few fields, okay, just remove them, add them, and just play around with that. But it's much more cost-effective also by using GraphQL. Another advantage here is that we mentioned that it's strongly typed. You cannot mess around with different types. If the user put


chunk_text:
  you get the user. You ask for the name only, so you get only the name. You don't get the full description or the user with all the details as well. And the frontend, yeah, it's on a crown here. So the frontend must match exactly of the changes that you do with the backend. And in GraphQL, probably you have your PM, you have your customers. They want to do some changes specifically to the API. They don't want to be called ORDERS. They want to be called ALL. So what do you do now? You need to change everything in the frontend. You need to change everything in the backend as well. It's just time-consuming. In GraphQL, it's just going to be the same endpoint, GraphQL. And only you change specifically in the backend, or maybe just in the frontend, about what your customer, your PM, wanted to change. If it's just a few fields, okay, just remove them, add them, and just play around with that. But it's much more cost-effective also by using GraphQL. Another advantage here is that we mentioned that it's strongly typed. You cannot mess around with different types. If the user put number one as a string, where it should be an integer, or if the user, you know, because that could also lead to some attacks. If on the phone number, the user put the email, not because they made a mistake, but because they wanted to enumerate or try to attack your server, so that could be directly rejected by the server by GraphQL, because you asked specifically for a type. And the rest, yeah, you could do that. You could still, of course, in the backend, you know, compare, you know, PHP, Java, whatever, JavaScript. You could use the three equal signs to compare both the type and the value, but, you know, you would need to do that for every single value. And here, it's just made by, you know, the schema. It says you get only that type, and that's all. Besides that, in GraphQL, you also have the ability to create your own type, okay? You create your user type like we did before. You create kind of like your class with all your fields, with all your different values that you request, so it's much more granular than just REST API. But there's one thing,


chunk_text:
  number one as a string, where it should be an integer, or if the user, you know, because that could also lead to some attacks. If on the phone number, the user put the email, not because they made a mistake, but because they wanted to enumerate or try to attack your server, so that could be directly rejected by the server by GraphQL, because you asked specifically for a type. And the rest, yeah, you could do that. You could still, of course, in the backend, you know, compare, you know, PHP, Java, whatever, JavaScript. You could use the three equal signs to compare both the type and the value, but, you know, you would need to do that for every single value. And here, it's just made by, you know, the schema. It says you get only that type, and that's all. Besides that, in GraphQL, you also have the ability to create your own type, okay? You create your user type like we did before. You create kind of like your class with all your fields, with all your different values that you request, so it's much more granular than just REST API. But there's one thing, at least here, that REST APIs are still good. I mean, we need to still consider if we really do some complex and very, very, you know, nested queries, nested APIs with GraphQL, it's a little bit different here. Because with, you know, imagine like you nest, nest, nest more, that could lead to adding null of service or simply crash the GraphQL endpoint if you don't do it properly. Or even if you do it and some attacker plays around with your API. And in just the common, the traditional RESTful API, that will be just easier. And also, by caching responses, so RESTful API, it will be better because, you know, the API will always return the same response. But in GraphQL, it's enough that you change one field on the same endpoint, the same operation, and you're going to get a completely different response. So it's still possible, but it's just a little bit more complicated to cache your responses. So it means that if the response, let's say, last 10 users, that a couple of users are trying to query to your server, so it's going to take a little bit more because the server will


chunk_text:
  at least here, that REST APIs are still good. I mean, we need to still consider if we really do some complex and very, very, you know, nested queries, nested APIs with GraphQL, it's a little bit different here. Because with, you know, imagine like you nest, nest, nest more, that could lead to adding null of service or simply crash the GraphQL endpoint if you don't do it properly. Or even if you do it and some attacker plays around with your API. And in just the common, the traditional RESTful API, that will be just easier. And also, by caching responses, so RESTful API, it will be better because, you know, the API will always return the same response. But in GraphQL, it's enough that you change one field on the same endpoint, the same operation, and you're going to get a completely different response. So it's still possible, but it's just a little bit more complicated to cache your responses. So it means that if the response, let's say, last 10 users, that a couple of users are trying to query to your server, so it's going to take a little bit more because the server will need to, again, process that and retrieve back to the user. So only for this reason, I would recommend to, or I mean, at the end, you could work with both. You could combine GraphQL and APIs. So specifically for that, for those complex queries, so you can use better RESTful APIs. So this is a very interesting example here, just to illustrate what GraphQL can do here. So at the top, you can see the RESTful API. You have your api.com slash burger. You get everything. Okay. You get the bun, you get the bread, you get the patty, you get everything you get. There is no way to specify, I want just this and that field, or in this case, pieces. I mean, of course you can filter by in the backend, you could apply some limits, but it's harder. I mean, it's not by design. And here in GraphQL, just specify what you want. You said bun, patty, bun, lettuce, lettuce at the bottom. So this is what you get. Okay. As you can see, there's no cheese here. Okay. And this is a GraphQL versus REST API. Now let's see some usage statistics. Who uses that?


chunk_text:
  need to, again, process that and retrieve back to the user. So only for this reason, I would recommend to, or I mean, at the end, you could work with both. You could combine GraphQL and APIs. So specifically for that, for those complex queries, so you can use better RESTful APIs. So this is a very interesting example here, just to illustrate what GraphQL can do here. So at the top, you can see the RESTful API. You have your api.com slash burger. You get everything. Okay. You get the bun, you get the bread, you get the patty, you get everything you get. There is no way to specify, I want just this and that field, or in this case, pieces. I mean, of course you can filter by in the backend, you could apply some limits, but it's harder. I mean, it's not by design. And here in GraphQL, just specify what you want. You said bun, patty, bun, lettuce, lettuce at the bottom. So this is what you get. Okay. As you can see, there's no cheese here. Okay. And this is a GraphQL versus REST API. Now let's see some usage statistics. Who uses that? Why do you do that? So GraphQL is everywhere. Okay. Sometimes we don't realize about that, but it's actually there. So this graph was taken from a wonder graph. It just illustrates the popularity of GraphQL. This is the amount, this is until actually two years ago, but it reflects here the amount of there's most 4 million of repositories, 4 millions that were created just with a word or with some tool regarding GraphQL. Okay. And again, this is just GitHub. We could even have more data about GitLab, Bitback and other technologies or platforms. But as you can see also, there are big technology, big companies, just like Facebook, GitHub, Pinterest, Coursera, Shopify. And there's just many, many, many companies that adopted already this technology. And they're even contributing to the advance of this great technology here. And again, this is just an example taken from graphql.org. There are just millions, probably other websites that are using this technology as well. And the reason, you know, because it's just much more flexible as we talked earlier. Now let's go to the fun parts. Let's see a real exploit scenario of how we can take advantage of GraphQL. I


chunk_text:
  Why do you do that? So GraphQL is everywhere. Okay. Sometimes we don't realize about that, but it's actually there. So this graph was taken from a wonder graph. It just illustrates the popularity of GraphQL. This is the amount, this is until actually two years ago, but it reflects here the amount of there's most 4 million of repositories, 4 millions that were created just with a word or with some tool regarding GraphQL. Okay. And again, this is just GitHub. We could even have more data about GitLab, Bitback and other technologies or platforms. But as you can see also, there are big technology, big companies, just like Facebook, GitHub, Pinterest, Coursera, Shopify. And there's just many, many, many companies that adopted already this technology. And they're even contributing to the advance of this great technology here. And again, this is just an example taken from graphql.org. There are just millions, probably other websites that are using this technology as well. And the reason, you know, because it's just much more flexible as we talked earlier. Now let's go to the fun parts. Let's see a real exploit scenario of how we can take advantage of GraphQL. I mean, it's great, but everything comes with their part on the side. So not a long time ago, there was an attack in Shopify. Shopify, I guess you are familiar with. It's a website, it's an e-commerce that you can mount, you can use and sell your stuff. You can kind of use their service for that. What's more fun about this is that Shopify, they actually, as we mentioned, they contribute and they develop tools for GraphQL. So they had a vulnerability in their website and the way of exploiting it was to first enumerate, to first discover what's going on, analyzing the endpoints, analyzing the fields that can be sent to Shopify. Of course, it's, you know, it takes, it sounds maybe easy, but it takes a lot of effort here. And once that, the endpoint that was actually lacking authorization, it was found, then the email, basically what happened is that you could send a mutation to an endpoint and there was no authorization. It means you could update any email just by changing your email. Okay. You just found the endpoint changing your customer's email. So then you just change that. You simply change the endpoint


chunk_text:
  mean, it's great, but everything comes with their part on the side. So not a long time ago, there was an attack in Shopify. Shopify, I guess you are familiar with. It's a website, it's an e-commerce that you can mount, you can use and sell your stuff. You can kind of use their service for that. What's more fun about this is that Shopify, they actually, as we mentioned, they contribute and they develop tools for GraphQL. So they had a vulnerability in their website and the way of exploiting it was to first enumerate, to first discover what's going on, analyzing the endpoints, analyzing the fields that can be sent to Shopify. Of course, it's, you know, it takes, it sounds maybe easy, but it takes a lot of effort here. And once that, the endpoint that was actually lacking authorization, it was found, then the email, basically what happened is that you could send a mutation to an endpoint and there was no authorization. It means you could update any email just by changing your email. Okay. You just found the endpoint changing your customer's email. So then you just change that. You simply change the endpoint or the host where your victim is, and you could change their, every single customer's email as well. So after manipulating the mutation, we can just simply send that, you know, with any proxy, Zap, Burp, whatever, Fiddler, just manually with the URL. And that was enough just to exploit that. So let's see this in a more technical way. We have here the mutation that was in, um, in, in Shopify. So email sender configuration update, nothing really that tells us a lot, but here we can see that the, uh, the ID that was sent is basically the email. Okay. We could figure it out that there is no really, uh, authorization of this from this, uh, on this side. We don't send any token. We don't send any, uh, API key or any password here, uh, to the endpoint. So that could be one way of identifying that there is a vulnerability here. Then we could just play around with the different fields. We could add more fields. We could just, you know, uh, delete or add some arguments there. And this is just a screenshot of, um, how it looks like in the, in, uh, this


chunk_text:
  or the host where your victim is, and you could change their, every single customer's email as well. So after manipulating the mutation, we can just simply send that, you know, with any proxy, Zap, Burp, whatever, Fiddler, just manually with the URL. And that was enough just to exploit that. So let's see this in a more technical way. We have here the mutation that was in, um, in, in Shopify. So email sender configuration update, nothing really that tells us a lot, but here we can see that the, uh, the ID that was sent is basically the email. Okay. We could figure it out that there is no really, uh, authorization of this from this, uh, on this side. We don't send any token. We don't send any, uh, API key or any password here, uh, to the endpoint. So that could be one way of identifying that there is a vulnerability here. Then we could just play around with the different fields. We could add more fields. We could just, you know, uh, delete or add some arguments there. And this is just a screenshot of, um, how it looks like in the, in, uh, this is in Postman. And lastly, this is how we can change the customer's email here. Again, now this is just one example. There could be many, many other examples that we can see shortly. So, um, there are many vectors, many ways of attacking or many ways that we can defend ourselves from attackers here. So one of them is injections, just like with any other technology. So there was an alternate attack in Nuri, uh, I think Nuri, uh, there was a, a blockchain bank or something, a financial institution. And they were, uh, um, they, they had an injection through WebSockets there that affected their service. Uh, but also there was an SQL injection. Why not SQL injection just by, you know, they're putting the, um, the apostrophe and doing the query. You could just do whatever you want, job the table, add users, manipulate the database. And that was in HackerOne, HackerOne just, you know, it's a, a platform used by hackers. So hack the hacker. Uh, there was also a denial of service, denial of service, uh, by, uh, recursively putting more and more fields. You could just nest more and more, uh, levels, you know,


chunk_text:
  is in Postman. And lastly, this is how we can change the customer's email here. Again, now this is just one example. There could be many, many other examples that we can see shortly. So, um, there are many vectors, many ways of attacking or many ways that we can defend ourselves from attackers here. So one of them is injections, just like with any other technology. So there was an alternate attack in Nuri, uh, I think Nuri, uh, there was a, a blockchain bank or something, a financial institution. And they were, uh, um, they, they had an injection through WebSockets there that affected their service. Uh, but also there was an SQL injection. Why not SQL injection just by, you know, they're putting the, um, the apostrophe and doing the query. You could just do whatever you want, job the table, add users, manipulate the database. And that was in HackerOne, HackerOne just, you know, it's a, a platform used by hackers. So hack the hacker. Uh, there was also a denial of service, denial of service, uh, by, uh, recursively putting more and more fields. You could just nest more and more, uh, levels, you know, eight, 10, 13 levels of, um, uh, sub, uh, sub, uh, uh, objects there and putting more and more fields. Uh, we could just do the same with fragments, just putting the dot, dot, dot, and naming the same function 30 times with different names. Okay. So basically we are kind of doing 30 different operations, but at the end it's just the same with different names and the same thing with a directive. So that happened in Magento that I mentioned before, which is the directive is the, uh, include or some, um, uh, component that changes the behavior of the response. So if it's a skip and you do include, so you can include some other information that wasn't unintended. Uh, there was, um, SRF also is another attack vector. I didn't hear about any attack in that attack surface, but it doesn't mean it didn't happen. You know, if you don't hear it means it didn't reach out to the news yet. Okay. Uh, we have also CSRF or a CSWSH, which is the same thing as cross, uh, uh, WebSocket hijacking. And, uh, it just basically happens if you use, uh, GraphQL over get method because


chunk_text:
  eight, 10, 13 levels of, um, uh, sub, uh, sub, uh, uh, objects there and putting more and more fields. Uh, we could just do the same with fragments, just putting the dot, dot, dot, and naming the same function 30 times with different names. Okay. So basically we are kind of doing 30 different operations, but at the end it's just the same with different names and the same thing with a directive. So that happened in Magento that I mentioned before, which is the directive is the, uh, include or some, um, uh, component that changes the behavior of the response. So if it's a skip and you do include, so you can include some other information that wasn't unintended. Uh, there was, um, SRF also is another attack vector. I didn't hear about any attack in that attack surface, but it doesn't mean it didn't happen. You know, if you don't hear it means it didn't reach out to the news yet. Okay. Uh, we have also CSRF or a CSWSH, which is the same thing as cross, uh, uh, WebSocket hijacking. And, uh, it just basically happens if you use, uh, GraphQL over get method because there's no authentication there. So we should be careful about that as well. Uh, authorization, authentication bypass. Okay. This is also another issue in Git, um, in GraphQL. It happened in GitLab. It happened in Shopify again, uh, also privilege escalation simply by changing the ID, changing their, uh, role from regular user to admin. Also, uh, hacker one was, um, vulnerable, uh, other attack vectors include less, uh, or low vulnerabilities, which is enumerating the field suggestions. Usually, um, GraphQL tells you something like, you know, if you, uh, if you were wrong in writing a field, uh, do you, you know, like just Google, they suggest you another field similar, uh, with, with a similar name. And they tell you, uh, the response says, did you, uh, um, refer to maybe this title? Did you refer to that? So basically you are enumerating this schema, you're enumerating the GraphQL endpoint. And lastly, when we are mishandling errors, as usual, when we send errors, we don't need to send the whole stack trace or the whole database, uh, error. We need to just send exactly what we, um, need. So these are the attack vectors. Now how we can


chunk_text:
  there's no authentication there. So we should be careful about that as well. Uh, authorization, authentication bypass. Okay. This is also another issue in Git, um, in GraphQL. It happened in GitLab. It happened in Shopify again, uh, also privilege escalation simply by changing the ID, changing their, uh, role from regular user to admin. Also, uh, hacker one was, um, vulnerable, uh, other attack vectors include less, uh, or low vulnerabilities, which is enumerating the field suggestions. Usually, um, GraphQL tells you something like, you know, if you, uh, if you were wrong in writing a field, uh, do you, you know, like just Google, they suggest you another field similar, uh, with, with a similar name. And they tell you, uh, the response says, did you, uh, um, refer to maybe this title? Did you refer to that? So basically you are enumerating this schema, you're enumerating the GraphQL endpoint. And lastly, when we are mishandling errors, as usual, when we send errors, we don't need to send the whole stack trace or the whole database, uh, error. We need to just send exactly what we, um, need. So these are the attack vectors. Now how we can remediate those, how we can defend ourselves from these, um, attacks, we're using a great technology. So first of all, yeah, disable introspection. Of course, if you're doing, again, if you're using Java and Go, so you need to find a work But, uh, don't expose this, at least not in a production environment. Don't expose your schema. Don't let users query your, uh, schema or types or any other, I'm sorry, any other piece of information about your GraphQL endpoint. Uh, also some developers, they like to preload some queries in JavaScript libraries. They do it because of performance. So try not to do that because that gives a hint to attackers. Uh, also use only POST requests. And again, because by using GET requests, you could be automatically, um, vulnerable to CSRF. Uh, next set the query def limits and timeouts. To avoid denial of service, just, you have like a, a way of limiting the fields and limiting the time of how every query should last. If the query lasts for more than three, four seconds, that's too much. Just reject that. Uh, also calculate the field's height. If you have only eight fields, that's all you're


