one more year till I address all of my
fears it's not too late
[Music]
[Applause]
[Music]
[Applause]
[Music]
[Applause]
[Music]
wasting my days on people who just don't
care too hard on myself I had to learn
to be fair
I ain't got rules
[Music]
[Applause]
[Music]
no no faker
[Music]
oh yeah yeah
[Music]
it shines in RGB and it's full of blood
I don't know what is wrong with me I'm
scared pissed off and lonely I have
trouble speaking to women
state that I'm
in the Twitter feeds life in the brain
because I have it on dark mode memorize
everything she says so I can use it to
get her passcode she's Beauty she's
great oh no that's okay
try and get more sponsors
try
to sleep
why don't you care
past ten years
[Music]
look no one must sound insane
that's part of the package if she can't
handle me and my words you don't deserve
my mental package I only want six to
four
to wash their eyes shall be your answer
why does she run
monthly giving her fifty percent of my
income
action based around artificial infection
[Music]
fun go together we sleep on clothes
together
[Music]
we sleep together
[Music]
all together
[Music]
foreign
[Applause]
[Music]
[Applause]
[Music]
obviously
[Music]
thinking that good old sound is ringing
they don't know what they're missing
[Music]
so it's time to get up and let go
okay
[Music]
baby
[Music]
thank you
[Music]
friends
hello
how are y'all doing today
all right
um happy uh Bastille Day to all who
observe
uh welcome to Summer con
uh 2023 day one
somehow this will do its thing
yeah yeah everybody should you know come
in and like get ready to get get Summer
con
yes
it's like being conned only
you know in the summertime
um
I was assured this was working
and as
as many people know
um I'm not good at computers
none of us are in the org here I don't
know you tell me I don't I just work
here two
oh yeah so uh we this is fine for tap
dancing purposes because uh we need two
minutes
but yeah okay make it negative I don't
know
plug it I don't know
if you try turning it off and on again
team
I too I'm sore searching
searching
try this side it was working I believe
you
[Music]
it's great to see you guys here
oh
yeah
here you go
doing it
all right
uh hiring you'll tell me when we're
ready right
oh we're good we can go okay great so uh
thank you one and all uh John Wayne come
on out
um we're gonna get started
um we are we do have a live stream
um Hiram and the uh the video crew is
doing a great job of getting the video
out there on the you know the internet
so that people can see this they
couldn't come
um Anything could happen with the stream
we've had the stream had some problems
in the past particularly because of the
YouTube AI being really really quick to
say like I think I heard a song in the
background that isn't cleared for
streaming so like we have to shut down
whatever
a lot
I recommend that if you decide to sing a
Disney show tune sing it out of key as
much as possible okay that's how you you
know that's how you get them
all right uh so thank you uh for rolling
with the punches all right
um I am
um required by law okay not by law but I
am required as a part of our Charter as
a charitable Foundation to remind
everybody to
be nice to not be jerks to like you know
to this is a community where we're a
family there are actually many of my
family members here
um be nice you know um
we have a posted code of conduct on the
website and I encourage you to look at
it don't
harass anyone
in any way shape or form if you do
we reserve the right to eject You
Without Pity or remorse like Terminators
um
no refund either I've you know that's
that's the twisting of the knife there a
little bit
um if you if you are being harassed if
you witness harassment if you are if you
just feel like generally unsafe whatever
members of the team in the red shirts
members of the bar staff you can reach
out to any of them if you do not feel
comfortable reaching out to somebody
directly there is a phone number
720
-586 hack
586 of course is the Pentium so you can
remember that
all right so uh let's talk about the
money um and for that conversation about
money
um our financial director executive
Financial director John Terrell
so it's been a tradition for summer con
that we try to be as in maximally
transparent word uh so a lot a lot of
conferences don't show off what's
actually going on with money A lot of
times it goes into people's pockets
that's not going on here uh in fact in
in some past years it's more money
coming out of our pockets
um
okay so basics of the income is
essentially both tickets and sponsorship
uh expenses are what we spend
so that's going to be the venue that's
going to be food and drink that's happy
hours uh the the difference is what our
profit is called that's not actually
profit that just goes back into the fund
uh and the endowment is what's actually
kind of left over
all right so
for this year we came in a bit short in
previous years we've done a lot better
for this year we came in at 22.5
so our our attendee uh tickets were at
twenty six thousand
sorry
um and our total was 48.5
um
yes sorry
okay it's much easier for me to walk
around with this thing all right so
these sponsorships came in at 22.5 the
attendees were at 26. this represents
the ticket sales so at 48.5 that's the
total amount of Revenue that came in
unfortunately and I'll skip this
that meant that with our expenses though
coming out at 54 250. we actually came
in short of about like 7 500.
so we did have an extra Platinum sponsor
they pulled out three days ago
that's 7 500 so that's what that
shortfall is
so that's the gist of it
uh this is what the breakdown on what we
spend is
so as you can see here it's pretty
transparent to break down the bulk of it
this year was on travel
and putting people up in a hotel
so
the t-shirts are also pretty expensive
so please enjoy them
um and what is this ah so this is 5750
is our total deficit
um we're expecting for next year we
would like to be able to fix that that
means more more sponsorships and if we
don't have more sponsorships that means
you all have to pay more
so we don't want to have to do that
um
and this is showing that we are back
into a loss
so we want that to be going up
I like when the market goes up so the
the endowment health is at about 166
grand for full transparency there's
roughly 200 in it right now
that means we haven't paid our bills yet
so we're planning to do a bit more with
it but we don't want to have drawdowns
and we are a 50c a 501c3 so we are
technically federally not supposed to be
paying taxes
and uh I will pass back to Mark about
our sponsors
thanks John appreciate that all right so
uh you you did hear that we need money
to make this run and you this year were
the strongest component of the money so
thank you to all of the attendees you
are all sponsoring it in your small way
but the people who uh put up corporate
funds include our research sponsor trail
of bits we thank them
our Platinum sponsor our Traders
partners
our gold sponsors red balloon security
and mongodb
and our silver sponsors data theorem
Flatiron and thanks to Canary things
Canary is like in South Africa and they
are never here and they can never ship
us anything and they can never like do
anything and they always just give us
money and I'm concerned that it's like a
money laundering operation so I don't
know what's what's up with that that
they just haven't but they do have a
great product in fact I would be remiss
if I did not uh tell everyone
that the sponsors of summercon provide
remarkedly better products and services
than people who do not sponsor summer
cons so I urge you to uh to to to buy
their services uh the thinks QR code is
going to be up uh more later but you
know this would be a good time to scan
it if you wanted to get a surprise from
them I just love blindly scanning QR
codes I don't know about you all right
so
let's bring it home
I do want to give thanks to uh our our
entire organizing team including Dawn
and the production team uh you guys you
guys did it you got us here somehow
there were moments where I was nervous
but um we we did it we got it there I
also want to thank Littlefield who
somehow um is uh
comfortable enough with the chaos that
we bring uh each year so thank you to
Littlefield for continuing to have us
here
um the video team Hiram and his guys uh
who um a cannery Collective who are
keeping us on the air thank you I do not
understand how the internet works but um
but but it is allegedly very complicated
and those guys know what to do
um our amazing and Brilliant speakers I
think we do have an outstanding lineup
this year I'm very excited uh by all of
it uh Emily who is somewhere around who
uh in addition to wrangling
[Music]
she's over there somewhere I've recently
got eye surgery so I can't see anything
anymore it's a whole like you know deal
I'd recommend it to everybody
um Emily uh in addition of wrangling
sponsors actually he's even presenting
for a few minutes in this conference
this year so we're very excited about
that uh Zach
who is uh unable to attend this year but
he has always kept us grounded and calm
through the the Maelstrom of running
this thing
um and uh Barbara Tracy Dave Jimbo all
the volunteers if you if you see
somebody in a red shirt with the White
Stripes consider uh buying them a drink
very important our bartenders let's not
forget to tip your bartender it is the
summer con moto motto
um I I wanted to before I um I I go I
wanted to also remember our friend Kelly
who
ran the volunteer side of the business
and is no longer with us and we're very
sad about that but
um I'm sure she would be very excited to
see you all here and occasionally scream
to shut up to people as they talk too
much in the back in the bar area so
remember her when it gets a little loud
and shut up uh
and of course you this this event is for
the attendees
um and we are delighted that you're here
so thank you you should give your
yourselves all a round of applause thank
you for being here
all right so with that
it is time
to
get our get ready for our next speaker
who probably needs to be
um uh do some tech work to get the thing
going so
uh get ready to dive into the world of
gaming and hacking
our first speaker is Dan alt for Petro
by day he's a security engineer at
Bishop Fox but by by night
he becomes the mad scientist of the
melee world
uh Dan is here to share the thrilling
story of how he hacked the GameCube to
beat professional melee players at Smash
Bros for charity he'll take us through
the technical details of gaining
arbitrary code execution exfiltrating
data and the custom build Hardware
involved so grab your controllers
and get ready for an unforgettable
journey into the realm of hacking and
gaming again
so my abstract did say to bring your
controller did anyone bring a controller
well I got a couple
that's cool uh yeah they already plug
into
cool
so the way this is going to work is
we're gonna
see
to restart this probably
you can almost hear the GameCube booting
up can't you
alas you can't literally hear it booting
up since the HDMI does not hook up to
the speaker system
and Works cool
all right so the way this is gonna work
is uh we're going to start with the demo
um somebody
is going to come up and play
who wants to play
if there was anybody that brought their
own controller then they were definitely
going to get to go first
I uh alas I was trying to uh
I came down there or something
[Laughter]
uh the yeah you pick any character and
smash ball will pick the stage for you
I'm just going to kind of commentate as
this is going on we'll go on for about
like 10 minutes or so and then we'll get
to a proper presentation and
um well I'll kind of do another section
at the end here where people can uh play
whatever so just hit start and it'll
pick the stage
cool so uh Hey everybody Welcome to uh
summer con glad to get to go first here
this is smashbot this is a project that
I've been working on for a really long
time it's been sort of a passion project
of mine I'm a super old school uh melee
player
um from like the back when the game
first came out
um the I'll sort of talk about uh like
what is happening uh like on the screen
here so smashbot as you can probably
tell is the fox player
um and uh it is a AI that I built for
the game that kind of came out of a
series of conversations with some like
really old players
um like from way back in the day we're
like What if you could remove the human
element to the game what if you could
play the game as fast as possible Right
without having to worry about all the
like Tech skill stuff like how good
could you make an AI at the game and a
friend of mine once said like like nah I
just don't think that you could like
make an AI that'd be very good at it
like it requires too many like high
level too much high level thinking too
much strategy I thought well the
challenge accepted yeah
go and give it another one
[Applause]
unfortunately the projector does lag a
lot
um so that is a hinders you gotta hit
the start button
um I was originally trying to get a CRT
um here on stage like the original TVs
that you would play melee on but uh alas
they do not fit in the overhead
compartment of an airplane
um and a sourcing one locally turned out
to be hard too so uh the projector will