chunk_text:
  remediate those, how we can defend ourselves from these, um, attacks, we're using a great technology. So first of all, yeah, disable introspection. Of course, if you're doing, again, if you're using Java and Go, so you need to find a work But, uh, don't expose this, at least not in a production environment. Don't expose your schema. Don't let users query your, uh, schema or types or any other, I'm sorry, any other piece of information about your GraphQL endpoint. Uh, also some developers, they like to preload some queries in JavaScript libraries. They do it because of performance. So try not to do that because that gives a hint to attackers. Uh, also use only POST requests. And again, because by using GET requests, you could be automatically, um, vulnerable to CSRF. Uh, next set the query def limits and timeouts. To avoid denial of service, just, you have like a, a way of limiting the fields and limiting the time of how every query should last. If the query lasts for more than three, four seconds, that's too much. Just reject that. Uh, also calculate the field's height. If you have only eight fields, that's all you're going to get. If an attacker puts, uh, 11, so that's enough to reject the, the, the request. Uh, return generic errors, just, you know, kind of something went wrong. But if you, uh, you have, uh, an error in your SQL syntax in line 92. And lastly, as a general rule is sanitize and validate all the fields. Every single field needs to be validated because if you request again, a phone number, don't expect the user to send all the numbers. Okay. Uh, even that you have your front end, uh, you know, JavaScript is, uh, actually even HTML is only letting users to put, um, all the numbers. Don't expect that because that could be easily changed by proxies, by many, many other tools. And if you expect that and a user sends something else, you could be in trouble, but not only that, every single piece of data that you ask for the user, every input, every search, every field that has a text box and, or even any piece of data that, you know, input hidden, uh, that the user can send back to the, um, to the server. So that needs to be validated


chunk_text:
  going to get. If an attacker puts, uh, 11, so that's enough to reject the, the, the request. Uh, return generic errors, just, you know, kind of something went wrong. But if you, uh, you have, uh, an error in your SQL syntax in line 92. And lastly, as a general rule is sanitize and validate all the fields. Every single field needs to be validated because if you request again, a phone number, don't expect the user to send all the numbers. Okay. Uh, even that you have your front end, uh, you know, JavaScript is, uh, actually even HTML is only letting users to put, um, all the numbers. Don't expect that because that could be easily changed by proxies, by many, many other tools. And if you expect that and a user sends something else, you could be in trouble, but not only that, every single piece of data that you ask for the user, every input, every search, every field that has a text box and, or even any piece of data that, you know, input hidden, uh, that the user can send back to the, um, to the server. So that needs to be validated and sanitized. Sanitize mean, you know, uh, to simply remove the special characters, those characters that you're not expecting, like an apostrophe may be expected if you are in America for, you know, McDonald's for a name, but that's not expected for an email. Okay. So if you have invalid or Unicode, um, uh, letters or characters in emails, that's not also expected. So for that specific, try to sanitize. And there are just many best practices around the internet for that as well. Okay. So that was all. You are awesome. And thank you so much. Hope you enjoyed. Okay. Okay. You know, the drill, any questions? My site is based on movement, so I should don't move. I don't see it. Yes. You talked about hiding field names by not having a suggestion. Shouldn't it make more sense to have authorization on which field can, which fields can be carried by which user? Yeah, yeah. You're right. I mean, you should, every operation, let's say the type user, it should be always, uh, uh, checked against authorization and authentication. That's first of all. I mean, you have a schema. You have a schema that, uh, only specifies, let's


chunk_text:
  and sanitized. Sanitize mean, you know, uh, to simply remove the special characters, those characters that you're not expecting, like an apostrophe may be expected if you are in America for, you know, McDonald's for a name, but that's not expected for an email. Okay. So if you have invalid or Unicode, um, uh, letters or characters in emails, that's not also expected. So for that specific, try to sanitize. And there are just many best practices around the internet for that as well. Okay. So that was all. You are awesome. And thank you so much. Hope you enjoyed. Okay. Okay. You know, the drill, any questions? My site is based on movement, so I should don't move. I don't see it. Yes. You talked about hiding field names by not having a suggestion. Shouldn't it make more sense to have authorization on which field can, which fields can be carried by which user? Yeah, yeah. You're right. I mean, you should, every operation, let's say the type user, it should be always, uh, uh, checked against authorization and authentication. That's first of all. I mean, you have a schema. You have a schema that, uh, only specifies, let's say the ID name, username age, and that will be only, uh, stick to, let's say the user that the ID matches to, let's say the cookie. That will be really the, the, the idea. Of course you could have another schema for admins that they can query, let's say support, technical support. They can actually query and even mutate the password with the right, uh, permissions as well. Yeah. Yes. Hi. Uh, thanks so much for, for your talk. Very interesting. Um, when you do an enumeration of the, the, the service GraphQL, do you have access to the schema or you need to use some brute force technique? Um, by default, yeah, by default, the, the introspection is enabled. Yes. But even if you don't do it, I mean, there are other ways of enumerating. You could simply, um, just, you know, throw your own field name and if you don't get an error, so it means that the field exists. So it doesn't, I mean, yeah, it's not implied that the introspection is disabled. You could still have some other ways, but that's still enough to, you know, I mean like again, you could have rate limiting,


chunk_text:
  say the ID name, username age, and that will be only, uh, stick to, let's say the user that the ID matches to, let's say the cookie. That will be really the, the, the idea. Of course you could have another schema for admins that they can query, let's say support, technical support. They can actually query and even mutate the password with the right, uh, permissions as well. Yeah. Yes. Hi. Uh, thanks so much for, for your talk. Very interesting. Um, when you do an enumeration of the, the, the service GraphQL, do you have access to the schema or you need to use some brute force technique? Um, by default, yeah, by default, the, the introspection is enabled. Yes. But even if you don't do it, I mean, there are other ways of enumerating. You could simply, um, just, you know, throw your own field name and if you don't get an error, so it means that the field exists. So it doesn't, I mean, yeah, it's not implied that the introspection is disabled. You could still have some other ways, but that's still enough to, you know, I mean like again, you could have rate limiting, you could have a WAF, which also help mitigate those attacks as well. Yeah. Great. Final question. Okay. So suppose I have an app that I want to pentest that uses GraphQL, like are there any tools that are available to like fuzz the APIs that use GraphQL or anything? You mean tools to defend? No, to attack. Tools to attack. There are a lot. You could use simply, uh, if you know burp, burp suite. Yeah. an extension called InQL, I think, so it's just available in the pro provisional version. You have a graph wolf, uh, I think I show it, uh, graph wolf to enumerate the endpoints just automatically. You have the WFuzz. You could use also SecList for check, you know, discover, uh, different fields, endpoints are just huge, uh, word lists there. Um, besides that, uh, I think that would be enough. That would just, yeah. Okay. Thank you, Leo. Thank you so much.


chunk_text:
  you could have a WAF, which also help mitigate those attacks as well. Yeah. Great. Final question. Okay. So suppose I have an app that I want to pentest that uses GraphQL, like are there any tools that are available to like fuzz the APIs that use GraphQL or anything? You mean tools to defend? No, to attack. Tools to attack. There are a lot. You could use simply, uh, if you know burp, burp suite. Yeah. an extension called InQL, I think, so it's just available in the pro provisional version. You have a graph wolf, uh, I think I show it, uh, graph wolf to enumerate the endpoints just automatically. You have the WFuzz. You could use also SecList for check, you know, discover, uh, different fields, endpoints are just huge, uh, word lists there. Um, besides that, uh, I think that would be enough. That would just, yeah. Okay. Thank you, Leo. Thank you so much.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=bRyghlND7kQ", "title": "Open Se\u0301same! Example Of Modern Electronic Lockpicking by Thomas Bygodt", "description": "", "channel_url": "https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA", "duration": 2582, "channel": "scrt.insomnihack", "uploader": "scrt.insomnihack", "upload_date": "20240223" } This text was transcribed using whisper model: large-v2 Thank you very much, thanks to be here, for the little anecdote, it's my first talk in my life, so just enjoy it, please. We will talk about some modern electronic lockpicking, it's quite pretentious, I agree with you, but you will see, it will be really fun. We will talk about some physical design vulnerability, of course I have confirmed it with another device, and after we have a big part about Bluetooth Low Energy, because it's my favorite color of money, and you will see why. So of course, let's go, I'm a senior security editor for OneCyberDefense since 2017, I work in Rennes, in France, I like IoT and especially hardware and reverse things since 2-3 years ago. I'm an ex-CTF player, sorry I'm quite old now, I can't bypass a full night, I'm quite old. So before to discuss about some smart locks, let's go back several thousand years, little history. According to the historians, trace of the first lock, as we know, dates back to the ancient Egypt, the design is really easy, just only three pins, the material is easy to break, of course, just wood, but this design, it's currently already used, but of course with more pins, more secure material, like steel and other things. In 1951, there was a great lock controversy, a famous lock manufacturer from United States, Mr. Hobbs, picked Chubb's lock, which is an unbreakable lock for 50, 60 years, during the great exposition at London, so of course, at this point, it was, he breaks the unbreakable lock, and the same year, he breaks the Braham lock, which is another unbreakable lock. Of course, in the last 30 years, many technologies are evolving, for example, we have Bluetooth low energy in 2009, of course, we have ZigBee, we have Wi-Fi, and everything. So all of it creates a lot of hacking possibilities for us, so yes, there are already some hacking stories about smart locks in DEF CON or Black Hat conference, but I think we can find some other conferences like Insomniac too. So, the physical vulnerability, obviously a lock must protect the access from unwanted people. You can always use


chunk_text:
  we know, dates back to the ancient Egypt, the design is really easy, just only three pins, the material is easy to break, of course, just wood, but this design, it's currently already used, but of course with more pins, more secure material, like steel and other things. In 1951, there was a great lock controversy, a famous lock manufacturer from United States, Mr. Hobbs, picked Chubb's lock, which is an unbreakable lock for 50, 60 years, during the great exposition at London, so of course, at this point, it was, he breaks the unbreakable lock, and the same year, he breaks the Braham lock, which is another unbreakable lock. Of course, in the last 30 years, many technologies are evolving, for example, we have Bluetooth low energy in 2009, of course, we have ZigBee, we have Wi-Fi, and everything. So all of it creates a lot of hacking possibilities for us, so yes, there are already some hacking stories about smart locks in DEF CON or Black Hat conference, but I think we can find some other conferences like Insomniac too. So, the physical vulnerability, obviously a lock must protect the access from unwanted people. You can always use a brute force attack to break the door and enter to the house or to the room, but we will not do that in this talk, we want to be like James Bond, maybe we can have some tools just open the door for us, yes, let's see. So of course, when we talk about physical, we have to find a physical entree to attack the hardware. And once you are in the hardware, you have to understand how the lock works, how many boards inside the lock, how boards communicate with them, both together. And obviously, if we can get the hardware, we will try to reverse the framework if we can get it, to find a password, hidden functionality, backdoor, vulnerability like a buffer overflow or everything. So this is the lock, so sorry, but I will not disclose any name of company during this talk due to some respect. You will see why before. Not for the lock manufacturer, because for the lock manufacturer, sorry, but I have no pity for them, but for the BLE creator, it was really great, so just for them, I will not disclose any name on this talk. So we have


chunk_text:
  a brute force attack to break the door and enter to the house or to the room, but we will not do that in this talk, we want to be like James Bond, maybe we can have some tools just open the door for us, yes, let's see. So of course, when we talk about physical, we have to find a physical entree to attack the hardware. And once you are in the hardware, you have to understand how the lock works, how many boards inside the lock, how boards communicate with them, both together. And obviously, if we can get the hardware, we will try to reverse the framework if we can get it, to find a password, hidden functionality, backdoor, vulnerability like a buffer overflow or everything. So this is the lock, so sorry, but I will not disclose any name of company during this talk due to some respect. You will see why before. Not for the lock manufacturer, because for the lock manufacturer, sorry, but I have no pity for them, but for the BLE creator, it was really great, so just for them, I will not disclose any name on this talk. So we have this lock, which is quite simple. We have three parts, two big parts, one outside of the house. The outside has the main board, has the battery, of course, outside. If the power is off, you can change the battery easily. And inside the cylinder, inside the door, you can find a motor board in this talk. So of course, let's dig in a little on this board. So first, the main board has a Nordic processor ARM Cortex M4 32-bit. We can find some other motor controller on this board. Of course, we have a connector, because of course, the main board has to communicate with the motor board, so we have to communicate with them, and that shows a wire connection. And we can find some pins on this board, so I have already soldered them, because first, I don't think that just my work will bring me here, just in front of you. So on the motor board connector, we can find the old pin about debug, so we will use them a little bit later. Same thing for the motor board, we have a microcontroller, of course, it's an STM8. We have another motor controller. We


chunk_text:
  this lock, which is quite simple. We have three parts, two big parts, one outside of the house. The outside has the main board, has the battery, of course, outside. If the power is off, you can change the battery easily. And inside the cylinder, inside the door, you can find a motor board in this talk. So of course, let's dig in a little on this board. So first, the main board has a Nordic processor ARM Cortex M4 32-bit. We can find some other motor controller on this board. Of course, we have a connector, because of course, the main board has to communicate with the motor board, so we have to communicate with them, and that shows a wire connection. And we can find some pins on this board, so I have already soldered them, because first, I don't think that just my work will bring me here, just in front of you. So on the motor board connector, we can find the old pin about debug, so we will use them a little bit later. Same thing for the motor board, we have a microcontroller, of course, it's an STM8. We have another motor controller. We have the motherboard connector, of course. And some other debug port, we can find a UART connector. So the thing is that the TX is working, RX doesn't work. The debug connector is used, but I can't find anything on this pin. For this board, they have to do the right thing. So of course, we have to find a physical entry point. So when you are in front of the lock, once you remove the stainless protector, you have a little pellet. You can really easily remove it, just drill it, and you remove it, and we have access to the motor connector, really easy. So that's it. We can have access to the connector between the main board and the motor board. Of course, they forget to remove read protection on the processor of the main board. So we can connect to it with OpenOCD, and we can extract the firmware, and we can put the firmware that we retrieve. We can use nrefident, which is an open source program, to identify the Nordic SDK version. Obviously, you can connect GDB. It's more easy to use GDB to extract some part of memory, like RAM, like pin configuration,


chunk_text:
  have the motherboard connector, of course. And some other debug port, we can find a UART connector. So the thing is that the TX is working, RX doesn't work. The debug connector is used, but I can't find anything on this pin. For this board, they have to do the right thing. So of course, we have to find a physical entry point. So when you are in front of the lock, once you remove the stainless protector, you have a little pellet. You can really easily remove it, just drill it, and you remove it, and we have access to the motor connector, really easy. So that's it. We can have access to the connector between the main board and the motor board. Of course, they forget to remove read protection on the processor of the main board. So we can connect to it with OpenOCD, and we can extract the firmware, and we can put the firmware that we retrieve. We can use nrefident, which is an open source program, to identify the Nordic SDK version. Obviously, you can connect GDB. It's more easy to use GDB to extract some part of memory, like RAM, like pin configuration, and everything. So first, they don't hide any information about the hardware. So thanks for that. It's easy for us to retrieve datasheets on the web. Electronic board is not difficult, it's really easy to access to it. Debug port is not deactivated. And weak protection of the processor is not set. OK, thank you very much. So of course, I said that we have the motor connection access. So let's use a logical analyzer to see what's going on on the wire. I don't connect the red wire, because red wire is only a power. So well, we run our logical analyzer. We have this signal, let's dig it. We have three parts. The first in blue is probably just a wake-up signal to the motor board. We have two other big parts, probably the request and the response from the motor board. So let's zoom on the first one. OK, here we can see that we don't have many symbols. We can see that we have only two symbols on the signal. So let's do an exception. OK, we have a 0, we have a 1. Because for me, I don't like play with it. Personally, I prefer


chunk_text:
  and everything. So first, they don't hide any information about the hardware. So thanks for that. It's easy for us to retrieve datasheets on the web. Electronic board is not difficult, it's really easy to access to it. Debug port is not deactivated. And weak protection of the processor is not set. OK, thank you very much. So of course, I said that we have the motor connection access. So let's use a logical analyzer to see what's going on on the wire. I don't connect the red wire, because red wire is only a power. So well, we run our logical analyzer. We have this signal, let's dig it. We have three parts. The first in blue is probably just a wake-up signal to the motor board. We have two other big parts, probably the request and the response from the motor board. So let's zoom on the first one. OK, here we can see that we don't have many symbols. We can see that we have only two symbols on the signal. So let's do an exception. OK, we have a 0, we have a 1. Because for me, I don't like play with it. Personally, I prefer string, so I prefer hexadecimal. It will be easier for me if I can treat the data with hexadecimal string. And once you have the language, the hexadecimal conversion, to analyze the communication, I take sample at different action, of course, during the initialization. So initialization is when you power on the lock. So you remove the battery, and you put the battery back. It's the initialization. And the opening is, of course, when you enter the white code or you use your phone, the lock is open. So this is the function. I take two different controllers, C1, C2, and obviously, at two different times, the dash 1, dash 2. So of course, we can say that we don't have any time issue, any time token. So we can probably do a replay attack of that, obviously. So let's go deeper. We have some few bytes we never change. So OK, the first one is maybe some headers. The other is some maybe separator. We have a byte we change only during the function. So for initialization, we have, in ping part, we have three. And during opening, we have one. So this is the common byte. And of