have to do
so
um some of the things that you'll notice
that oh this is gonna be good this is
what's called the infinite wave shine
combo uh so uh fox has this move called
shine it's his downbeat attack and he
can it's a one frame move so it the
attack comes out the very frame you
press it and the opponent uh slides when
they get hit by it and then Fox can
cancel his attack and wave Dash along
the path that you're getting hit and
just sort of get you caught in this
infinite wave shine combo or what did we
lose feet oh what happened that was
weird we sort of lost the feed for a
moment
and oh you're not quite stuck in the
blender yet
there's the blender
um strictly speaking it is possible to
get out of it if you smash the eye
basically if you hit the control stick
on the very frame that you get out uh do
you get hit by the attack but you don't
have to either president not just once
but in fact three times I'm in the span
of three frames so you have to hit it
and then within a 60th of a second
unpress the joystick and then press it
back in and then do that three times in
a row
um
so um one of the things you might be
noticing here that this is playing on a
GameCube like an actual literal GameCube
um which you uh might notice uh has a
whole bunch of uh electronics hooked up
to it that is probably not very friendly
with the humidity of New York City
um so uh we're gonna get to that in a
minute
cool so now for the our next bit we're
going to take a second volunteer or
maybe two different volunteers
2V1 versus the Box
uh two people
surely we've got to have somebody who's
not too embarrassed to get destroyed by
a bot playing 2V1
yeah come on down
come on down
there you go
I'm just glad that this is working
[Laughter]
go and pick the state pick your
character and then just hit start and
smash bottle pick a random stage for you
it is really laggy I'm very sorry about
that
all right
so this is going to be a lot more chaos
um as there's a lot just more going on
on the screen smashbot is a has a clever
trick to play 2V1 so it actually only
sees one person at a time
um it's only capable of like fighting
1v1 but I came up with a clever hack to
make it fight a two and three V one
which is just two uh only consider the
closest enemy as existing and the other
person is just sort of invisible
um but it just switches back and forth
so fast that it's like hard to even
notice we're going to get into a little
bit later on like how smashbot works and
both in terms of attack like the whole
journey of making this work but also
sort of like what it's thinking how it's
programmed and stuff like that
cool so you might have um realized that
like you know this is all well and good
and you've sort of seen this before but
maybe you haven't seen this before I'm
going to press a button on my laptop
right now
and this happens
so um one of the things that's going to
be coming up that will describe it a bit
is that uh the there's a uh speed
running competition coming up soon
called the esa where this is going to be
taking place and people are going to be
donating live it's a it's like charity
speedrun Marathon
um for the Alzheimer's Foundation which
is a
charity that means a lot to me that uh
where people are going to be donating
money so they can spawn items like this
um in the game and also like this
a bunch of Bob bombs
there we go
cool thanks a lot
cool I'm gonna switch over to
representation we'll come back to this
at the end if anybody wants
where is
really hard
it's on the other side of my laptop
cool
yeah go and take photos
that's fine oh there we go I need to
switch to
oh that it really does lag
displays
apply
yes
very good all right so one of the things
you should know about me is that I hate
slides
um uh don't worry does that say 139
slides don't worry about it
on console how
so already I want to congratulate all of
you for accomplishing something that no
melee player has ever done before which
is to wake up before noon for an event
[Applause]
so as I was mentioning on smashbot is
going to be uh showcased at the esa
coming up here and uh that's not right
the esa the esa
that's still not the right one uh nope
nope nope no no no no no that's the one
the European speedrunning assembly
um that uh the European sepsis Alliance
is my favorite um these the esa a great
speedrunning organization are really bad
at SEO though
um so this is all running on a Nintendo
GameCube hooked up to the Internet you
might be wondering how on Earth that's
even possible the Nintendo GameCube came
out in 2001 of making it I guess pretty
ancient at this point there may be
audience members that are younger than
this GameCube here
and it has no networking connectivity so
making this all like you know hook up to
the Internet making this work from my
laptop
um it took some doing it was sort of a
passion project of mine for a few years
now I've been working on it more or less
since covid smash mode I've been working
on since like 2015 or 16 or something
but um specifically making it work on
Console
um kind of like since covid locked up
and figured this would be a fun thing to
do so there's an asterisk next to the um
a no network connectivity um thing here
oh actually as a quick aside this is a
small enough crowd where if you have any
questions comments insults or abuse just
kind of yell them out it's probably fine
if you're gonna throw anything just
don't throw them in this area
uh so uh the asterisks is because
technically this exists
um this absolute Abomination is an
official Nintendo product uh that uh was
made for the game Fantasy Star online so
it's like a legit GameCube controller um
with a full query keyboard in the middle
of it
um and on the right there you actually
notice there's a a network adapter
there's like a RJ45 Jack plugin right
into the GameCube
um the problem with it is that it sucks
uh that uh for reasons we'll describe a
little bit later a performance is
actually kind of important in order to
like turn around things and sort of into
the the frame timings uh and uh the
performance of this is just absolutely
miserable it was it sucked even when it
like existed
um uh the other reason that I didn't go
this route uh was because of this
um these are hard to get these days and
I love you all but I don't love you that
much
um so instead uh there's another option
there is the Nintendo Wii so you see the
Wii can play GameCube games but the Wii
uh has this like fun backwards
compatibility thing where it's not
backwards compatible backwards
compatible per se it doesn't have like a
compatibility layer or whatever it
literally just contains a mini GameCube
they just said it and just like how
to completely separate processor inside
of the Nintendo Wii Just for playing
GameCube games like that's kind of
intense that's really good so if you
ever wondered why like the Wii like
plays gamecube8s really well you're like
wow it like this is a great
compatibility layer emulation or
something that's not how it works it's
not emulation it's just it's actually
just two in one
and this does have networking so maybe
that's an option however you might see
where this is going it sucks
um uh I actually uh went this route so
there's just massive Network latency
through the built-in uh both the Wi-Fi
which is just absolutely unusable and
you can plug into USB ethernet adapter
um if there's any um uh enterprising
members of the audience that really feel
like rewriting the networking stack
inside of the Wii's proprietary kernel
that would be awesome uh but I did not
do that
um I actually got the entire thing
working in air quotes on the Nintendo
Wii using this method and had to throw
the entire thing out because like the
network latency was just massive there's
like 30 to 40 milliseconds of latency
per sys call in the networking kernel on