chunk_text:
  string, so I prefer hexadecimal. It will be easier for me if I can treat the data with hexadecimal string. And once you have the language, the hexadecimal conversion, to analyze the communication, I take sample at different action, of course, during the initialization. So initialization is when you power on the lock. So you remove the battery, and you put the battery back. It's the initialization. And the opening is, of course, when you enter the white code or you use your phone, the lock is open. So this is the function. I take two different controllers, C1, C2, and obviously, at two different times, the dash 1, dash 2. So of course, we can say that we don't have any time issue, any time token. So we can probably do a replay attack of that, obviously. So let's go deeper. We have some few bytes we never change. So OK, the first one is maybe some headers. The other is some maybe separator. We have a byte we change only during the function. So for initialization, we have, in ping part, we have three. And during opening, we have one. So this is the common byte. And of course, we have a big part in middle, in orange, which is maybe, I know, is that the ID of the motherboard, but it's maybe some un-ID. And the first, it's just a checksum. If you don't trust me, you can check it just with the command, because you can see on the first time that you have 87 with three commands. And on the opening function, you have 95, and you have 1 in command. So it's maybe a checksum. So of course, communication is unencrypted, is not signed. They don't have any protection against triple attack. And of course, yes, they use, the same use, a sensitive data without authentication, because when you open, when you put the battery back, so we, but this is not an authentication. Yes, you tried, OK. OK, so this is the easy part. Let's go deeper on the frameworks. First of all, before I attack the framework, I have to extract, obviously, all the part of the processor. With the datasheet, you have, we have all address that we want, so we can extract the pin configuration, we can extract the RAM memory, and everything. Of course, the first thing you do


chunk_text:
  course, we have a big part in middle, in orange, which is maybe, I know, is that the ID of the motherboard, but it's maybe some un-ID. And the first, it's just a checksum. If you don't trust me, you can check it just with the command, because you can see on the first time that you have 87 with three commands. And on the opening function, you have 95, and you have 1 in command. So it's maybe a checksum. So of course, communication is unencrypted, is not signed. They don't have any protection against triple attack. And of course, yes, they use, the same use, a sensitive data without authentication, because when you open, when you put the battery back, so we, but this is not an authentication. Yes, you tried, OK. OK, so this is the easy part. Let's go deeper on the frameworks. First of all, before I attack the framework, I have to extract, obviously, all the part of the processor. With the datasheet, you have, we have all address that we want, so we can extract the pin configuration, we can extract the RAM memory, and everything. Of course, the first thing you do when you have a binary, is just do a string. It's a basic. We have some string on the result. Some of them are, can be interesting, dynamic password, yes, why not. We have some string which looks like some identifier, or some token, maybe. And obviously, we have to some file path, and github command, github URL, of course. Thanks for that. Thank you, developers. First of all, I will focus on the EF40 and the KV40, because for me, it's quite strange. They came really a lot, so it's maybe some magic number. So I look for EasyFlash. EasyFlash, it's an open source project to manage memory on bare metal firmware. So let's go on the source code of EasyFlash, thanks to github. We have some, obviously, we have some structure, we have some function, so let's go find this function and structure inside our firmware. Okay, so we have the createEnvBlob, once we have the function to manage the blob, you can follow all the call stack to find the memory which is modified, read, written, and we find a memory like that. So we find the KV40, we find some probably CRC32, we find the lens,


chunk_text:
  when you have a binary, is just do a string. It's a basic. We have some string on the result. Some of them are, can be interesting, dynamic password, yes, why not. We have some string which looks like some identifier, or some token, maybe. And obviously, we have to some file path, and github command, github URL, of course. Thanks for that. Thank you, developers. First of all, I will focus on the EF40 and the KV40, because for me, it's quite strange. They came really a lot, so it's maybe some magic number. So I look for EasyFlash. EasyFlash, it's an open source project to manage memory on bare metal firmware. So let's go on the source code of EasyFlash, thanks to github. We have some, obviously, we have some structure, we have some function, so let's go find this function and structure inside our firmware. Okay, so we have the createEnvBlob, once we have the function to manage the blob, you can follow all the call stack to find the memory which is modified, read, written, and we find a memory like that. So we find the KV40, we find some probably CRC32, we find the lens, name lens, and everything, and we can find the name here. It's lots of settings. Okay, well, I love Gidra, but I'm really bad to create some plugin on Gidra, so I prefer to take my pattern script. So I write a pattern script to search for me. All of the data which follows the structure of the EasyFlash project. I found 60 structures, and some of them are really interesting, like log setting, of course, and hard ID. Yes, because my first log is obviously, I have put a very strong password on it, which is 123456. Very strong. Don't use it, please. So the password is really in plain text. We use it, we can use it, we can find it really easily. So I don't speak about it, but we have a master password which never change. You can reset the log, but the master password doesn't change. It's like a joker. If you forget your code, you can reset the log. Maybe you can think that the master password is random. Well, no. Why use random when you can just increment it? It's more easier to increment than do random. So you can read some of


chunk_text:
  name lens, and everything, and we can find the name here. It's lots of settings. Okay, well, I love Gidra, but I'm really bad to create some plugin on Gidra, so I prefer to take my pattern script. So I write a pattern script to search for me. All of the data which follows the structure of the EasyFlash project. I found 60 structures, and some of them are really interesting, like log setting, of course, and hard ID. Yes, because my first log is obviously, I have put a very strong password on it, which is 123456. Very strong. Don't use it, please. So the password is really in plain text. We use it, we can use it, we can find it really easily. So I don't speak about it, but we have a master password which never change. You can reset the log, but the master password doesn't change. It's like a joker. If you forget your code, you can reset the log. Maybe you can think that the master password is random. Well, no. Why use random when you can just increment it? It's more easier to increment than do random. So you can read some of them, and if you know the time when your target bot is locked, you probably can guess which is the brute-forcing part of the master password. So obviously, passwords are not hashed, master passwords are not random. Okay, thanks for that, too. So let's go deeper into the framework. Of course, here we have found the password. We have to find the command implementation. So to do that, I use the ID, because as I have extracted the RAM memory, I can search in the RAM memory for the ID. Obviously, the ID must come from somewhere. So we have just followed the call stack and the external reference to the memory address. The first of all is obviously the write. So the ID comes from a FICR register, so it's a full random 8-byte identifier for each Nordic processor. It's set in factory, you can't modify it, and it's fully random. Well, okay, this is quite good. We have only one place that the data is read. Okay, let's go. So we have our function, launch motor command. Obviously, I have renamed it. And we have three positions in the code where we call this function. You have it


chunk_text:
  them, and if you know the time when your target bot is locked, you probably can guess which is the brute-forcing part of the master password. So obviously, passwords are not hashed, master passwords are not random. Okay, thanks for that, too. So let's go deeper into the framework. Of course, here we have found the password. We have to find the command implementation. So to do that, I use the ID, because as I have extracted the RAM memory, I can search in the RAM memory for the ID. Obviously, the ID must come from somewhere. So we have just followed the call stack and the external reference to the memory address. The first of all is obviously the write. So the ID comes from a FICR register, so it's a full random 8-byte identifier for each Nordic processor. It's set in factory, you can't modify it, and it's fully random. Well, okay, this is quite good. We have only one place that the data is read. Okay, let's go. So we have our function, launch motor command. Obviously, I have renamed it. And we have three positions in the code where we call this function. You have it here. So obviously, we have the open command, we have the initialization command, and we have the last one, but I can't say anything on it, because I don't have success to trigger it. Maybe I have tried. But maybe some one-shot command to initialize the motor board with the identifier of the main board when the lock is in factory. So obviously, here we have firmware, we have the communication language, we have everything that we know, everything that we have to do to create an attack card. But I don't want to create an attack card, because even if I like Raspberry Pi or Arduino, I want to save the planet, and I just want to reuse my main board tested card. So I take the firmware, and I put my code inside the firmware. Why I do that? Because you can say, well, you have the debug port, you can flash all the firmware. Well, I don't reverse everything in that firmware, because reversing a bare metal firmware, it's quite complicated for me. And it's quite time-consuming a lot. So I don't want to waste too much time on the initialization reverse. So like that, I can


chunk_text:
  here. So obviously, we have the open command, we have the initialization command, and we have the last one, but I can't say anything on it, because I don't have success to trigger it. Maybe I have tried. But maybe some one-shot command to initialize the motor board with the identifier of the main board when the lock is in factory. So obviously, here we have firmware, we have the communication language, we have everything that we know, everything that we have to do to create an attack card. But I don't want to create an attack card, because even if I like Raspberry Pi or Arduino, I want to save the planet, and I just want to reuse my main board tested card. So I take the firmware, and I put my code inside the firmware. Why I do that? Because you can say, well, you have the debug port, you can flash all the firmware. Well, I don't reverse everything in that firmware, because reversing a bare metal firmware, it's quite complicated for me. And it's quite time-consuming a lot. So I don't want to waste too much time on the initialization reverse. So like that, I can use all the initialization of the firmware of the constructor. Okay, perfect. So I put just my command, my code, inside the firmware. Because I have the size to do it, because the firmware doesn't take the full memory of the processor. So of course, you can find here some of my attack code. So we have to intercept the ID. So we transform, we switch our card like, obviously, a logical analyzer. And once we have the identifier, we are just to send the open command to the lock. And obviously, I have built a door lock, I have built a little door, to show my work. Ah, demo effect. So let's go. So we have, this attack can be done on the real door, of course. It's absolutely not mandatory to be in laboratory. So we pull back the battery. We wait for the initialization command. Here I have read the identifier, and here I have opened the door, in less than 8 seconds. So yes, of course, you can hear it, because I disabled the sound, but we can hear the little door, the little motor inside the door. So in 8 seconds, I can open your


chunk_text:
  use all the initialization of the firmware of the constructor. Okay, perfect. So I put just my command, my code, inside the firmware. Because I have the size to do it, because the firmware doesn't take the full memory of the processor. So of course, you can find here some of my attack code. So we have to intercept the ID. So we transform, we switch our card like, obviously, a logical analyzer. And once we have the identifier, we are just to send the open command to the lock. And obviously, I have built a door lock, I have built a little door, to show my work. Ah, demo effect. So let's go. So we have, this attack can be done on the real door, of course. It's absolutely not mandatory to be in laboratory. So we pull back the battery. We wait for the initialization command. Here I have read the identifier, and here I have opened the door, in less than 8 seconds. So yes, of course, you can hear it, because I disabled the sound, but we can hear the little door, the little motor inside the door. So in 8 seconds, I can open your door. Okay, that is for one lock. But this design is used in many other types of lock. So I take another one lock of the manufacturer, obviously not the same lock. Okay, so I took this one, with a fingerprinting captor, and NFC possibility to open the door. The connector is easily accessible, it's just turned by 90 degrees, but you can use it, you can always use it. We can find, obviously, debug port. So let's go analyze the communication between the motor and the mainboard. So we are only one wire to data. And here, they don't implement any specific constructor communication, that is the protocol, they just use UART classical, but they use in one wire. So they switch the RX and TX, the receive and transmission, on the wire, between request and answer. Okay, so it's best for me, because I don't have to write, to return a specific plugin to extract the data. Okay, we find the same structure, command, ID, okay, perfect. Let's go with opening, because of course this is for initialization, so just when you pull back the battery. And for opening, this is the same, same for that, we have


chunk_text:
  door. Okay, that is for one lock. But this design is used in many other types of lock. So I take another one lock of the manufacturer, obviously not the same lock. Okay, so I took this one, with a fingerprinting captor, and NFC possibility to open the door. The connector is easily accessible, it's just turned by 90 degrees, but you can use it, you can always use it. We can find, obviously, debug port. So let's go analyze the communication between the motor and the mainboard. So we are only one wire to data. And here, they don't implement any specific constructor communication, that is the protocol, they just use UART classical, but they use in one wire. So they switch the RX and TX, the receive and transmission, on the wire, between request and answer. Okay, so it's best for me, because I don't have to write, to return a specific plugin to extract the data. Okay, we find the same structure, command, ID, okay, perfect. Let's go with opening, because of course this is for initialization, so just when you pull back the battery. And for opening, this is the same, same for that, we have the same design. So I have to check, of course, the weight protection. Well, they set it. Ah, bad luck. But no, thanks to include security in Cortex-M0, there is a vulnerability, which affects all of Nordic NRF-51, because yes, the board doesn't have the same processor of the first lock. And thanks to that, we can read register, and we can set register. But obviously, in the few steps of the initialization, a processor just read one address of the memory. So we have just to put the address of what we want to read, and just step one, and obviously we have the result in the register. This is for the vulnerability. So thanks to that, you can extract the firmware, you can dump the firmware in 20 minutes. For 2,056 kilobytes, so it's quite fast. So I will not, I have reversed the firmware too, but yes, I just want to confirm our command I implemented. So of course, we have the same problem. Communication is unencrypted, no protection against replay attack, and they use sensitive data without authentication. Thanks. For it, I don't have made a specific attack board. The most easy part is just to


chunk_text:
  the same design. So I have to check, of course, the weight protection. Well, they set it. Ah, bad luck. But no, thanks to include security in Cortex-M0, there is a vulnerability, which affects all of Nordic NRF-51, because yes, the board doesn't have the same processor of the first lock. And thanks to that, we can read register, and we can set register. But obviously, in the few steps of the initialization, a processor just read one address of the memory. So we have just to put the address of what we want to read, and just step one, and obviously we have the result in the register. This is for the vulnerability. So thanks to that, you can extract the firmware, you can dump the firmware in 20 minutes. For 2,056 kilobytes, so it's quite fast. So I will not, I have reversed the firmware too, but yes, I just want to confirm our command I implemented. So of course, we have the same problem. Communication is unencrypted, no protection against replay attack, and they use sensitive data without authentication. Thanks. For it, I don't have made a specific attack board. The most easy part is just to hard-code the identifier inside the firmware. And you just put all commands, like initialization, open, everything. You hard-code the fact that all commands are just opening functions. So you just have to put your attack card, and it opens the door. Of course, there are NFCs, so I must, I have to check it. First of all, without any administrator, any NFC card can open the door. Thanks for that. Obviously, the documentation of the lock says you have to set an administrator. But I'm sure that we can find some lock without administrator in the wild. And with administrator, maybe it's better? Absolutely not, because in the memory, there are just the UID of NFC tag inside the memory, so of course, they don't use a secure, if NFC can be secured, behavior. Thanks for that. Please, don't use UID to authenticate people with NFC card, please. Okay, so here I have done the full physical vulnerability. We will talk about Bluetooth Low Energy. So for the first lock, they use SDK provided by a specialized company in the Internet of Things world. They have cloud integration, it's a major actor in IoT world. They don't use any encryption


chunk_text:
  hard-code the identifier inside the firmware. And you just put all commands, like initialization, open, everything. You hard-code the fact that all commands are just opening functions. So you just have to put your attack card, and it opens the door. Of course, there are NFCs, so I must, I have to check it. First of all, without any administrator, any NFC card can open the door. Thanks for that. Obviously, the documentation of the lock says you have to set an administrator. But I'm sure that we can find some lock without administrator in the wild. And with administrator, maybe it's better? Absolutely not, because in the memory, there are just the UID of NFC tag inside the memory, so of course, they don't use a secure, if NFC can be secured, behavior. Thanks for that. Please, don't use UID to authenticate people with NFC card, please. Okay, so here I have done the full physical vulnerability. We will talk about Bluetooth Low Energy. So for the first lock, they use SDK provided by a specialized company in the Internet of Things world. They have cloud integration, it's a major actor in IoT world. They don't use any encryption protocol, protocol encryption, it's a full plaintext Bluetooth Low Energy communication. But they have implemented some encryption on the software side. They just use Bluetooth like a whole wire. Okay, so we can find maybe ZIV, and we have a packet, but only for 20 bytes length. So we have a counter to say the packet is the fourth packet, the fifth packet, okay. Let's go do some 3D hooking with Objection open source program. Well, you hook on the IES function, so as you can find the key, you can find the initialization for the vector, and everything. Okay, you can print the stack trace too, it's easier for us to get the call trace, to do reverse. So of course, I have done two trace, and I compare the key. The first key are always the same, always. But the other change, okay, so maybe they have to exchange some random token or something to change the key, okay, why not? But the most interesting part is that the key is always the same, okay, keep that in mind. Obviously, even if I like Frida, when developers put a log inside their code, and give us the possibility