the Wii it's just miserable
it's not even obviously doing it I don't
know what it's doing
so back to the Nintendo GameCube
we're going to need to get code
execution on this thing uh and uh it was
not entirely clear off the beginning how
to do that so let's explore arbitrary
code execution on the Nintendo GameCube
we're going through this through melee
so we do actually have to be running the
game Super Smash Brothers Melee for the
Nintendo GameCube on the GameCube at the
time we did a code execution so let's
talk about melee glitches now melee has
a ton of glitches not by like cyberpunk
2077 levels of glitches but like you
know for the time anyway like a lot of
glitches
uh there's a couple here that are of
potential interest the first is the Home
Run contest so melee has this uh like
mini game where you can beat up this
little sandbag guy and then hit him with
a baseball bat neck flies off the stage
and that's you know cool when it
measures how far you can hit it and you
can like compare scores with your
friends or whatever
um the thing about this is that the
developers didn't anticipate uh melee
players getting as good as they did and
hitting the the bat or hitting the bag
as far as they do and so they uh
programmed it so that after about like I
think it's ten thousand feet uh the
stage just ends
and if a sandbag goes off the stage it
just Falls like off of a like level goes
down into Oblivion and just crashes the
game so uh this starts to sound like a
thing or like okay we can crash the game
and like we can kind of do it on purpose
but there's not really any input we're
like if we're trying to like shove Shell
Code into this like what would our
inputs even be so I this is it's
possible it's feasible
um that we could use this but I think
it's unlikely
the next up in terms of uh possible
in-game glitches is the black hole
glitch
um this is describing the exact
parameters of how to do this is not
important and also really complicated
but involves like throwing a bunch of
turnips from Peach all together at each
other and then reflecting them with like
Fox and they kind of get stuck into this
black hole and every item that you throw
into it just gets also stuck into it
um and it just eventually grinds the
game to a halt and crashes so this has
the Hallmarks of an exploitable memory
corruption vulnerability it's got too
many of a thing you do have some
selection into what you can put into
that thing and it's largely unexplored
in terms of its potential for uh code
execution
so if there's again any enterprising
members of the audience that would like
to improve upon the exploits that we
will go through here this one would I
would consider to be an improvement on
the method I went through because it
would be entirely through the controller
Port of the game that you could get code
execution which is pretty cool but
that's not what we went with
so there's name entry
so melee allows you to insert a like a
name tag for yourself like a four
character string to like represent you
and it tracks your stats and stuff and
obviously if you're a teenager and
you're offered to give a four-letter
word to represent yourself hilarity
ensues
um but that's not what we're doing here
at least
in addition to the normal polarity
um they're uh when the the game copies
these uh name tags into like from the
memory card into into memory it just
does a straight up string copy
um so it just takes the name tag and
just yellows it right into memory
um like there is there's no bounds
checking whatsoever this is on the stack
and this is a 2001 console there is no
aslr there is no data execution
prevention this is just like baby's
first exploit it's just like the easiest
stack based buffer overflow you've ever
overflowed
um there's just one problem with this
process and that's at the front end
enforces this limit so if you try to go
into the game and like input a fifth
letter it just won't let you because
like why wouldn't right like so
this like presents a logistical problem
of how to actually like put in a long
enough string how to actually put that
in so we have a side quest
because there is a memory card attached
to the GameCube the memory card stores
these name tags right so you can pull
that memory card and hold it in your
hand that's where the string goes
so our side quest
is to write arbitrary contents to a
memory a GameCube memory card
this isn't as easy as you might think
because the GameCube has like a memory
management mode or whatever but you
can't just write arbitrary bytes to it
with that thing all it does is let you
like save and back up and move files
from one GameCube card to another one
it's very opaque we can't write
arbitrary contents to the memory the
GameCube memory card that way
so in order to exploit the Nintendo
GameCube we first have to exploit a
Nintendo Wii
um so this part is uh pretty well
trodden this is more or less the process
for getting Homebrew up and running on a
Nintendo Wii uh the so I had nothing to
do with the creation of any of these
exploits but we'll just kind of go
through it for of the sake of it since
it's fun
um and is also necessary for this whole
thing
um so the Nintendo Wii has a Eula
program
um so the as all legal as all legal the
best legal agreements I have um it has
just a quick accept button that has no
record of you ever like actually signing
anything
um but uh this is actually not just an
application it is a web browser it just
runs in Opera and loads uh remote
content from this URL uh so you there's
a there's a um uh like the x's and the
Y's are your country code and language
code you can actually visit it right now
if you wanted to
um you'll also notice that this is over
HTTP this is not https again oh this is
a even the Wii is like pretty old by
this point
so we can go into the DNS settings of
our Wii and change it to whatever we
want to reroute the uh the website to
whatever we want so now instead of the
Nintendo Wii visiting our remote like
ulo website where it's going to like
have the contents and you hit the OK
button we can redirect it to whatever
website we want
okay so now at this point we're running
arbitrary malicious JavaScript in the
Opera browser running in the Nintendo
Wii but that's still not good enough
right we actually need to get code
execution on the Wii itself so we have
to break out of the sandbox of Opera to
do that we have to use CV 20090689 which
is well beyond the scope of this
conversation to go into the details of
is actually a low-level C library
exploit it's not specific to opera or
the Nintendo Wii it was a big deal back
in the time it's like something
something floating point conversion I
it's not important but what is important
is you can do it from JavaScript because
you can do a whole bunch of like
floating Point operations in the
JavaScript and then get cause a heap
overflow in the Opera browser which like
lol has no memory protections and then
gain code execution through that
so what do you do if a genie grants you
one wish you of course wish for more
wishes
so now we're running arbitrary code on
the Nintendo Wii and we load The
Homebrew Channel onto our Nintendo Wii
so the Wii comes up in the age of like
the iPhone where like everything had to
be an app and even like really looks
like iPhone apps
um so what we do is we load up this
Homebrew Channel they call them channels
because probably for legal reasons they
can call them apps
um where uh this is just like a Play
Store app like a custom Play Store app
so it's an app that lets you like run
new apps
so from this app we're going to load the
Wii GameCube memory card manager this
lets you copy contents from an SD card
into a GameCube memory card now we're
talking because the Wii has an SD card
slot I'm pointing down here as I've as
if I had a Wii but there isn't one
there's a the SD cards it's behind this
little door
um has like SD cards capability I'm not
sure what the Wii even does with SD
cards come to think of it I've only ever
used it for exporting the game View
so it's important that the Wii can have
both an SD card and a mem card plugged
into it at the same time because of
course the Wii can play GameCube games
and natively too so wrapping this all up
we have a GCI file GCI file is just the
like GameCube image it's like GameCube
save file
running up onto your laptop
load that up onto an SD card place that
SD card into your Nintendo Wii
place the GameCube memory card into the
Nintendo Wii
use the Homebrew app to copy the GCI
file onto the SD card and then onto your
GameCube memory card
and then plug that GameCube memory card
into your Nintendo GameCube
thus completing our side quest to write
arbitrary contents to a GameCube memory
card
[Applause]
thus giving us a second side quest to
develop a GCI payload so we still
haven't actually figured out what the
hell to put onto this GCI file we can
load an arbitrary GCI file onto our
GameCube memory card it's the um the one
with the red flashy light is my uh that
you see there is my custom GCI
so let's talk about the basic
construction of the exploit at first
there's a four characters that is our
name tag
then there's a bunch of padding uh this
just kind of doesn't matter you have to
blow past a bunch of random nonsense
then there's just a jump uh this is
where you're going to LEAP to jump to
the rest of the payload um it's not the
EIP this is all in powerpc assembly by
the way I'll mention later
um a PPC is basically a dead
architecture at this point unless you're
like Melee modding um or for whatever
reason you're trying to exploit a really
old Mac before they went to Intel
um and then you just have to stick your
shell code in here and that's really it
like I did say this was like baby's
first exploit right
this is all of course within the
constructs of a GCI file so there's
still some trappings of like the actual
file structure because the the GameCube
will expect this to be a valid uh
GameCube save file and so it has to have
the right hashes here and there and it's
got to have the right structure or
whatever so it's got to have all this
stuff inside of that
luckily a lot of the work for that was
done by a great melee hacker called Dan
salvato who wrote this melee GCI
compiler that does a lot of this
structure for you to build the GCI file
you give it some gecko codes um gecko
codes are this fun thing so most of the
melee Community doesn't like we're doing
modding and stuff we don't actually
write arbitrary assembly per se the
assembly is packaged up into this format
called the gecko code
um it's a useful in modding since uh the
gecko codes can run like once per frame
not just all at one shot off the
beginning of the exploit so there's like
a gecko code Handler then uh that is
like a little piece of code that
basically is an injected interpreter in
the game that can interpret gecko codes
so this will take gecko codes which is
for our purposes basically just PPC
assembly stick it into our uh uh our
shell code area right into the GCI but
run it into the um exploit the name tag
exploit now I know what you're thinking
you're thinking wait a minute Dan
salvato isn't that the guy who made Doki
Doki literature club and the answer is
yes that's the same dude
uh the melee Community knows no bounds
all right so as I was mentioning uh the
the GameCube is running on a power PC
which is like pretty dead at this point
so that's already kind of a hindrance
but what actual code are we trying to
run so we have an exploit we can run
arbitrary gecko codes or you know
assembly basically but what do we want
to do with that superpower to like run
smashbot
so let's take a bird's eye view and look
at it from a one higher level so over
here we've got the Nintendo GameCube and
over here we've got smashbot running on
a laptop what we need is to Output the
game state from the Nintendo GameCube to
the laptop so we need to gather up all
the information about what's going on in
the game so smashbot doesn't see the
game visually I was in like with pixels
with the way that we do
um it's going to like get the game State
information so we need to know what
stage we're playing on with the X Y
coordinates of each of the players like
what character they're playing uh what
animation they're in what frame of the
animation they're in all that stuff
every possible bit of information that's
on the screen but just in a digital
format right
so for that
um okay also we need to do this on each
frame so this happens
um the game runs at 60 hertz so that's
uh each frame runs at around 16.6
milliseconds and so uh it's a tight-ish
timing requirement
um when I very first wrote smashbot I
wrote it in C plus plus partly because I
was familiar with C plus plus
um and I was also had this like
misguided notion in my head that 16
milliseconds was this like really tight
timing requirement and we had to be
super fast
um and uh turns out that 60 milliseconds
is an eternity for a computer
um and I would later wind up rewriting
the entire thing in Python and the
python version actually runs faster
um so uh it is true that in theory C
plus plus is faster than python but
you're a shitty programmer and uh
so am I and so uh the python uh is a lot
harder to up
it's not impossible but it's harder
so that is um part of the the reason
that like the things do have to happen
in a reasonable Pace we can't take
forever for like each step of the way
because the game is going to send us on
this Frame and then we have to respond
within 16 milliseconds uh like the
button presses basically have to get to
the game in that time otherwise uh like
nothing works um if the button presses
come in late uh smashbot just kind of
fails miserably
um since a lot of what it's doing is
writing on a knife's edge of timing
where it's like going to wait till the
very last moment to do something because
it's strictly optimal to do it that way
and if we're late by even a single frame
a 60th of a second then like
the bot just blows up and like Yates
itself off stage
so now it's time to talk about project
slippy so project slippy is this a great
project run by a guy named fizzy who
actually lives here in Brooklyn and is
actually not in the audience because
he's out of town this week
um so that really sucks he was
definitely going to be here
um but uh project slippy um if you're
familiar with Mela you might know it as
this thing that gave melee a rollback
net code and the ability to play online
um like automatic matchmaking gets like
this fantastic system
now this all runs inside of an emulator
all the like rollback net code stuff
um but at the heart of uh project slippy
is a replay system so I've actually been
involved with project slippy for God
like like five six years or something
like that now maybe
um if you go to slippy.gg about you see
my face grinning's like an idiot I
occasionally do um cheating
investigations as well since I you know
like uh hacker guy I mean post stuff to
YouTube to shame people for cheating
online
um so one of the core technologies that
makes slippy work as a melee mod is this
replay system so he was sort of thought
of that it's really sad that all these
old games of melee that used to be
played in tournament uh kind of got lost
to time maybe there's some old grainy
VHS tape of them I actually had some VHS
tapes from tournaments
um that predate YouTube uh since uh me
and a friend of mine used to run like
most of the melee events out in Phoenix
for like a lot of years
um but uh project slippy does a lot of
this work for us so what it does is it
takes a lot of the game State the things
that are happening in the game as well