chunk_text:
  protocol, protocol encryption, it's a full plaintext Bluetooth Low Energy communication. But they have implemented some encryption on the software side. They just use Bluetooth like a whole wire. Okay, so we can find maybe ZIV, and we have a packet, but only for 20 bytes length. So we have a counter to say the packet is the fourth packet, the fifth packet, okay. Let's go do some 3D hooking with Objection open source program. Well, you hook on the IES function, so as you can find the key, you can find the initialization for the vector, and everything. Okay, you can print the stack trace too, it's easier for us to get the call trace, to do reverse. So of course, I have done two trace, and I compare the key. The first key are always the same, always. But the other change, okay, so maybe they have to exchange some random token or something to change the key, okay, why not? But the most interesting part is that the key is always the same, okay, keep that in mind. Obviously, even if I like Frida, when developers put a log inside their code, and give us the possibility to put the switcher, the log back, yes, just use it. So there are two functions which is called CircuitKey4 and CircuitKey5. So obviously, it's quite, it's not really easy to read, so just focus on the green and the orange packet boxes, it's much easier like that. So the first key is just MD5 checksum of the login key, and the second key is MD5 checksum from the concatenation of the login key plus S1, okay? Thanks to Logcat, we have the size of the login key, we have the S1, and here, we have the first critical problem, the login key is only six additional characters, thanks for that, because obviously, six characters in the decimal is really easy to crack. So we will just focus on the first packet, so the first and the second packet between the mobile and the device. So on the device, so the first request doesn't have any specific strings, but the device responds to us with many information. First, we have the hotkey, we have a device ID, and we have the S1. So we don't have to brute force the S1. The second request, it's more interesting from the mobile


chunk_text:
  to put the switcher, the log back, yes, just use it. So there are two functions which is called CircuitKey4 and CircuitKey5. So obviously, it's quite, it's not really easy to read, so just focus on the green and the orange packet boxes, it's much easier like that. So the first key is just MD5 checksum of the login key, and the second key is MD5 checksum from the concatenation of the login key plus S1, okay? Thanks to Logcat, we have the size of the login key, we have the S1, and here, we have the first critical problem, the login key is only six additional characters, thanks for that, because obviously, six characters in the decimal is really easy to crack. So we will just focus on the first packet, so the first and the second packet between the mobile and the device. So on the device, so the first request doesn't have any specific strings, but the device responds to us with many information. First, we have the hotkey, we have a device ID, and we have the S1. So we don't have to brute force the S1. The second request, it's more interesting from the mobile part, on the device, it just maybe, okay, you just pad. So on the mobile part, we have the device ID, we have the login key, and here, we have the UUID. Well, but I don't speak for UUID, okay, just let's find where is the UUID. Each Bluetooth device has some advertising communication, which broadcasts every time, once it's powered on, it broadcasts some data. In the data of the lock, we can find the UUID, which is encrypted by AES, CBC, with a key. The key is given to us with the advertisement data, okay, so just do that. But where comes from the AES key? It just comes from here, and same for them, it's the AES key, the alpha of the AES key, is the UUID encrypted by login key and UUID. But you know UUID, you just have to guess the login key. You know the plaintext, you know the ciphertext, you know a part of the key, you just have to brute force six hexadecimal characters. Thanks. No, so obviously, they don't use any Bluetooth low-energy encryption, they can be used. So we, but no, even if you use MD5 checksum, your AES key


chunk_text:
  part, on the device, it just maybe, okay, you just pad. So on the mobile part, we have the device ID, we have the login key, and here, we have the UUID. Well, but I don't speak for UUID, okay, just let's find where is the UUID. Each Bluetooth device has some advertising communication, which broadcasts every time, once it's powered on, it broadcasts some data. In the data of the lock, we can find the UUID, which is encrypted by AES, CBC, with a key. The key is given to us with the advertisement data, okay, so just do that. But where comes from the AES key? It just comes from here, and same for them, it's the AES key, the alpha of the AES key, is the UUID encrypted by login key and UUID. But you know UUID, you just have to guess the login key. You know the plaintext, you know the ciphertext, you know a part of the key, you just have to brute force six hexadecimal characters. Thanks. No, so obviously, they don't use any Bluetooth low-energy encryption, they can be used. So we, but no, even if you use MD5 checksum, your AES key is not 60-byte length, the charset of the key is not large at all, and obviously don't use sensible data to generate public data in a secure way. So here, maybe I can do something with that. So we have a SDK, obviously the mandatory part is that an inbound device should not be able to communicate with the device. If you bond your phone, only your phone on your account, on the SDK cloud integration, can communicate with the lock of the device. But we have two vulnerabilities, we have a six-character string, we have the same string used to create sensible, accessible data, okay, so we can have a decryption of all communication on the fly or offline, as you want, and obviously we can interact with a device without any user or cloud interaction. Thank you for that. So of course, I have done some responsible declosure, but just look, just go to two steps to weaponize it. So the first is optimize the brute-force algorithm, thanks Ashcat. Find some Bluetooth parameter, analyze an open uncheck, or whatever, or the request that you want implemented in your client, and obviously, open Sesame. I will not release the


chunk_text:
  is not 60-byte length, the charset of the key is not large at all, and obviously don't use sensible data to generate public data in a secure way. So here, maybe I can do something with that. So we have a SDK, obviously the mandatory part is that an inbound device should not be able to communicate with the device. If you bond your phone, only your phone on your account, on the SDK cloud integration, can communicate with the lock of the device. But we have two vulnerabilities, we have a six-character string, we have the same string used to create sensible, accessible data, okay, so we can have a decryption of all communication on the fly or offline, as you want, and obviously we can interact with a device without any user or cloud interaction. Thank you for that. So of course, I have done some responsible declosure, but just look, just go to two steps to weaponize it. So the first is optimize the brute-force algorithm, thanks Ashcat. Find some Bluetooth parameter, analyze an open uncheck, or whatever, or the request that you want implemented in your client, and obviously, open Sesame. I will not release the script, but I will show you. So, I'm quite late, so I will advance a lot, so we have to pair our phone with the lock, so thanks to that, okay, we can open, and when we open the door with the application, we have a log inside the application, okay? So let's go the attack. So here, I have found the login key, I brute-force the login key, of course, I have found it, and once you found it, you have just to, you have everything, every string, because lock sent to them, so you, sent to you, so you can use it to open the door. So in less than 20 seconds, I can open the lock, only with that. And obviously, no log at all inside the application. I have confirmed the vulnerability with another device, so it's just a little drawer, it's the same vulnerability, and in a few seconds, I can open it. So the vulnerability doesn't affect only one device, it affects all devices with the Bluetooth SDK. Okay, so I know my talk is long, sorry about that. So of course, I have tried to do a responsible disclosure for the physical vulnerability,


chunk_text:
  script, but I will show you. So, I'm quite late, so I will advance a lot, so we have to pair our phone with the lock, so thanks to that, okay, we can open, and when we open the door with the application, we have a log inside the application, okay? So let's go the attack. So here, I have found the login key, I brute-force the login key, of course, I have found it, and once you found it, you have just to, you have everything, every string, because lock sent to them, so you, sent to you, so you can use it to open the door. So in less than 20 seconds, I can open the lock, only with that. And obviously, no log at all inside the application. I have confirmed the vulnerability with another device, so it's just a little drawer, it's the same vulnerability, and in a few seconds, I can open it. So the vulnerability doesn't affect only one device, it affects all devices with the Bluetooth SDK. Okay, so I know my talk is long, sorry about that. So of course, I have tried to do a responsible disclosure for the physical vulnerability, so they don't really take me in consideration, you will say, yes, of course, it's a Chinese company, yes, okay, okay. So I came back in September about Bluetooth vulnerability, and they said to me, go to the police station, to, okay, I just want to say that you have a vulnerability, I don't want the police station, okay. The most fun part on the manufacturer is that you have, they have a blog, obviously, where they talk about security of connected lock, so things, but we can do some Bluetooth attack, we can do replay attack, and physical attack, it's possible, on your lock. Thanks for that. I quite finish. So for the BLE SDK creator, I have failed to found the above multi-platform on the SACMail, the customer support doesn't trust me in September, but thanks for me and for them, it was much better in February, so you can have, you have the timeline on the screen. So there was really great, I want to say thank you to them, because they authorized me to give the talk, despite of the critical vulnerability, and they paid me the reward, and I have, I have the maximum reward


chunk_text:
  so they don't really take me in consideration, you will say, yes, of course, it's a Chinese company, yes, okay, okay. So I came back in September about Bluetooth vulnerability, and they said to me, go to the police station, to, okay, I just want to say that you have a vulnerability, I don't want the police station, okay. The most fun part on the manufacturer is that you have, they have a blog, obviously, where they talk about security of connected lock, so things, but we can do some Bluetooth attack, we can do replay attack, and physical attack, it's possible, on your lock. Thanks for that. I quite finish. So for the BLE SDK creator, I have failed to found the above multi-platform on the SACMail, the customer support doesn't trust me in September, but thanks for me and for them, it was much better in February, so you can have, you have the timeline on the screen. So there was really great, I want to say thank you to them, because they authorized me to give the talk, despite of the critical vulnerability, and they paid me the reward, and I have, I have the maximum reward of the Ubuntu platform, so really thanks, it was a very great exchange. So for manufacturer, of course, please use Backpack Ties, listen security researcher, and for you, so we, I don't have any solution, perfect solution, if you want to choose some smart object, well, do your own research, do it for reputation, or anything, I don't have a perfect solution for that, sorry. Thanks for your listening. Okay, we have a little bit more than three minutes for questions. Any raised hands? Thank you for the talk. On the first part, how much time do you need to drill the hole, and do all the necessary steps to plug your attack card, or plug your stuff to opponent? To drill the, the planet? Sorry? To drill the planet? Yes, to connect your, well, it wasn't an attack card. In two minutes, I think, on the door. So two minutes plus the time, like, was, like, I don't know, five, ten seconds? And three, three minutes, you're in, okay, awesome. Of course, the pallet, you have to replace it, so you just buy the same lock on your e-commerce website, and just put glue and replace your, a new


chunk_text:
  of the Ubuntu platform, so really thanks, it was a very great exchange. So for manufacturer, of course, please use Backpack Ties, listen security researcher, and for you, so we, I don't have any solution, perfect solution, if you want to choose some smart object, well, do your own research, do it for reputation, or anything, I don't have a perfect solution for that, sorry. Thanks for your listening. Okay, we have a little bit more than three minutes for questions. Any raised hands? Thank you for the talk. On the first part, how much time do you need to drill the hole, and do all the necessary steps to plug your attack card, or plug your stuff to opponent? To drill the, the planet? Sorry? To drill the planet? Yes, to connect your, well, it wasn't an attack card. In two minutes, I think, on the door. So two minutes plus the time, like, was, like, I don't know, five, ten seconds? And three, three minutes, you're in, okay, awesome. Of course, the pallet, you have to replace it, so you just buy the same lock on your e-commerce website, and just put glue and replace your, a new pallet, of course, because if you make a hole, you can see the hole. No more questions? Okay, thank you, Thomas, very good presentation. Thank you. Thank you all. A round of applause for you.


chunk_text:
  pallet, of course, because if you make a hole, you can see the hole. No more questions? Okay, thank you, Thomas, very good presentation. Thank you. Thank you all. A round of applause for you.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=yg_ix5NEErk", "title": "A COMPLETE Offlane Guide for Beginners and Advanced Dota 2 Players - Early Game", "description": "Immortal Dota 2 coach breaks down a complete Offlane guide on how to dominate the early game phase as an Offlaner using a specially created Offlane cheat sheet with a 5-point grading scale. \n\nGet CRACKED on Offlane today!\n\n-------------------------------------------------------------------------------\nBALLOONDOTA COACHING RATES \n-------------------------------------------------------------------------------\n(Short term coaching)\n50$ for 1 hour\n120$ for 3 hours (25% discount, 40$/hr)\n\n(Long term coaching) \n(recommended for cheaper rates)\n350$ for 10 hours (30% discount, 35$/hr)\n650$ for 20 hours (35% discount, 32.5$/hr)\n850$ for 30 hours (45% discount, 28$/hr)\n\n-------------------------------------------------------------------------------\nDOTA COACHING BY BALLOONDOTA\n-------------------------------------------------------------------------------\nFiverr coaching link: https://www.fiverr.com/yongy146/help-you-improve-in-dota-2-with-7400-mmr-coaching\nDiscord: BaLLooN#5243 \nDiscord Server: https://discord.com/invite/w4PWyXDV4n\nPaypal: siahcheonyisiahcheonyi@gmail.com\nPatreon: patreon.com/BalloonDota\n-------------------------------------------------------------------------------\n\n00:00 - Introduction\n00:58 - Won Lane Subsection\n6:54 - Dota2ProTracker\n7:12 - Lost Lane Subsection\n10:43 - Conclusion\n\n-------------------------------------------------------------------------------\n\nDocument link: https://docs.google.com/document/d/12Vj_aOIJopll2lKLuLjx05wiaICaRwhu/edit?usp=sharing&ouid=106671014916816226730&rtpof=true&sd=true\n\n-------------------------------------------------------------------------------\n\nDota2ProTracker\nhttps://dota2protracker.com/\n\n-------------------------------------------------------------------------------\n\n\u266a Memories (Prod. by Lukrembo)\nLink : https://www.youtube.com/watch?v=jbnMSWrLuMs\n\n\u266a Cloud (Prod. by Lukrembo)\nLink : https://www.youtube.com/watch?v=v1XgHCIdDc8\n\nMusic: High Tide by Hotham is licensed under a Creative Commons License.\nhttps://creativecommons.org/licenses/...\nStream: https://linktr.ee/hothammusic\nFree Download: https://hypeddit.com/hotham/hightide\nSupport by RFM - NCM: https://bit.ly/3U7XiHI\n\nMusic: Don't Go - tubebackr & Scandinavianz \u200bis licensed under a Creative Commons License.\nhttps://creativecommons.org/licenses/...\nhttps://soundcloud.com/tubebackr%C3%A2%C2%80%C2%8B | https://links.fanlink.to/tubebackr\nSupport by RFM - NCM: https://bit.ly/2xGHypM\n\nMusic from #Uppbeat (free for Creators!):\nhttps://uppbeat.io/t/fass/furious\nLicense code: JNBUADJFRTJIFFRA", "channel_url": "https://www.youtube.com/channel/UCYldE7tGQHjNwIVHQ7bDNoA", "duration": 745, "channel": "BalloonDota", "uploader": "BalloonDota", "upload_date": "20240528" } This text was transcribed using whisper model: medium Hey guys, so what I have here is the Dota Phases step-by-step process assessment sheet for the offlane early game phase. For those of you that have watched my carry DPSP cheat sheet, this will be similar to that. The only difference is we are now looking at the offlane okay and specifically the early game phase. I also have the complete DPSP sheet for the offlane role but the laning phase and the mid game phase will be exactly the same as the carry cheat sheet so you can get it from that video instead. Alright, the biggest difference will be the early game phase, how it's played. If you like my content, please consider clicking on the like, comment and subscribe button. Also, if you're interested in getting coached by me, do check the description box down below. So let's dive right into it. For this cheat sheet, I've separated it into two subsections. The first subsection will be where you win the lane okay so we are trying to push the advantage in this phase and the second subsection will be where you lose the lane so you're gonna recover and play like a post one carry.


chunk_text:
  Hey guys, so what I have here is the Dota Phases step-by-step process assessment sheet for the offlane early game phase. For those of you that have watched my carry DPSP cheat sheet, this will be similar to that. The only difference is we are now looking at the offlane okay and specifically the early game phase. I also have the complete DPSP sheet for the offlane role but the laning phase and the mid game phase will be exactly the same as the carry cheat sheet so you can get it from that video instead. Alright, the biggest difference will be the early game phase, how it's played. If you like my content, please consider clicking on the like, comment and subscribe button. Also, if you're interested in getting coached by me, do check the description box down below. So let's dive right into it. For this cheat sheet, I've separated it into two subsections. The first subsection will be where you win the lane okay so we are trying to push the advantage in this phase and the second subsection will be where you lose the lane so you're gonna recover and play like a post one carry. Alright, so the offlanes early game phase will normally begin when you manage to break the enemy's safe lane tower. So this will happen around the 8, 9 or 10 minutes. Of course, if you are more proficient in playing the lane, you can dominate the lane earlier so typically 6, 7, 8 minutes is possible as well. Some even going as early as 5 minutes but the moment you break the safe lane tower, we're gonna go towards the focus on what you want to do in the early game phase. Okay, so when you manage to break the tower, the first thing you want to look at is you want to ensure the enemy's safe lane is always pushed out, right? You want to make the enemy safe laner get kicked out of lane because if they go into lane, they're gonna have to go across you. Okay, so the prioritization of pushing out the safe lane is so important because it applies pressure and when you apply pressure, the enemies have to keep coming to retaliate against what you're doing in the lane. So what tends to go wrong is people most of the time will get


chunk_text:
  Alright, so the offlanes early game phase will normally begin when you manage to break the enemy's safe lane tower. So this will happen around the 8, 9 or 10 minutes. Of course, if you are more proficient in playing the lane, you can dominate the lane earlier so typically 6, 7, 8 minutes is possible as well. Some even going as early as 5 minutes but the moment you break the safe lane tower, we're gonna go towards the focus on what you want to do in the early game phase. Okay, so when you manage to break the tower, the first thing you want to look at is you want to ensure the enemy's safe lane is always pushed out, right? You want to make the enemy safe laner get kicked out of lane because if they go into lane, they're gonna have to go across you. Okay, so the prioritization of pushing out the safe lane is so important because it applies pressure and when you apply pressure, the enemies have to keep coming to retaliate against what you're doing in the lane. So what tends to go wrong is people most of the time will get interrupted so they start looking at fights that are not purposeful and they start wasting a lot of time around the map. So make sure you are always pushing the lane, right? And you only leave to the other lane if there's like a clean-up fight or a tp into an important fight. Otherwise, do not leave the enemy's safe lane area. Okay, next we go into the warding around the enemy safe and enemy jungle. One of the most easily overlooked thing that cores do not do in low MMR, I would highly suggest that you do it because a lot of times if you are always reliant on your supports to plant the wards and stuff, if the supports are not around or they have not bought the wards, now you have essentially given up control of what could have been if you just warded it up yourself. So once you manage to break the tower, first thing that goes to mind, buy your wards. Every time you open the shop, you buy tps, you buy clarities, right? You buy your observers and buy however many sentries you buy as your observers. So you're gonna have to protect


chunk_text:
  interrupted so they start looking at fights that are not purposeful and they start wasting a lot of time around the map. So make sure you are always pushing the lane, right? And you only leave to the other lane if there's like a clean-up fight or a tp into an important fight. Otherwise, do not leave the enemy's safe lane area. Okay, next we go into the warding around the enemy safe and enemy jungle. One of the most easily overlooked thing that cores do not do in low MMR, I would highly suggest that you do it because a lot of times if you are always reliant on your supports to plant the wards and stuff, if the supports are not around or they have not bought the wards, now you have essentially given up control of what could have been if you just warded it up yourself. So once you manage to break the tower, first thing that goes to mind, buy your wards. Every time you open the shop, you buy tps, you buy clarities, right? You buy your observers and buy however many sentries you buy as your observers. So you're gonna have to protect your wards. So if you have vision, you're going to ensure your safety around the enemy safe lane and you can keep farming around the area. Okay, now we move to invading the enemy jungle. This goes hand in hand with the earlier point. So you want to ward the enemy jungle. In order to do so, you can invade the enemy jungle as well. Okay, so you want to walk into the enemy jungle to establish control and you want to hunt the enemies with or without your teammates. Of course, you have to factor in how much information you have on the map. So map awareness needs to come into play. Okay, make sure you are always going into the enemy jungle, taking away the safe lane carry's farm from the enemy side, kicking them out of the entire area and establishing your control there. Okay, ensure you don't die as well. Now we go into the fourth point. So all of this, you will notice that it happens after you break the tower and after you invade the jungle. Establish your control around their jungle, ensure the safe lane, enemy safe lane is always pushed in. So


chunk_text:
  your wards. So if you have vision, you're going to ensure your safety around the enemy safe lane and you can keep farming around the area. Okay, now we move to invading the enemy jungle. This goes hand in hand with the earlier point. So you want to ward the enemy jungle. In order to do so, you can invade the enemy jungle as well. Okay, so you want to walk into the enemy jungle to establish control and you want to hunt the enemies with or without your teammates. Of course, you have to factor in how much information you have on the map. So map awareness needs to come into play. Okay, make sure you are always going into the enemy jungle, taking away the safe lane carry's farm from the enemy side, kicking them out of the entire area and establishing your control there. Okay, ensure you don't die as well. Now we go into the fourth point. So all of this, you will notice that it happens after you break the tower and after you invade the jungle. Establish your control around their jungle, ensure the safe lane, enemy safe lane is always pushed in. So you want to take away the resources from the enemy carry and their teammates. So once you break the tower, normally you're the strongest hero in the game because you will already have your ultimate most of the time, right? You will have a lot more net worth than the opposition and you'll have a lot of vision set up yourself. So you'll deplete the enemy's farm and always select the correct jungle camps, meaning you want to move forwards into the enemy's jungle camps where you can, instead of farming backwards, right? You want to lead to the jungle camp that's closest to the lane rather than the jungle camps that are far from the lane. So that always ensures that you proceed forwards, push the lane in, farm the jungle camp and you repeatedly do that over and over again until the play happens at another lane where you TP to or you manage to see a kill with the vision you have set up yourself. Okay, so we go into protecting your wards. Alright, so once you plant wards in the enemy's jungle, there are cleaves, right? Plant on their cleaves, someone is on the cleaves. So


chunk_text:
  you want to take away the resources from the enemy carry and their teammates. So once you break the tower, normally you're the strongest hero in the game because you will already have your ultimate most of the time, right? You will have a lot more net worth than the opposition and you'll have a lot of vision set up yourself. So you'll deplete the enemy's farm and always select the correct jungle camps, meaning you want to move forwards into the enemy's jungle camps where you can, instead of farming backwards, right? You want to lead to the jungle camp that's closest to the lane rather than the jungle camps that are far from the lane. So that always ensures that you proceed forwards, push the lane in, farm the jungle camp and you repeatedly do that over and over again until the play happens at another lane where you TP to or you manage to see a kill with the vision you have set up yourself. Okay, so we go into protecting your wards. Alright, so once you plant wards in the enemy's jungle, there are cleaves, right? Plant on their cleaves, someone is on the cleaves. So you want to protect those wards with your own sentries, with your presence and you want to call for supports for backup from your side to come and invade the jungle with you as well. So if you manage to always protect, it's going to be ensured that your wards will never be de-ordered because with the advantage you have with the enemy safe lane constantly pushed in, with your control and presence around the entire area, the enemy can never return and take over the lane back again. Okay, now we go into connecting the dots. So connecting the dots will refer to how well you connect from waves to camps back to waves and camps again. So if you want to get a 5, you want to make sure that you are not pausing in between. So you go from waves to camps, always pre-planning your route beforehand. Next we go to maintaining control over enemy safe lane and enemy jungle. Okay, so this again is relatable to taking away resources, relatable to the three pointers here. Enemy jungle warded, invading enemy jungle, keeping enemy safe lane pushed out. You'll then maintain control, meaning once you have done


chunk_text:
  you want to protect those wards with your own sentries, with your presence and you want to call for supports for backup from your side to come and invade the jungle with you as well. So if you manage to always protect, it's going to be ensured that your wards will never be de-ordered because with the advantage you have with the enemy safe lane constantly pushed in, with your control and presence around the entire area, the enemy can never return and take over the lane back again. Okay, now we go into connecting the dots. So connecting the dots will refer to how well you connect from waves to camps back to waves and camps again. So if you want to get a 5, you want to make sure that you are not pausing in between. So you go from waves to camps, always pre-planning your route beforehand. Next we go to maintaining control over enemy safe lane and enemy jungle. Okay, so this again is relatable to taking away resources, relatable to the three pointers here. Enemy jungle warded, invading enemy jungle, keeping enemy safe lane pushed out. You'll then maintain control, meaning once you have done all of this, you don't want to leave, right? The moment you leave, what's going to happen is the enemy safe lane will come back into the game. Okay, so you need to maintain the control you have over and you do not give back the control you have established earlier on. Alright, threat identification. When you're invading the jungle and controlling their enemy safe lane, of course in turn will come threats. So I have a lot of students that when I tell them, how come you're not pushing forwards, right? And their typical answer will be, oh but it's on the enemy side, I don't see any vision on the map. And then immediately five seconds ago, we have just seen like one hero show top, three heroes show mid. These players do not see that what happened five seconds ago is the information they need to decide on what happens now, on what they do now. That is the threat identification we want for these players to understand. So your farming path selection, if you can go forwards, always pick forwards. If you can't go forwards, then you'll pick backwards. So you'll base this off map information,


chunk_text:
  all of this, you don't want to leave, right? The moment you leave, what's going to happen is the enemy safe lane will come back into the game. Okay, so you need to maintain the control you have over and you do not give back the control you have established earlier on. Alright, threat identification. When you're invading the jungle and controlling their enemy safe lane, of course in turn will come threats. So I have a lot of students that when I tell them, how come you're not pushing forwards, right? And their typical answer will be, oh but it's on the enemy side, I don't see any vision on the map. And then immediately five seconds ago, we have just seen like one hero show top, three heroes show mid. These players do not see that what happened five seconds ago is the information they need to decide on what happens now, on what they do now. That is the threat identification we want for these players to understand. So your farming path selection, if you can go forwards, always pick forwards. If you can't go forwards, then you'll pick backwards. So you'll base this off map information, vision, awareness, the words you plant, control, lead, your levels, a lot of factors, right? So make sure you understand what will kill you and what cannot kill you. Then play around that, push your limits as far as you can. Lastly, usage of scan for a winning lane. So when you push forwards, let's say you're playing to an area that you have no vision, you want to walk up to your high ground to plant a ward on the cliff. You want to push a wave without knowing what's behind and the map is black. Then you'll abuse the scan behind the wave. So the scan will tell you if the wave is dangerous or not. Okay, these are all like global criteria for every role. How fast you kill creeps, how well you identify whether you die or not and how often you use scan. Before we continue with this video, I would like to quickly introduce to you Dota 2 Pro Tracker, the top Dota 2 website to get your resources from about up-to-date meta builds and hero picks. If you are not already using Dota 2 Pro Tracker to learn more about the game, be


chunk_text:
  vision, awareness, the words you plant, control, lead, your levels, a lot of factors, right? So make sure you understand what will kill you and what cannot kill you. Then play around that, push your limits as far as you can. Lastly, usage of scan for a winning lane. So when you push forwards, let's say you're playing to an area that you have no vision, you want to walk up to your high ground to plant a ward on the cliff. You want to push a wave without knowing what's behind and the map is black. Then you'll abuse the scan behind the wave. So the scan will tell you if the wave is dangerous or not. Okay, these are all like global criteria for every role. How fast you kill creeps, how well you identify whether you die or not and how often you use scan. Before we continue with this video, I would like to quickly introduce to you Dota 2 Pro Tracker, the top Dota 2 website to get your resources from about up-to-date meta builds and hero picks. If you are not already using Dota 2 Pro Tracker to learn more about the game, be sure to check it out. With that said, let's get back to the video. Okay, now we go into the losing lane. So when you lose your lane, on the other hand, we are looking at ways for you to recover, right? So instead of pushing your advantage earlier, early on when you break the tower, now you're playing from a scenario where you fail to break the tower. So these cases will happen when your support goes missing. When your support is like doing something else somewhere else and now you're left with a 1v2 scenario in the lane that you cannot win. In cases like this, you will fall into recovery and you'll play very similar to your post-1 carry. Okay, so what I mean by this is, first we are looking at how well you select your farming route. When you lose the lane and you can't push forwards because forwards will mean death, now we are looking at farming backwards. So we are looking at the ancient camp, we are looking at the triangle and we are looking at safe farm near our tower. Okay, and we're also looking at pulling the big camp for the


chunk_text:
  sure to check it out. With that said, let's get back to the video. Okay, now we go into the losing lane. So when you lose your lane, on the other hand, we are looking at ways for you to recover, right? So instead of pushing your advantage earlier, early on when you break the tower, now you're playing from a scenario where you fail to break the tower. So these cases will happen when your support goes missing. When your support is like doing something else somewhere else and now you're left with a 1v2 scenario in the lane that you cannot win. In cases like this, you will fall into recovery and you'll play very similar to your post-1 carry. Okay, so what I mean by this is, first we are looking at how well you select your farming route. When you lose the lane and you can't push forwards because forwards will mean death, now we are looking at farming backwards. So we are looking at the ancient camp, we are looking at the triangle and we are looking at safe farm near our tower. Okay, and we're also looking at pulling the big camp for the wave to push back to your tower. So ensuring that you pick the right farming route, say you're a tight hunter, you go smash ancient creeps instead of big camps. If you are X, you also pick ancient camps, right? If you're playing like say death prophet and you can't play ancient camps, you're gonna play big camps. So how well you select your farming route, forwards, backwards, ancient speed camps, reading the timer for the ways to push back to your site, very important factors. Okay, now we go to connecting the dots. So same thing as before, whether there are pauses or not, whether you're maximizing time, right, or you're wasting time. Normally you want to prepare your movements like five seconds ahead, three seconds ahead, based on what you see on the map. If you prepare on spot, if you try and execute things on spot, you're gonna be slow. Example, I push a wave, now I'm thinking about what camps to go. Essentially, you're gonna be wasting a few seconds there. However, if before you even pushed out the wave, you know, okay, after this wave, we see a camp, we see a camp there, we


chunk_text:
  wave to push back to your tower. So ensuring that you pick the right farming route, say you're a tight hunter, you go smash ancient creeps instead of big camps. If you are X, you also pick ancient camps, right? If you're playing like say death prophet and you can't play ancient camps, you're gonna play big camps. So how well you select your farming route, forwards, backwards, ancient speed camps, reading the timer for the ways to push back to your site, very important factors. Okay, now we go to connecting the dots. So same thing as before, whether there are pauses or not, whether you're maximizing time, right, or you're wasting time. Normally you want to prepare your movements like five seconds ahead, three seconds ahead, based on what you see on the map. If you prepare on spot, if you try and execute things on spot, you're gonna be slow. Example, I push a wave, now I'm thinking about what camps to go. Essentially, you're gonna be wasting a few seconds there. However, if before you even pushed out the wave, you know, okay, after this wave, we see a camp, we see a camp there, we see another camp, we see the next wave coming. So this, all this will go together to make up the bigger picture of not wasting time. All right, so amount of interruptions present, say you're like recovering, if you proceed to like go help your team and you die and turn, or you show to a fight that's not good and you just wasted time, you have essentially interrupted yourself from recovering, so you're too slow. All right, so no chasing for kills, don't trade if there's no point in trading, just push wave and farm, push wave and farm. So time taken to kill creeps, same as before, using our spells, right, how well, how fast you kill creeps and all that. Clarity and TP's, same thing. Ability to identify open lanes, same thing. So two TP's, two Clarity's, mana always running, all right. Open lanes, so we're always gonna be TPing to these lanes, we're not gonna be walking, if the lane is too far, just TP. Because right now the plan is to recover, when you're recovering, you gotta speed up your farm. Okay, cleanups, as mentioned, show up to cleanups, don't show up to not cleanups,


chunk_text:
  see another camp, we see the next wave coming. So this, all this will go together to make up the bigger picture of not wasting time. All right, so amount of interruptions present, say you're like recovering, if you proceed to like go help your team and you die and turn, or you show to a fight that's not good and you just wasted time, you have essentially interrupted yourself from recovering, so you're too slow. All right, so no chasing for kills, don't trade if there's no point in trading, just push wave and farm, push wave and farm. So time taken to kill creeps, same as before, using our spells, right, how well, how fast you kill creeps and all that. Clarity and TP's, same thing. Ability to identify open lanes, same thing. So two TP's, two Clarity's, mana always running, all right. Open lanes, so we're always gonna be TPing to these lanes, we're not gonna be walking, if the lane is too far, just TP. Because right now the plan is to recover, when you're recovering, you gotta speed up your farm. Okay, cleanups, as mentioned, show up to cleanups, don't show up to not cleanups, right, show up to good fights, pick the right fights, don't show up to fights that are like with intent to help and you die in turn, or don't show up to fights that are like a waste of time when you can be recovering with your farm. Track amplification, make sure you're not dying when you farm, usage of scan, you gotta ensure you're always safe when you push waves, when you hit camps, when you go high ground, when you push into your jungle, right. And finally, from both of this winning and losing, you're gonna go into how fast you take to hit your item timing. So normally the item timing for an offlaner will be something like a BKB, a blink dagger, but if the game pacing is very fast, then your item timing will change, your item timing will go from like a BKB to a blink dagger, it depends on how fast the game is progressing. What is the key item that tells you to start fighting? In a slow game, there will be a BKB, in a fast game, there will be a blink dagger. So how fast you relate to the game


chunk_text:
  right, show up to good fights, pick the right fights, don't show up to fights that are like with intent to help and you die in turn, or don't show up to fights that are like a waste of time when you can be recovering with your farm. Track amplification, make sure you're not dying when you farm, usage of scan, you gotta ensure you're always safe when you push waves, when you hit camps, when you go high ground, when you push into your jungle, right. And finally, from both of this winning and losing, you're gonna go into how fast you take to hit your item timing. So normally the item timing for an offlaner will be something like a BKB, a blink dagger, but if the game pacing is very fast, then your item timing will change, your item timing will go from like a BKB to a blink dagger, it depends on how fast the game is progressing. What is the key item that tells you to start fighting? In a slow game, there will be a BKB, in a fast game, there will be a blink dagger. So how fast you relate to the game pacing will determine what items you will buy as your item timing. So that means you start like grouping and all that stuff. One key note I want you guys to understand is, even if you have lost the lane, you can still go back into a winning lane, meaning this criteria, all of this farming recovery route can become a winning lane again, can go back to this state, even if it's slower. Let's say you lost the lane, suddenly you get ganks from your teammates to win the lane for you, and you manage to break the tower by like 13 minutes, 12 minutes, you will still go into the winning lane state. So do not assume that I've lost the lane, I have to lose the lane forever. No, a losing lane can become a winning lane. Subsequently, a winning lane can become a losing lane. Okay, so let's say you try and you broke their tower and you try and push forwards, but they retaliate and now you die, or you can no longer push forwards because there's too many threats, and now you're forced to play backwards. Then you'll farm your jungle camps instead, and


chunk_text:
  pacing will determine what items you will buy as your item timing. So that means you start like grouping and all that stuff. One key note I want you guys to understand is, even if you have lost the lane, you can still go back into a winning lane, meaning this criteria, all of this farming recovery route can become a winning lane again, can go back to this state, even if it's slower. Let's say you lost the lane, suddenly you get ganks from your teammates to win the lane for you, and you manage to break the tower by like 13 minutes, 12 minutes, you will still go into the winning lane state. So do not assume that I've lost the lane, I have to lose the lane forever. No, a losing lane can become a winning lane. Subsequently, a winning lane can become a losing lane. Okay, so let's say you try and you broke their tower and you try and push forwards, but they retaliate and now you die, or you can no longer push forwards because there's too many threats, and now you're forced to play backwards. Then you'll farm your jungle camps instead, and you're gonna go into the losing lane state. Normally, if you do it right, you're gonna mostly win the lane and you're gonna stay with the winning criteria instead. Okay, so I hope this video makes sense. There's also a total score for you in case you win lane or lose lane or both, and you can summarize your win in the end. Okay, any questions, you guys can feel free to leave them in the comment box below. I try my best to answer to every comment that's being posted. This DPSP cheat sheet will be in the description box down below. Thank you for supporting my channel. I'll see you guys again. Peace.