as all the buttons that everyone's
pressed and outputs them to a slippy
file dot SLP file this is just a very
brief uh screenshot of some of the data
that's contained inside of one of these
um slippy files
so one of the other things that
prod terminism so we're for a replay to
work the game has to be deterministic so
that means that every time you press the
same buttons in the exact same sequence
given the same startup the game has to
behave exactly the same way
unfortunately melee it is not set up for
this out of the box I'm going to give
you just one example of the of this
there's dozens of these so um one of
these is the Luigi Cyclone so Luigi when
he presses his down B in the air uh like
down B attack it's called the Luigi
Cyclone I don't know he spins around uh
can either go up or down depending on
whether the attack is charged or
uncharged um it's kind of like supposed
to be used as a recovery move to like
help you get back onto the stage so um
if you could just keep on going upwards
over and over again you could kind of
just fly indefinitely and that would be
stupid so the developers thought of that
and they figured so you have to do it
once on the ground and then that's
considered charged it has a little State
variable that keeps track of whether the
Luigi Cyclone is charged or uncharged
and if it's uncharged and you just fall
like a rock
problem is that this starts out
uninitialized
so when you first boot up a game on
whether Luigi is going to go up or down
when you do this is dependent on like
just random arbitrary memory contents
has in practice has much to do with like
the order you pressed things in the menu
leading up to the game it's awful
it's one of the things that project
slope we had to do was to modify the
code in the game to fix this bug to
initialize the memory before loading it
um that way like the game has a
consistent starting point and there's
just like dozens and dozens of instances
like this
the question was are all those instances
based off of uninitialized memory um the
answer is no there's some things that
are like uh there's one really recent
uh-ish instance of like the Fox's tail
moves in a random like way it just kind
of like Flaps in the breeze but um for
whatever reason it doesn't use the
in-games RNG so the game has this like
in-game random number generation
function that isn't like managed within
project slippy so it's random but it's
like just a pseudo random number
generator and so it's stateful and so
the random number generator behaves the
same way every time but for whatever
reason it was just like using some other
like RNG system and we just
yeah it was just like yoloing something
um and uh it's very very subtle because
like it almost never matters and like
the exact position of Fox's tail but
every once in a blue moon like Fox's
tale is actually part of his hitbox like
you can hit him on his tail so it's the
exact position of a tail sometimes
matters and can cause a desync if it
like hits on one person's screen and not
the other and uh these things took
forever to iron out
so importantly this replay file is more
or less the game state that smashbot
wants um in practice there was a few
things that I had to add into this
um ecbs were one of them environmental
Collision boxes basically a little box
that like denotes where your character
can touch the stage as well as a menu
support was not there so I had to add
support for menus in order for um
smashbot to be able to pick its own
character and select the stage and all
that stuff I had to add support for the
stages by uh default slippy only does
the game State information for when
you're in a game itself
so
this completes our side quest develop a
GCI payload it's more or less going to
be What's called the um slippy recording
codes the with a bunch of custom
additions to it
all right so let's return to our bird's
eye view so we have smashbot getting the
game State information but you might
still be think looking down at the stage
and going all right but
like how like physically how like sure
we have the game State gathered up into
the GameCube right but like again
there's no never connectivity in this
thing like how do we like physically get
the data over to the laptop so slippy
normally runs on top of dolphins that as
you can clearly see depicted here slippy
on top of dolphin
um the running on top of uh which is the
dolphin by the way is the the GameCube
slash Wii Emulator I'm running inside of
your PC and so if we need to save a
slippy file of one of these save files
we can just do it it's running on your
computer it's just a save file on your
computer
but this again has no networking so like
how the hell are we going to get the
data off of the GameCube and onto the
laptop
again
the GameCube does have a memory card
Port which if you think about it is
external and it is writable
so uh this is where uh this thing came
in uh this uh something that a a fizzy
or Jazz uh referred to as the original
slippy This was um what the project
slippy was originally supposed to be so
it's this little uh it's a bit difficult
to see from the picture but it's a
memory card device you stick into the
memory card and then uh it's running a
microcontroller that you can write to to
save files so the game the idea is that
you just plug this little Gizmo into
your GameCube you play a bunch of fun
games of melee and it's saving the files
the replay files as you're doing it to
this little Gizmo but we can kind of
hijack this exact process to copy the
game State over the the GameCube refers
to as the exi interface though I don't
even know what ex I stands for it's
probably external interface I don't know
um the memory card port
so um this uh this awful contraption
that luckily TSA did not flag as a bomb
um a TI microcontroller that was
designed by onosaurus who is one of my
the primary collaborators um for this
project
um what it does is it can talk the
memory card protocol over the ti
microcontroller
um and uh get the game State information
out over the memory card so the GameCube
thinks it's like saving the game it's
like sending data to the like what it
thinks is a memory card Port which is
actually just a microcontroller that is
then going to send all that information
to my laptop over ethernet
and this is uh running with enough juice
to do that in a pretty quick uh pace
but the game still can't be
smashbot still can't actually play the
game because it can't push any buttons
so at this point Smashbox can see the
game it can get the game state from the
GameCube to the microcontroller to the
laptop but we can't push any buttons so
how do we actually push buttons so the
naive way of course would be to like get
some actuators and take a little
controller and like like press the
buttons like but that would just be I
think everybody in the audience is like
that would be awful and that like would
not work at all
um so there's obviously a much better
way to do that which is just to like
um Talk the GameCube memory card the
GameCube uh protocol over the uh
controller Port so this is a task tm32
also bionosaurus um from the taskbot
community
um if you've ever seen uh taskbot Play I
Like A Games Done Quick
um the this is one of this is a task
spot here sitting next to uh Duane oacy
who's a friend of mine a former
co-worker as well I'm also one of the
collaborators on this project
the inside of taskbot is one of these
little gizmos it's a task 1032 that is
the like portion of taskbot that is
responsible for pressing the buttons
it's able to do this over a variety of
means
um
presses this over a fun cable that is uh
this is a GameCube port on one side and
RJ45 on the other um it does not
actually talk over IEP it just uses this
as a convenient like mechanism to plug
into uh the uh into the of the taskbot
to potassium 32.