chunk_text:
  you're gonna go into the losing lane state. Normally, if you do it right, you're gonna mostly win the lane and you're gonna stay with the winning criteria instead. Okay, so I hope this video makes sense. There's also a total score for you in case you win lane or lose lane or both, and you can summarize your win in the end. Okay, any questions, you guys can feel free to leave them in the comment box below. I try my best to answer to every comment that's being posted. This DPSP cheat sheet will be in the description box down below. Thank you for supporting my channel. I'll see you guys again. Peace.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=QruSCKPuUgI", "title": "Gain MMR With These Concepts: Increasing Leads, Progressing Game, & Highground", "description": "I'm Carbonyl_DotA and I'm a 7k MMR coach. I make educational DotA YouTube content. If you're interested in my paid coaching, please join my discord linked below.\n\nPart 1 in this Series: https://youtu.be/rxFWNPpB7gw\nThe Box video: https://www.youtube.com/watch?v=WVnzQN1u-o8\n\nCoaching Discord: https://discord.gg/fhdXsaEsas\nYouTube Channel: https://www.youtube.com/channel/UC8Rv6PXWZ5ERqoLlUsIyQ8w\nEmail for business opportunities or requests for coaching: carbonyl.dota@gmail.com\n\n#Carbonyl_Dota #Dota2\ndota coaching,dota coach,immortal dota,carry coach,carry coaching,support coach,support coaching", "channel_url": "https://www.youtube.com/channel/UC8Rv6PXWZ5ERqoLlUsIyQ8w", "duration": 498, "channel": "Carbonyl DotA", "uploader": "Carbonyl DotA", "upload_date": "20231229" } This text was transcribed using whisper model: medium Hey guys, today we're bringing you part two in the series of what you need to know to improve at Dota 2, talking about increasing a lead, progressing the game, and going high ground. Progressing the game is taking objectives for your side. Objectives are towers and Roshan. Alternatively, you can progress the game not by taking an objective, but by setting up the map, gaining map control, such that you can then increase your lead. Increasing your lead is accruing more gold and XP than your opponent over a period of time. Sounds pretty simple. The thing with taking objectives is it permanently increases your map control, or in a sense, permanently lessens their map control, their area of control, the areas they can easily be in. If you win a fight and you take a tower, that's like permanent map control, or at least lack of map control for their side in that area. If you win a fight and then you go farm at your side of the map, and you jungle or whatever, and you don't take objectives, then the game just continues as is. You haven't really gained anything. You haven't really progressed the game. They could always come back later. Stuff happens all the time. So if you're not progressing the game when you're ahead or you want to fight, then you're not really going to win consistently, I guess. Things are just going to become more random because the games are going to get longer looking at you low MMR players. So we've talked about how these things are linked. The best play after winning a fight is to take an objective. If you can't because your lanes are bad, then what you need to do after winning a fight is immediately fix your lanes. This sets up the map such


chunk_text:
  or in a sense, permanently lessens their map control, their area of control, the areas they can easily be in. If you win a fight and you take a tower, that's like permanent map control, or at least lack of map control for their side in that area. If you win a fight and then you go farm at your side of the map, and you jungle or whatever, and you don't take objectives, then the game just continues as is. You haven't really gained anything. You haven't really progressed the game. They could always come back later. Stuff happens all the time. So if you're not progressing the game when you're ahead or you want to fight, then you're not really going to win consistently, I guess. Things are just going to become more random because the games are going to get longer looking at you low MMR players. So we've talked about how these things are linked. The best play after winning a fight is to take an objective. If you can't because your lanes are bad, then what you need to do after winning a fight is immediately fix your lanes. This sets up the map such that the next fight you take, you can take an objective, or just sets up the map such that it gives you the information you need to then know if you can safely take an objective even if they respawn. Now, let's talk a lot more about how we set up the map and what playing from ahead looks like and how you can try and play from behind. This is called what I call the box. I have a full video on this. I highly recommend you check it out. If you haven't seen it already, I'll link it in the description. But we're going to cover the basics here because it's so important and it kind of ties into these other concepts anyway. And just to define the box, the box is the losing team's area of control. So, for example, just in the thumbnail portrait here, you can see that the dire team is winning and the losing team is what's within this red line here. This is the losing team's area of control. The dire team obviously has a bigger advantage here. So just keep that in mind. The dire is trying to shrink that box


chunk_text:
  that the next fight you take, you can take an objective, or just sets up the map such that it gives you the information you need to then know if you can safely take an objective even if they respawn. Now, let's talk a lot more about how we set up the map and what playing from ahead looks like and how you can try and play from behind. This is called what I call the box. I have a full video on this. I highly recommend you check it out. If you haven't seen it already, I'll link it in the description. But we're going to cover the basics here because it's so important and it kind of ties into these other concepts anyway. And just to define the box, the box is the losing team's area of control. So, for example, just in the thumbnail portrait here, you can see that the dire team is winning and the losing team is what's within this red line here. This is the losing team's area of control. The dire team obviously has a bigger advantage here. So just keep that in mind. The dire is trying to shrink that box smaller, take objectives, make it smaller. And the radiant wants to push that out. The box comes down to a couple fundamentals. So a team at the lead cannot control the entire map. And by the entire map, I mean all three lanes and all the jungle area. You just can't. It's too big. You don't have enough heroes. When ahead, the team that's ahead wants to fight the enemy with their already superior level and item advantage. And when you're behind, you want to dodge them because the enemy has a superior level and item advantage. Obviously, things like cooldowns of high impact spells or items can affect whether you want to fight in that exact second or not. But that's the general idea. And then the map control and information gained from the lanes being pushed in for either side, really. Like it's good if you're losing, because it's good if you're winning. The more you can get the lanes in, the more information you have to dodge bad fights if you're losing or to choose good fights. And when you have the lanes pushed in, it forces a response from the enemy because they want to get


chunk_text:
  smaller, take objectives, make it smaller. And the radiant wants to push that out. The box comes down to a couple fundamentals. So a team at the lead cannot control the entire map. And by the entire map, I mean all three lanes and all the jungle area. You just can't. It's too big. You don't have enough heroes. When ahead, the team that's ahead wants to fight the enemy with their already superior level and item advantage. And when you're behind, you want to dodge them because the enemy has a superior level and item advantage. Obviously, things like cooldowns of high impact spells or items can affect whether you want to fight in that exact second or not. But that's the general idea. And then the map control and information gained from the lanes being pushed in for either side, really. Like it's good if you're losing, because it's good if you're winning. The more you can get the lanes in, the more information you have to dodge bad fights if you're losing or to choose good fights. And when you have the lanes pushed in, it forces a response from the enemy because they want to get that golden XP or it forces an obvious non-response. If you're pushing in a tower and creeps are dying under that tower and nobody on their team's farming it, that's kind of a key indicator that they might be doing something important somewhere else, because otherwise they wouldn't be letting those creeps die for free. So we want to tie in progressing the game here with this box idea. When you've got the lane shoved in and you're trying to reduce the enemy's area of control, that allows progressing the game to happen much easier. You're applying the pressure, you're controlling where the enemy goes. When you're ahead, you want to corral the enemy into the area behind their existing still standing towers. Once you've done this, objectives will fall easier because you'll have good information for where they are. And a lot of times things like Roshan can be free because you've contained them. They're in a small area and you can take Roshan whenever you want and they either have to like try and smoke or it'll be really obvious that they're coming to stop you and it'll set a good play for your side. Another key, while


chunk_text:
  that golden XP or it forces an obvious non-response. If you're pushing in a tower and creeps are dying under that tower and nobody on their team's farming it, that's kind of a key indicator that they might be doing something important somewhere else, because otherwise they wouldn't be letting those creeps die for free. So we want to tie in progressing the game here with this box idea. When you've got the lane shoved in and you're trying to reduce the enemy's area of control, that allows progressing the game to happen much easier. You're applying the pressure, you're controlling where the enemy goes. When you're ahead, you want to corral the enemy into the area behind their existing still standing towers. Once you've done this, objectives will fall easier because you'll have good information for where they are. And a lot of times things like Roshan can be free because you've contained them. They're in a small area and you can take Roshan whenever you want and they either have to like try and smoke or it'll be really obvious that they're coming to stop you and it'll set a good play for your side. Another key, while you're doing this box concept and keeping the box in, you want to kill heroes that leave their box. So if you look again just at this thumbnail picture that is on the right here. From the Dyr's perspective, this Tusk walking into the triangle or this Drow walking into her jungle is not allowed. It's outside the Radiance area of control and you can just kill them. So just real quickly on how to do that, and I go into a lot more detail in that video, but having good wards when you're ahead, scouts when the enemy is trying to leave their box, and then you just need to have the means and the discipline to catch and kill those heroes when they leave their area of control. People do this all the time, especially at low MMRs. The thing is at lower MMRs, the winning team or the team that's ahead doesn't really capitalize. The higher MMR you get, the more often you're capitalizing on these mistakes that your opponents are making. The losing team should be trying to spread out and they do want to increase their area of control, but they want to do it


chunk_text:
  you're doing this box concept and keeping the box in, you want to kill heroes that leave their box. So if you look again just at this thumbnail picture that is on the right here. From the Dyr's perspective, this Tusk walking into the triangle or this Drow walking into her jungle is not allowed. It's outside the Radiance area of control and you can just kill them. So just real quickly on how to do that, and I go into a lot more detail in that video, but having good wards when you're ahead, scouts when the enemy is trying to leave their box, and then you just need to have the means and the discipline to catch and kill those heroes when they leave their area of control. People do this all the time, especially at low MMRs. The thing is at lower MMRs, the winning team or the team that's ahead doesn't really capitalize. The higher MMR you get, the more often you're capitalizing on these mistakes that your opponents are making. The losing team should be trying to spread out and they do want to increase their area of control, but they want to do it away from wherever the opponent is. And remember, the opponent cannot control the entire map. Even if you're ahead, they can't control the entire map. So if you see them all in one area, you can move out the other way. If they split up too much, you can kill the people that try and split up. And you want to shove these lanes out away from the opponent. And in pubs, this should really be you, because your teammates just won't do it well a lot of the time. So that's progressing the game, and we know how that ties into taking the lead. We want to progress the game by taking objectives when possible. We want to use the box to get map control and control where the enemy can go. We want to have good vision up. Eventually, this is going to lead into trying to go high ground. How do you go high ground? Well, it's dangerous. Everybody complains about it on Reddit and some heroes it feels impossible against. So really, it should only be done with a significant advantage. So you're up in hero number and or you have the Aegis. Of course, if


chunk_text:
  away from wherever the opponent is. And remember, the opponent cannot control the entire map. Even if you're ahead, they can't control the entire map. So if you see them all in one area, you can move out the other way. If they split up too much, you can kill the people that try and split up. And you want to shove these lanes out away from the opponent. And in pubs, this should really be you, because your teammates just won't do it well a lot of the time. So that's progressing the game, and we know how that ties into taking the lead. We want to progress the game by taking objectives when possible. We want to use the box to get map control and control where the enemy can go. We want to have good vision up. Eventually, this is going to lead into trying to go high ground. How do you go high ground? Well, it's dangerous. Everybody complains about it on Reddit and some heroes it feels impossible against. So really, it should only be done with a significant advantage. So you're up in hero number and or you have the Aegis. Of course, if you're like 50k ahead, it doesn't really matter. But in general, you want to have a significant advantage. You also really need to be aware of the possible buybacks and what your plan is if they buy back. It doesn't need to be elaborate. If they buy back, do we back right away? Yes or no? And it can depend on the hero. So like in this screen cap below, if the Tusk buys back, maybe not a big deal. We can keep going high ground. If the Spectre buys back, that probably is a big deal, but we still have Aegis, so maybe we're still okay with it. It's just something you have to think about, and it'll just depend in your game and the heroes as to what those buybacks mean. It's just really important to know and not throw, to respect the buybacks a lot of time. Usually the best play is to respect the buyback. Push high ground if they buy back, back off, farm it up a little bit, and look for the next good play. And the last thing is don't push into those key high ground heroes like Tinker and Sniper. Those heroes


chunk_text:
  you're like 50k ahead, it doesn't really matter. But in general, you want to have a significant advantage. You also really need to be aware of the possible buybacks and what your plan is if they buy back. It doesn't need to be elaborate. If they buy back, do we back right away? Yes or no? And it can depend on the hero. So like in this screen cap below, if the Tusk buys back, maybe not a big deal. We can keep going high ground. If the Spectre buys back, that probably is a big deal, but we still have Aegis, so maybe we're still okay with it. It's just something you have to think about, and it'll just depend in your game and the heroes as to what those buybacks mean. It's just really important to know and not throw, to respect the buybacks a lot of time. Usually the best play is to respect the buyback. Push high ground if they buy back, back off, farm it up a little bit, and look for the next good play. And the last thing is don't push into those key high ground heroes like Tinker and Sniper. Those heroes are just impossible to push high ground against. So just play the box, play the map and control it. If they leave the box, if they leave their box, which a lot of times will be their base if you're really far ahead because you've shrunk them all the way down, if they leave their base, that's when you fight them. Any fight outside the base against these high ground defensive heroes like Tinker and Sniper is usually good, versus trying to push into their base is where they have supreme advantage. That is the end of the video, guys. Thanks for checking it out. I will hit you with part three, which is going to be on making good plays pretty soon, and I'll catch you later. Thanks for watching. If you liked the video, give it a thumbs up. If you haven't already, sub to the channel. And if you want to be coached by me, check the link in the video description. You can join my Discord there, and there's all the information there on how to sign up.


chunk_text:
  are just impossible to push high ground against. So just play the box, play the map and control it. If they leave the box, if they leave their box, which a lot of times will be their base if you're really far ahead because you've shrunk them all the way down, if they leave their base, that's when you fight them. Any fight outside the base against these high ground defensive heroes like Tinker and Sniper is usually good, versus trying to push into their base is where they have supreme advantage. That is the end of the video, guys. Thanks for checking it out. I will hit you with part three, which is going to be on making good plays pretty soon, and I'll catch you later. Thanks for watching. If you liked the video, give it a thumbs up. If you haven't already, sub to the channel. And if you want to be coached by me, check the link in the video description. You can join my Discord there, and there's all the information there on how to sign up.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=sjsnuirLyKM", "title": "Rust stole C++'s best features", "description": "In this video, we dive deep into the best feature Rust stole from C+.+ I'll break down exactly what these features are and show you how the creators of Rust have innovated on top of them. Stick around till the end where I'll discuss the biggest challenge Rust faces in its quest to compete with and potentially replace C++. \n\nFree Rust training: https://letsgetrusty.com/bootcamp\n\nChapter:\n0:00 Intro\n0:18 1st feature\n3:27 2nd feature\n5:33 3rd feature\n7:27 Rust major limitation", "channel_url": "https://www.youtube.com/channel/UCSp-OaMpsO8K0KkOqyBl7_w", "duration": 527, "channel": "Let's Get Rusty", "uploader": "Let's Get Rusty", "upload_date": "20240912" } This text was transcribed using whisper model: medium Rust stole C++'s 3 best features. In this video, I'll cover exactly what these features are, and more importantly, how the Rust creators innovated on top of these features. At the end, I'll also explain the biggest limitation Rust has to overcome in order to truly compete and potentially replace C++. The first feature Rust stole from C++ is, ironically, the resource management model. When C++ was first introduced, the creator, Bjorn Strashtrup, came up with an extremely useful design pattern called RAII, which stands for Resource Acquisition is Initialization. The idea is that resources like heap-allocated memory, database connections, and file handles should be tied to the lifecycle of objects. When an object is created, it should acquire the resources it needs. This is done in the object's constructor function. And when the object is destroyed, the resource should be released. This is done in the object's destructor function. This design pattern leads to reliable resource management, cleaner code, and, most importantly, it reduces the risk of resource leaks. That's why it's used throughout the C++ standard library. In fact, OFstream already implements RAII internally, so we can use it directly to manipulate files. To automatically clean up heap-allocated memory, we can use the unique smart pointer from the standard library. And to automatically manage database connections, we can use third-party libraries. RAII is so useful that Rust took this design pattern and made it a core part of the language. Similar to C++, the Rust standard library extensively uses RAII. We can manipulate files and the handle will automatically be released. The box smart pointer is used to automatically clean up heap-allocated memory. And we can manage database connections using third-party libraries. But Rust doesn't stop there. It provides two major improvements


chunk_text:
  resources like heap-allocated memory, database connections, and file handles should be tied to the lifecycle of objects. When an object is created, it should acquire the resources it needs. This is done in the object's constructor function. And when the object is destroyed, the resource should be released. This is done in the object's destructor function. This design pattern leads to reliable resource management, cleaner code, and, most importantly, it reduces the risk of resource leaks. That's why it's used throughout the C++ standard library. In fact, OFstream already implements RAII internally, so we can use it directly to manipulate files. To automatically clean up heap-allocated memory, we can use the unique smart pointer from the standard library. And to automatically manage database connections, we can use third-party libraries. RAII is so useful that Rust took this design pattern and made it a core part of the language. Similar to C++, the Rust standard library extensively uses RAII. We can manipulate files and the handle will automatically be released. The box smart pointer is used to automatically clean up heap-allocated memory. And we can manage database connections using third-party libraries. But Rust doesn't stop there. It provides two major improvements on top of the traditional RAII pattern in C++. First, unlike C++, Rust prevents you from accidentally shooting yourself in the foot. In C++, you can bypass the RAII pattern and allocate memory manually using the new and delete operators. This can lead to mistakes like use after free errors if you attempt to access a pointer after calling delete, double free errors if you accidentally call delete twice, and resource leaks if you forget to call delete. These bugs can and do compromise the stability, security, and performance of software. Microsoft famously reported that 70% of vulnerabilities found in their products were caused by memory safety bugs. Rust avoids these pitfalls because it doesn't have operators like new and delete. It only allows you to allocate resources using RAII constructs. The second major improvement Rust provides on top of the traditional RAII pattern is automatically managing references to data. In Rust, the compiler enforces the validity of references. When a value is deallocated, the compiler will prevent any references to that deallocated value from being used again by performing compile-time checks. This means references are guaranteed to point to valid memory. So you don't have to worry about infamous


chunk_text:
  on top of the traditional RAII pattern in C++. First, unlike C++, Rust prevents you from accidentally shooting yourself in the foot. In C++, you can bypass the RAII pattern and allocate memory manually using the new and delete operators. This can lead to mistakes like use after free errors if you attempt to access a pointer after calling delete, double free errors if you accidentally call delete twice, and resource leaks if you forget to call delete. These bugs can and do compromise the stability, security, and performance of software. Microsoft famously reported that 70% of vulnerabilities found in their products were caused by memory safety bugs. Rust avoids these pitfalls because it doesn't have operators like new and delete. It only allows you to allocate resources using RAII constructs. The second major improvement Rust provides on top of the traditional RAII pattern is automatically managing references to data. In Rust, the compiler enforces the validity of references. When a value is deallocated, the compiler will prevent any references to that deallocated value from being used again by performing compile-time checks. This means references are guaranteed to point to valid memory. So you don't have to worry about infamous bugs like null pointer dereferences, use after free errors, and data races. The RAII pattern in Rust is called the ownership model, and the extra compile-time checks that ensure the validity of references is called the borrowing model. Together, they ensure that resources are automatically cleaned up and references are always valid, eliminating an entire class of memory safety bugs. The second feature Rust stole from C++ is the principle of zero-cost abstractions. This principle can be summarized with the following phrase, what you don't use, you don't pay for, and what you do use, you couldn't have hand-coded any better. This means that high-level abstractions like generics and collections should not impose any runtime overhead or performance penalties compared to code using low-level abstractions like loops and counters. This leads to a great developer experience while preserving lightning-fast performance. In this C++ example, we create a vector of integers and then use a for loop to find the greatest element in the vector. This code includes loop initialization, condition checking, and element comparison, making it less readable and more prone to errors. By using the iterator abstraction in C++, this code becomes a lot simpler. Now, we just have


chunk_text:
  bugs like null pointer dereferences, use after free errors, and data races. The RAII pattern in Rust is called the ownership model, and the extra compile-time checks that ensure the validity of references is called the borrowing model. Together, they ensure that resources are automatically cleaned up and references are always valid, eliminating an entire class of memory safety bugs. The second feature Rust stole from C++ is the principle of zero-cost abstractions. This principle can be summarized with the following phrase, what you don't use, you don't pay for, and what you do use, you couldn't have hand-coded any better. This means that high-level abstractions like generics and collections should not impose any runtime overhead or performance penalties compared to code using low-level abstractions like loops and counters. This leads to a great developer experience while preserving lightning-fast performance. In this C++ example, we create a vector of integers and then use a for loop to find the greatest element in the vector. This code includes loop initialization, condition checking, and element comparison, making it less readable and more prone to errors. By using the iterator abstraction in C++, this code becomes a lot simpler. Now, we just have to call the maxElement function in the standard library. The iterator abstraction encapsulates iteration and comparison logic, making the code cleaner, more concise, and less error-prone without sacrificing performance. Here's how we would write the same code in Rust. First we turn a vector into an iterator by calling the iter method, and then we find the greatest element by calling the max method. In this example, we're actually using a few zero-cost abstractions. The first one being the iterator abstraction. The second one is the option enum, and the third is pattern matching. The beautiful thing about Rust is that it builds on top of the zero-cost abstraction principle by further emphasizing memory safety and thread safety. For example, if we go back to the C++ example and call the maxElement function with an empty it would lead to undefined behavior, because we would get back an object that is not safe to dereference, but in the next line we are attempting to dereference it. In Rust on the other hand, the max method returns an option type, so if we call it on an empty vector, it would simply return the none variant. The option type forces us


chunk_text:
  to call the maxElement function in the standard library. The iterator abstraction encapsulates iteration and comparison logic, making the code cleaner, more concise, and less error-prone without sacrificing performance. Here's how we would write the same code in Rust. First we turn a vector into an iterator by calling the iter method, and then we find the greatest element by calling the max method. In this example, we're actually using a few zero-cost abstractions. The first one being the iterator abstraction. The second one is the option enum, and the third is pattern matching. The beautiful thing about Rust is that it builds on top of the zero-cost abstraction principle by further emphasizing memory safety and thread safety. For example, if we go back to the C++ example and call the maxElement function with an empty it would lead to undefined behavior, because we would get back an object that is not safe to dereference, but in the next line we are attempting to dereference it. In Rust on the other hand, the max method returns an option type, so if we call it on an empty vector, it would simply return the none variant. The option type forces us to check whether the return type is the sum variant or the none variant, which makes our code a lot more robust while preserving blazingly fast performance. The third feature Rust stole from C++ is generic programming. In C++, generic programming is implemented through templates. Templates allow you to write code that works with any data type, providing flexibility and reusability. This template function called print takes a single parameter of generic type T. The generic is also constrained by the printable concept. Concepts in C++ define requirements that a type must satisfy. In this case, for a type to be considered printable, it must be able to output to standard and the operation must return a reference to Ostream. By using this concept as a constraint on the generic type T, the print function ensures that it will only be instantiated for types that can actually be printed. Rust took the idea of generics and modernized it. In Rust, we have generics which are inspired by C++ templates, but with two key improvements. First, notice the clean and concise syntax. Rust generics are more intuitive and easier to read. Second, Rust integrates generics tightly with its trait system. In


chunk_text:
  to check whether the return type is the sum variant or the none variant, which makes our code a lot more robust while preserving blazingly fast performance. The third feature Rust stole from C++ is generic programming. In C++, generic programming is implemented through templates. Templates allow you to write code that works with any data type, providing flexibility and reusability. This template function called print takes a single parameter of generic type T. The generic is also constrained by the printable concept. Concepts in C++ define requirements that a type must satisfy. In this case, for a type to be considered printable, it must be able to output to standard and the operation must return a reference to Ostream. By using this concept as a constraint on the generic type T, the print function ensures that it will only be instantiated for types that can actually be printed. Rust took the idea of generics and modernized it. In Rust, we have generics which are inspired by C++ templates, but with two key improvements. First, notice the clean and concise syntax. Rust generics are more intuitive and easier to read. Second, Rust integrates generics tightly with its trait system. In this example, we're explicitly stating that the generic T must implement the display trait. This is similar to C++ concepts, but it's been a part of Rust from the very beginning. Because generics and traits are tightly integrated in Rust, you'll get clear error messages when you use a type that doesn't meet the requirements, which has been a historic pain point with C++ templates. Rust's approach to generics also maintains the zero-cost abstraction principle we discussed earlier. The compiled code is just as efficient as if you had written separate functions for each concrete type, because this is actually what Rust does automatically for you at compile time. Moreover, Rust's ownership system applies to generic code as well, ensuring that even generic functions are memory safe and thread safe. By refining C++'s template system, Rust has made generic programming more accessible while maintaining its power and performance benefits. Now while Rust has made significant strides improving on C++'s features, it still faces a major limitation, ecosystem and compatibility. C++ has been around for decades and has built up a vast ecosystem and wide-ranging industry adoption. C++ also has near seamless compatibility with C, meaning you can run your application


chunk_text:
  this example, we're explicitly stating that the generic T must implement the display trait. This is similar to C++ concepts, but it's been a part of Rust from the very beginning. Because generics and traits are tightly integrated in Rust, you'll get clear error messages when you use a type that doesn't meet the requirements, which has been a historic pain point with C++ templates. Rust's approach to generics also maintains the zero-cost abstraction principle we discussed earlier. The compiled code is just as efficient as if you had written separate functions for each concrete type, because this is actually what Rust does automatically for you at compile time. Moreover, Rust's ownership system applies to generic code as well, ensuring that even generic functions are memory safe and thread safe. By refining C++'s template system, Rust has made generic programming more accessible while maintaining its power and performance benefits. Now while Rust has made significant strides improving on C++'s features, it still faces a major limitation, ecosystem and compatibility. C++ has been around for decades and has built up a vast ecosystem and wide-ranging industry adoption. C++ also has near seamless compatibility with C, meaning you can run your application on virtually any operating system or hardware platform. Rust, being a newer language, is still building its ecosystem. And while industry adoption is rapidly growing, it's still in the early stages. And Rust's compatibility with C while improving isn't as seamless as C++'s. This ecosystem gap means that for many existing large-scale projects, or specialized industries, C++ remains the go-to choice despite Rust's safety advantages. For Rust to truly compete with C++, it needs to continue growing its ecosystem and improving its compatibility with existing codebases. Despite these challenges, I'm very optimistic about Rust's future. As the ecosystem grows and compatibility improves, I think the rate of adoption will only increase. If you need help becoming a Rust developer or are just curious about the opportunities, make sure to get your free Rust training at letsgetrusty.com slash bootcamp. Hope you've enjoyed the video and remember to stay Rusty.


chunk_text:
  on virtually any operating system or hardware platform. Rust, being a newer language, is still building its ecosystem. And while industry adoption is rapidly growing, it's still in the early stages. And Rust's compatibility with C while improving isn't as seamless as C++'s. This ecosystem gap means that for many existing large-scale projects, or specialized industries, C++ remains the go-to choice despite Rust's safety advantages. For Rust to truly compete with C++, it needs to continue growing its ecosystem and improving its compatibility with existing codebases. Despite these challenges, I'm very optimistic about Rust's future. As the ecosystem grows and compatibility improves, I think the rate of adoption will only increase. If you need help becoming a Rust developer or are just curious about the opportunities, make sure to get your free Rust training at letsgetrusty.com slash bootcamp. Hope you've enjoyed the video and remember to stay Rusty.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=7ZU8kQNjAcc", "title": "Rust's next major update is coming...", "description": "Rust's next major update is just around the corner, and it's shaping up to be a game-changer! Every 3 years, Rust releases a new edition, and the highly anticipated 2024 edition is almost here. In this video, we'll dive deep into the exciting new features and improvements coming with this major update.\n\nFree Rust training: https://letsgetrusty.com/bootcamp\n\n0:00 Intro\n0:29 Generators\n2:32 Polonius\n3:41 Additional features", "channel_url": "https://www.youtube.com/channel/UCSp-OaMpsO8K0KkOqyBl7_w", "duration": 287, "channel": "Let's Get Rusty", "uploader": "Let's Get Rusty", "upload_date": "20240905" } This text was transcribed using whisper model: medium Rust's next major update is right around the corner. Every 3 years, a new major update to Rust is released. These releases are called Rust Editions, and now we finally have more information about the long-awaited 2024 edition. In this video, we'll cover the most exciting changes planned in this upcoming Rust edition, and the additional features shipping in the next 6 months. In a recent blog post, the Rust team outlined their project goals for the second half of 2024, which includes shipping the 2024 edition. The first exciting change in the 2024 edition is reserving the Gen keyword so that generators can be added in the future. Generators provide a way to create iterators using imperative syntax, or in other words, describing a sequence of actions. And the big benefit is that they can greatly simplify the creation of complex iterators. For example, let's say we wanted to implement an iterator that yielded prime numbers using the sieve of Eratosthenes' algorithm. Now, there are a few approaches we can take. First, we can take the manual approach by creating a struct to manage state, and then implementing the iterator trait on that struct. The problem is this leads to verbose syntax and a lot of boilerplate. We have to deal with complex state management, and the solution is less intuitive because the algorithm is obscured by the iterator implementation details. So this is the manual approach. The second approach would be to use combinator methods to simulate something close to the sieve of Eratosthenes' algorithm. The problem is this code is hard to read because the algorithm is spread across multiple combinators. It's difficult to express complex state management, and this implementation is significantly slower than a proper implementation because with combinators, we can't actually implement a true sieve of Eratosthenes' algorithm. The third


chunk_text:
  in the future. Generators provide a way to create iterators using imperative syntax, or in other words, describing a sequence of actions. And the big benefit is that they can greatly simplify the creation of complex iterators. For example, let's say we wanted to implement an iterator that yielded prime numbers using the sieve of Eratosthenes' algorithm. Now, there are a few approaches we can take. First, we can take the manual approach by creating a struct to manage state, and then implementing the iterator trait on that struct. The problem is this leads to verbose syntax and a lot of boilerplate. We have to deal with complex state management, and the solution is less intuitive because the algorithm is obscured by the iterator implementation details. So this is the manual approach. The second approach would be to use combinator methods to simulate something close to the sieve of Eratosthenes' algorithm. The problem is this code is hard to read because the algorithm is spread across multiple combinators. It's difficult to express complex state management, and this implementation is significantly slower than a proper implementation because with combinators, we can't actually implement a true sieve of Eratosthenes' algorithm. The third approach is to use generators. By creating a gen block, we're able to yield items for each iteration. The yield keyword pauses the generator's execution and returns the value to the caller. Notice that this code is extremely concise, very readable, and is just as efficient as the manual approach we mentioned earlier. Now, it's important to note that in the 2024 edition of Rust, the gen keyword will be reserved, but additional work is still required to actually implement generators. That being said, after generator blocks are implemented, the Rust team is already thinking of additional features. For example, supporting async generator blocks and adding the gen function or gen trifunction syntax. In general, I'm very excited that progress is being made on this feature, and I can't wait to try it out in nightly. The second exciting feature mentioned in this blog post is Polonius. Polonius is Rust's next-generation borrow checking algorithm. It's an improved version of the current borrow checker that resolves some common limitations. For example, let's say we have a function which takes a hash map and key as input, and it either returns a mutable reference to the value if the key exists, or


chunk_text:
  approach is to use generators. By creating a gen block, we're able to yield items for each iteration. The yield keyword pauses the generator's execution and returns the value to the caller. Notice that this code is extremely concise, very readable, and is just as efficient as the manual approach we mentioned earlier. Now, it's important to note that in the 2024 edition of Rust, the gen keyword will be reserved, but additional work is still required to actually implement generators. That being said, after generator blocks are implemented, the Rust team is already thinking of additional features. For example, supporting async generator blocks and adding the gen function or gen trifunction syntax. In general, I'm very excited that progress is being made on this feature, and I can't wait to try it out in nightly. The second exciting feature mentioned in this blog post is Polonius. Polonius is Rust's next-generation borrow checking algorithm. It's an improved version of the current borrow checker that resolves some common limitations. For example, let's say we have a function which takes a hash map and key as input, and it either returns a mutable reference to the value if the key exists, or inserts a default value and returns a mutable reference to it if the key does not exist. Returning a mutable reference to value in the sum path requires that the mutable reference to map lives until the end of the function. This prevents mutation in the none path, even though the original mutable reference to map isn't used in the none path. The solution is to implement a borrow checker that understands these nuanced cases. Polonius would be smart enough to recognize that this code is memory safe and allow it to compile, meaning we can spend more time coding and less time fighting the borrow checker. The Rust team has the goal of landing Polonius in Nightly in the next six months, and eventually shipping Polonius to stable Rust. This means that in the next six months we get to try Polonius on Nightly Rust, which is extremely exciting. Some awesome additional features planned for the next six months include delivering some critical building block features for async Rust, like support for async closures and send bounds, unblocking Rust adoption in the Linux kernel by stabilizing a number of features, shipping cargo script which would allow you to create


chunk_text:
  inserts a default value and returns a mutable reference to it if the key does not exist. Returning a mutable reference to value in the sum path requires that the mutable reference to map lives until the end of the function. This prevents mutation in the none path, even though the original mutable reference to map isn't used in the none path. The solution is to implement a borrow checker that understands these nuanced cases. Polonius would be smart enough to recognize that this code is memory safe and allow it to compile, meaning we can spend more time coding and less time fighting the borrow checker. The Rust team has the goal of landing Polonius in Nightly in the next six months, and eventually shipping Polonius to stable Rust. This means that in the next six months we get to try Polonius on Nightly Rust, which is extremely exciting. Some awesome additional features planned for the next six months include delivering some critical building block features for async Rust, like support for async closures and send bounds, unblocking Rust adoption in the Linux kernel by stabilizing a number of features, shipping cargo script which would allow you to create a single file with Rust code and embedded dependencies, stabilizing parallel frontend compilation which can improve compile times by up to 20%, reducing syntactic overhead when working with reference counted data, and a few other smaller features. The 2024 edition of Rust is expected to land in Rust version 1.85, which will be released to beta just past the new year on January 3rd, 2025, and will reach stable Rust about a month afterwards. If you need help becoming a Rust developer or are just curious about the opportunities, make sure to get your free Rust training at letsgetrusty.com bootcamp. Hope you've enjoyed the video and remember to stay Rusty.