um I had to crimp this myself I had to
do it a couple times crimping is
actually not easy
um so the this allows us to then send a
USB button command over uh over USB from
the laptop to the tasty M32
which you then press buttons over on the
GameCube
and now smash ball can actually play the
video game
that's completing our Loop
[Applause]
so let's talk a little bit about
smashbot itself so who does smashbot
play Smash Mouth plays Fox if you've
ever played melee um for any duration of
time especially in the competitive
Community
um it's pretty obvious to you that
smashbot would play Fox he's by far the
fastest has the most potential
um shine is just a completely broken
move it's this down B move like I
mentioned before it's a one frame attack
there's only a couple of those and of
the one frame moves it's the most useful
um there are however um two other
possibilities two other characters that
like
um maybe could be arguable like the best
in the game not from a human perspective
but from like a a bot perspective are
there any uh anybody want to shout out
any uh options who you think might be a
character that could be uh possibly the
best in the game
maybe Jigglypuff does have a frame one
move but it's tiny and the rest of her
moves are terrible
I think I heard there's Falco so um
Falco is a lot like FOX also has a shine
move um it's also one frame but Falco is
a kind of slower the combos aren't
really true because it pops you up and
so you can di them really far so like
this isn't a possibility but I think not
um the surprise
um uh second place for or maybe even
first place is actually the Ice Climbers
um so because there's two of them and
that just like throws everything way off
like even if you were to try to attack
the Ice Climbers and you successfully
hit one of them the other one can just
go back and hit you and they have insane
combo potential if they ever get a grab
you're basically just dead so Vice
climber is actually super tricky and
there's a possibility that they might be
secretly the best character in the game
but actually programming that out would
be super tricky and maybe as a potential
for a future project
so how does smashbot work so Smashbox
Works in this like the tiered hierarchy
of goals system um this was a technique
that I'm not sure if it has a name but I
learned it in AI course one time in
college it's sort of like a hand Jam
neural network
um at the very base layer is uh button
presses and it gets more like abstract
as the layers go um so this is a uh like
an expert system there's no machine
learning involved in this process but it
sort of looks like a neural network so
the very base level of button presses
that's pretty obvious so the next
highest level what I refer to as chains
chains are like things that Smashers
would recognize as like Tech skill
things like multi-shining wave dashing
um shuffles which is a short hop fast
fall l cancel with an attack in the
middle
um so these are all like things that uh
like uh like are scriptable that are
like short and concrete that consist of
button presses these are for the most
part uninterruptible so the idea is that
like if you're in a wave Dash you have
to
um commit to that action for a certain
amount of time and so you're stuck in
that animation so you can't like be in
the middle of a wave Dash and then
suddenly change your mind to do
something else
um so you're kind of stuck into it and
then the context is assumed so if you're
wave dashing right now then it's assumed
that you should be doing that it's not
up to you at this layer to decide that
you should or shouldn't be doing this
that's a that's for the next layer
so the next layer is what we call
tactics
um so these are uh these have one job
which is to pick a chain they don't
press buttons they don't decide well
when to be in this tactic you have one
job of one job only which is to pick the
next layer down
so for instance if suppose we're this
purple Fox down here um we're in a bad
spot we need to recover we're off the
stage if we have a jump we should
probably use our double jump if we don't
have a double jump we should probably
just upbeat a Firefox uh is it like
Fox's recovery move and you can kind of
even hear it in my head as like a series
it's like a flow chart of uh different
chains you're going to execute like if
this then that and that's more or less
how the chains are the tactics are
implemented whereas if you're this box
and you probably want to Edge guard
you're going to want to like try to keep
this other guy from getting back onto
the stage
um similarly if we're in this sort of
situation
um the Falco is flying up here clearly
and it's done uh so we're just going to
want to turn around and charge and up
smash for the exact amount of time so um
there is actually quite a lot of
planning involved in these so smashbot
knows for instance that this uh Falco is
in hits done it'll know that it's in
it's done for the next seven frames and
knows this exact trajectory and can do
the physics calculations to know exactly
where he's going to be at the end of
those seven frames and can charge a
smash attack for that exact frame so
that the very moment that he gets out of
hits done he'll be like hit by an attack
and killed
and then the next higher level is just
higher level strategies which is more or
less devoted to picking which of those
tactics we should be in so like we're
off the stage should we try to recover
now or should we be trying to hit the
opponent or like are we in neutral
should I be trying to defend against an
attack should I be trying to attack all
that stuff is um at the strategy level
so it's sort of like a neural network
um this was I learned this well before
neural networks sort of blew up and
became like the thing that like AI is
all about now
um in fact you can actually replace any
one of these layers with a neural
network an actual neural network and it
would suffice just fine
um though this is something that I
intend on doing later
um specifically leaving the uh the
chains intact so that it kind of has all
the low level uh like uh Tech skills it
would look fast and cool like smashbot
does now but the high level thinking
would all be done by a neural network so
it would be sort of The Best of Both
Worlds and uh this is something I intend