chunk_text:
  a single file with Rust code and embedded dependencies, stabilizing parallel frontend compilation which can improve compile times by up to 20%, reducing syntactic overhead when working with reference counted data, and a few other smaller features. The 2024 edition of Rust is expected to land in Rust version 1.85, which will be released to beta just past the new year on January 3rd, 2025, and will reach stable Rust about a month afterwards. If you need help becoming a Rust developer or are just curious about the opportunities, make sure to get your free Rust training at letsgetrusty.com bootcamp. Hope you've enjoyed the video and remember to stay Rusty.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=769VqNup21Q", "title": "why rust libraries may never exist.", "description": "Rust libraries may never exist. Sure, I know what you're thinking: sure they do. In cargo. Well... it's not what you think. In this video we talk about why Rust libraries may never actually exist, and what we can do about it. \n\ncrabi PR: https://github.com/rust-lang/rust/pull/105586\n\n\ud83c\udfeb COURSES \ud83c\udfeb Learn to code in C at https://lowlevel.academy\n\ud83d\udcf0 NEWSLETTER \ud83d\udcf0 Sign up for our newsletter at https://mailchi.mp/lowlevel/the-low-down\n\n\ud83d\ude4c SUPPORT THE CHANNEL \ud83d\ude4c Become a Low Level Associate and support the channel at https://youtube.com/c/LowLevelLearning/join\n\n\ud83d\uded2 GREAT BOOKS FOR THE LOWEST LEVEL\ud83d\uded2\nC Programming Language, 2nd Edition: https://amzn.to/3OKh3q2\nC++ Crash Course: A Fast-Paced Introduction: https://amzn.to/3qdZILK\nThe Rust Programming Language, 2nd Edition: https://amzn.to/3MHaS36\n\n\ud83d\udd25\ud83d\udd25\ud83d\udd25 SOCIALS \ud83d\udd25\ud83d\udd25\ud83d\udd25\nLow Level Merch!: https://www.linktr.ee/lowlevellearning\nFollow me on Twitter: https://twitter.com/LowLevelTweets\nFollow me on Twitch: https://twitch.tv/lowlevellearning\nJoin me on Discord!: https://discord.gg/gZhRXDdBYY", "channel_url": "https://www.youtube.com/channel/UC6biysICWOJ-C3P4Tyeggzg", "duration": 446, "channel": "Low Level Learning", "uploader": "Low Level Learning", "upload_date": "20240225" } This text was transcribed using whisper model: large-v2 Rust libraries may never exist, and it's for this exact reason that when you build anything in rust, you need to download like a thousand crates and cargo and spend the next decade of your life compiling your project. Now, the rabbit hole on this one goes deep, so stick around until the end. I'm low-level learning, I make videos on YouTube about programming and software security. Now, Rust is one of my favorite programming languages, I'm a security researcher, and I honestly believe that the features in Rust like the borrow checker and the runtime access checks will usher in a new era of safer software. Every major system in the world is written in the C language, that's the Linux kernel and a bunch of other really foundational software. And while C is extremely fast, the language offers programmers too many opportunities to shoot themselves in the face from a security standpoint. And despite the dozens of skill issue arguments and the dozens of security features that seem to get added to the C language and the C standard libraries on a daily basis, still remains that 70% of security vulnerabilities originate from memory issues in C. But at the same time, I completely acknowledge that Rust isn't the most straightforward language to learn with. The syntax is a little messy and sometimes the compiler gets mad at you. And then the compile time takes forever. So why is that? Why does Rust take forever to


chunk_text:
  so stick around until the end. I'm low-level learning, I make videos on YouTube about programming and software security. Now, Rust is one of my favorite programming languages, I'm a security researcher, and I honestly believe that the features in Rust like the borrow checker and the runtime access checks will usher in a new era of safer software. Every major system in the world is written in the C language, that's the Linux kernel and a bunch of other really foundational software. And while C is extremely fast, the language offers programmers too many opportunities to shoot themselves in the face from a security standpoint. And despite the dozens of skill issue arguments and the dozens of security features that seem to get added to the C language and the C standard libraries on a daily basis, still remains that 70% of security vulnerabilities originate from memory issues in C. But at the same time, I completely acknowledge that Rust isn't the most straightforward language to learn with. The syntax is a little messy and sometimes the compiler gets mad at you. And then the compile time takes forever. So why is that? Why does Rust take forever to compile? And why are the binaries so huge? Now, fortunately, libraries would fix all of this. But unfortunately, Rust libraries don't actually exist and they may never exist. So before you tell me about Cargo and how Cargo creates our libraries, you download and hold your horses. Cargo is a package manager and it does manage libraries. But these libraries aren't the same as libraries in languages like C. Let me explain. Every program you write in C, for example, depends on the GNU C library or libc. Functions that you use in every piece of code like open or read or write or close are already written for you, luckily. And more importantly, they're already compiled for you. libc exists as a shared object, which lives on your file system as a file that your loader can reach into for functions that it needs to run the program at runtime. And the reason the C language is able to do this, and specifically in Linux, is because of the definition of the ELF application binary interface or the ABI defined for the ELF file format that adheres to function calls in a way that are compatible with C. This


chunk_text:
  compile? And why are the binaries so huge? Now, fortunately, libraries would fix all of this. But unfortunately, Rust libraries don't actually exist and they may never exist. So before you tell me about Cargo and how Cargo creates our libraries, you download and hold your horses. Cargo is a package manager and it does manage libraries. But these libraries aren't the same as libraries in languages like C. Let me explain. Every program you write in C, for example, depends on the GNU C library or libc. Functions that you use in every piece of code like open or read or write or close are already written for you, luckily. And more importantly, they're already compiled for you. libc exists as a shared object, which lives on your file system as a file that your loader can reach into for functions that it needs to run the program at runtime. And the reason the C language is able to do this, and specifically in Linux, is because of the definition of the ELF application binary interface or the ABI defined for the ELF file format that adheres to function calls in a way that are compatible with C. This ABI exposes an interface for your program, an ELF, to reach into another ELF and find any function that it needs. The ELF ABI specifies a table of functions or a symbol table that a program can parse specifically to find a function that is exported by that program. And this is exactly how libc exposes function calls. This ABI also guarantees that the data defined in one program is in the same order and in the same location as another. So struct X with elements a, b, and c will always be in that order, a, b, and c. This allows interoperability between not just functions, but data in libraries as well. This is where it starts to get a little crazy. Rust does not at this time have a stable ABI or an application binary interface to share information across multiple binaries. So cargo packages exist, but Rust libraries don't. All the cargo package is is a blob of source that you locally compile and it combines all of that code into one big blob of code inside of a singular ELF. So effectively, anytime you compile a Rust program, you are compiling every cargo package together required


chunk_text:
  ABI exposes an interface for your program, an ELF, to reach into another ELF and find any function that it needs. The ELF ABI specifies a table of functions or a symbol table that a program can parse specifically to find a function that is exported by that program. And this is exactly how libc exposes function calls. This ABI also guarantees that the data defined in one program is in the same order and in the same location as another. So struct X with elements a, b, and c will always be in that order, a, b, and c. This allows interoperability between not just functions, but data in libraries as well. This is where it starts to get a little crazy. Rust does not at this time have a stable ABI or an application binary interface to share information across multiple binaries. So cargo packages exist, but Rust libraries don't. All the cargo package is is a blob of source that you locally compile and it combines all of that code into one big blob of code inside of a singular ELF. So effectively, anytime you compile a Rust program, you are compiling every cargo package together required for that project and smashing them all into a single binary. Hence the high compile times and hence the high binary sizes. So how do we fix this? The answer is not simple. Organizing an ABI for a language and spec like the CELF is pretty simple, mainly because C is just a high level abstraction around assembly. So there isn't too much information to hide, just basic types and function calls. Rust, on the other hand, is a different beast. Structs in Rust really aren't guaranteed to be in any particular order across program boundaries. As long as a and b are in the structure, it's fine. Also, generics create a whole other world of problems because they're statically dispatched and built at compile time, as well as many other complex issues with types in the language. Also, a ton of power in Rust comes from compile time static analyzers that run checks like the borrow checker, which isn't possible if there's a compiled binary. If I pass a mutable reference into a compiled binary, how is it possible for the borrow checker to make sure that the reference is used in a way that is safe? Now, I


chunk_text:
  for that project and smashing them all into a single binary. Hence the high compile times and hence the high binary sizes. So how do we fix this? The answer is not simple. Organizing an ABI for a language and spec like the CELF is pretty simple, mainly because C is just a high level abstraction around assembly. So there isn't too much information to hide, just basic types and function calls. Rust, on the other hand, is a different beast. Structs in Rust really aren't guaranteed to be in any particular order across program boundaries. As long as a and b are in the structure, it's fine. Also, generics create a whole other world of problems because they're statically dispatched and built at compile time, as well as many other complex issues with types in the language. Also, a ton of power in Rust comes from compile time static analyzers that run checks like the borrow checker, which isn't possible if there's a compiled binary. If I pass a mutable reference into a compiled binary, how is it possible for the borrow checker to make sure that the reference is used in a way that is safe? Now, I know what a lot of you are probably thinking. Wait, doesn't Rust have a C ABI explicitly for this reason? So yes, the Rust language does allow you to create types and functions that are exposed using the ELF ABI using the reprC syntax. reprC decorator basically tells the Rust compiler to do what C does, order the structure the way that C would, create symbols the way the C would or the way the ELF would, and create a foreign function interface to call through. So doesn't that kind of solve our problem? No, not really. Using reprC doesn't allow any of the Rust features to cross the application boundary. We can't expose a function with unique types using the exotic typing system that Rust has. And also any function call that crosses the reprC foreign function interface is unsafe and disables the borrow checker. reprC is great for converting Rust code into a C library, but not for creating Rust to Rust binary objects. Now, luckily, I'm not the only one talking about this problem. There are plenty of people much smarter than me that have opened merge requests into the Rust Langmaster to produce their own ABIs.


chunk_text:
  know what a lot of you are probably thinking. Wait, doesn't Rust have a C ABI explicitly for this reason? So yes, the Rust language does allow you to create types and functions that are exposed using the ELF ABI using the reprC syntax. reprC decorator basically tells the Rust compiler to do what C does, order the structure the way that C would, create symbols the way the C would or the way the ELF would, and create a foreign function interface to call through. So doesn't that kind of solve our problem? No, not really. Using reprC doesn't allow any of the Rust features to cross the application boundary. We can't expose a function with unique types using the exotic typing system that Rust has. And also any function call that crosses the reprC foreign function interface is unsafe and disables the borrow checker. reprC is great for converting Rust code into a C library, but not for creating Rust to Rust binary objects. Now, luckily, I'm not the only one talking about this problem. There are plenty of people much smarter than me that have opened merge requests into the Rust Langmaster to produce their own ABIs. Now, this problem will require the entire Rust community to get on board probably with one ABI that is the most feature complete and makes the most sense before we can make meaningful progress. You can go check out this pull request. I'll put the link in the description below by Joss Triplett, which exposes the feature for an experimental feature gate to create a new API called Crabby or Crab API, which is pretty funny. The motivation here is today developers building projects incorporating multiple languages or calling a library written in one language from another often have to use the C ABI, and that's reprC from before, as the lowest common denominator for cross-language function calls. As a result, such cross-language calls use unsafe C representations, again, reprC, even for types that both languages understand. For example, passing an instance from Rust to another high-level language will typically use the unsafe C care star even if both languages have safe types for counted UTF-8 strings. And like I said before, also furthermore, higher-level data types such as Option and Rust currently require translations into C ABI compatible types, which discourages the use of such types in cross-language interfaces.


chunk_text:
  Now, this problem will require the entire Rust community to get on board probably with one ABI that is the most feature complete and makes the most sense before we can make meaningful progress. You can go check out this pull request. I'll put the link in the description below by Joss Triplett, which exposes the feature for an experimental feature gate to create a new API called Crabby or Crab API, which is pretty funny. The motivation here is today developers building projects incorporating multiple languages or calling a library written in one language from another often have to use the C ABI, and that's reprC from before, as the lowest common denominator for cross-language function calls. As a result, such cross-language calls use unsafe C representations, again, reprC, even for types that both languages understand. For example, passing an instance from Rust to another high-level language will typically use the unsafe C care star even if both languages have safe types for counted UTF-8 strings. And like I said before, also furthermore, higher-level data types such as Option and Rust currently require translations into C ABI compatible types, which discourages the use of such types in cross-language interfaces. Again, we don't have a way of communicating a generic type in Option T or Result TE. So go check out this pull request. I think it's pretty interesting. The entire world of ABIs and how to make systems more interoperable is really interesting to me. Now, let me know what you think down in the comments. Will Rust libraries ever exist? Will shared objects rule the world? And will Rust always compile into these gigantic amorphous monoliths? If you like this video, do me a favor, hit like, hit subscribe, and then go check out this other video about an internet enabled. I'm not going to say it, but you'll see.


chunk_text:
  Again, we don't have a way of communicating a generic type in Option T or Result TE. So go check out this pull request. I think it's pretty interesting. The entire world of ABIs and how to make systems more interoperable is really interesting to me. Now, let me know what you think down in the comments. Will Rust libraries ever exist? Will shared objects rule the world? And will Rust always compile into these gigantic amorphous monoliths? If you like this video, do me a favor, hit like, hit subscribe, and then go check out this other video about an internet enabled. I'm not going to say it, but you'll see.


chunk_text:
  { "webpage_url": "https://www.youtube.com/watch?v=ihtAijebU-M", "title": "new attack leaks secrets using RAM as a radio", "description": "The RAMBO Attack on RAM is truly amazing. Some of the best research I've seen.\n\nhttps://www.covertchannels.com/\nhttps://arxiv.org/pdf/2409.02292\nhttps://www.wired.com/story/air-gap-researcher-mordechai-guri/\n\nhttps://youtu.be/CjpEZ2LAazM\nhttps://youtu.be/-D1gf3omRnw\n\n\ud83c\udfeb COURSES \ud83c\udfeb Learn to code in C at https://lowlevel.academy\n\n\ud83d\uded2 GREAT BOOKS FOR THE LOWEST LEVEL\ud83d\uded2\nBlue Fox: Arm Assembly Internals and Reverse Engineering: https://amzn.to/4394t87\nPractical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation : https://amzn.to/3C1z4sk\nPractical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software : https://amzn.to/3C1daFy\nThe Ghidra Book: The Definitive Guide: https://amzn.to/3WC2Vkg\n\n\ud83d\udd25 SOCIALS \ud83d\udd25\nCome hang out at https://lowlevel.tv", "channel_url": "https://www.youtube.com/channel/UC6biysICWOJ-C3P4Tyeggzg", "duration": 481, "channel": "Low Level Learning", "uploader": "Low Level Learning", "upload_date": "20240911" } This text was transcribed using whisper model: small.en Can you hear RAM? Honest question. Are you able to hear the noises that your memory makes when you put data into the memory and take data out? Now, I thought the answer was no, but a researcher recently found a way that you can listen to the electrical signals that your RAM makes and use that to covertly extract data out of a computer. In this video, we're talking about the Rambo attack, a new attack that is truly insane. They're using electrical signals that are created by the RAM to sneak data out of a network that they don't have direct access to. Let's talk about it right now. Before we do, if you're new here, hi, my name is Ed. This is a level learning channel where I talk about cybersecurity, software security, a bunch of other cool stuff. If you like that stuff or just want to hang out, hit that sub button. This technique is called the Rambo attack radiation for air gapped memory bus for offense. Kind of a acronym, I think they probably chose Rambo and then decided to call it this. But basically this research is put out by this guy named Dr. Mordechai Gury. If I'm butchering your name, man, I'm so sorry. This guy is a world-class gray beard giga-chat hacker that runs this website here called covertchannels.com. He actually runs an entire research lab that does exclusively research on jumping air gaps. If you don't know what an air gap is, imagine you have a network where you do really sensitive research, like maybe you're Riot Games and you're working on your MMO and you refuse to let anyone know how little work you've done so far. So