on doing in the future
oh
bombs so something that happened
demo was they just spawned a whole bunch
of ball bombs in the middle of the stage
what's up with that
so the ti microcontroller down here is
able to read from the memory card Port
of the GameCube but it can also write
too the memory card can read and write
to the GameCube so we actually can take
from the laptop uh send an item command
to This Ti microcontroller
and then the ti Market controller can
then forward that over to a bit of code
that's running on the GameCube to handle
that item request
so this is some really dirty pseudo code
that is more or less how item spawning
like random item spawning works in the
game this runs once per frame there's a
global timer which is just an integer
that decrements uh once per frame and if
the timer is equal to zero it generates
a random integer that is just going to
be our item that we're going to spawn
and then spawns that item and then
chooses a new random number for our
timer that way we're going to spawn a
different item at a kind of a random
time at a random item
so what I do is I clobber that code and
replace it with this which is going to
take our time or we're going to read it
from the exi interface from the memory
cardboard and if no data is received we
just get a zero so nothing happens if
the data is greater than zero then we
assume that it's going to be an item
command and just spawn that item so that
way we can spawn items live into the
game and we can even spawn some items
that the game never really thought
you're supposed to spawn
um so the uh the Goombas and like OCTA
rocks and stuff like that probably the
first time you've ever seen that in a
versus mode because you're not supposed
to spawn those inverses mode there for
whatever reason programmed into the game
as items as if you could spawn them
randomly but they never actually appear
in the game randomly they only appear in
like Adventure mode in the single player
game so um that actually be something
that people be seeing for the first time
uh in versus mode or I suppose you all
are seeing for the first time
so now uh we can spawn items from the
laptop so then we can take the laptop
and hook it up to a system called crowd
control
um crowd controls this like web API
um where people can go to the internet
and throw money at them again remember
this is a charity event and this is for
people can donate money to the charity
and then the crowd control Ford's a
little Handler back to our laptop piece
of code listening for item spawn
commands sends them to the to the ti
microcontroller sends them to the
GameCube and that's how random idiots on
the internet can throw money out of
Charity and spawn items on my GameCube
ah
we had a question was can we spawn
another smash bot we don't spawn it this
way this is only items but you can have
multiple smash Bots um in fact if you if
you go to my YouTube you can find a
bunch of stuff about smashbot fighting
itself um I don't have it configured
right now but you can actually do like
2V1 like two people against two
smashbots or uh like two and like two
like one and one and one in one so like
two people each with a smashbot on their
team playing against each other however
you want to configure it
um in practice uh the it'll beat you so
you like yeah
so some shout outs before we um head out
uh shout outs to onasaurus who was my
Prime collaborator on this project did a
lot of the hardware work
um wrote the firmware for the
microcontroller um fizzy medic meta uh
Nikki and Uncle punch are all um project
slippy dudes who helped out a ton with
assembly uh there's a lot of just like
low-level reverse engineering of melee
code to know what to clobber and where
uh Chronos also for uh doing some
assembly work for us and the duango AC
um for uh on the taskbot community for
uh actually running the the thing over
at Esa and helping out as well
play The Master Hand you can make
Mastery I've never tried it uh Master
Hand flies up in the air though so it
might be difficult to like make that
work
but in theory yeah sure you could you
can make Master Hand play like in versus
mode that is the thing you can do
um do we have any more time how much
time do we have
actually what I'll do is I'll boot uh
smashbot back up and we'll do a q a
[Applause]
thank you
[Music]
very much
[Music]
tomorrow
[Music]
when in doubt just try turning it off
and on again
[Music]
um gosh this is actually going to be
hard to do this while answering
questions I didn't consider that
possibility so the uh it's not so much
like a series of states
foreign
[Music]
is it gonna work
I must have unplugged something
[Applause]
yeah so the question was when I started
programming neural network would I
consider like putting in like a human
reaction time
[Music]
something
[Applause]
make your own Smash Brothers
[Music]
like without the human limitations
okay
[Music]
[Applause]
[Music]
foreign
[Music]
to PPC is that part of the go Arch like
outputs it's kind of dead so I don't
know it might not be so I have a half of
mind to rewrite and go
um because I've been getting more to go
lately and if it does
[Applause]
[Music]
all right
[Music]
uh like you have to hit that framing
like the timing requirement it's
actually worse when you're doing the
computation on the GameCube because the
GameCube itself has to like do a bunch
of computations
out of here
[Music]
oh
[Music]
thanks
[Applause]
[Music]
[Applause]
[Music]
foreign
you have six minutes to get drinks
before the next presentation
don't forget to tip your bartender thank
you
[Music]
thank you
[Applause]
[Music]
thank you
[Music]
a human
[Music]
fine
it's all you've ever known
[Music]
but you don't ever let it go
you left the door
[Music]
there was still awake
[Music]
again
[Music]
call me love things
[Music]
I know you know
you never lost
[Music]
okay
we are
back in business
it is time for the next
presentation
uh I had one I had a couple of quick
things I wanted to mention if you could
all put eyes and ears on me for a moment
after this presentation
uh we will have our lunch break the
lunch break is one hour
um people generally flee here during
that hour there will actually be a small
event that takes place here that you can
participate in which I'll talk about in
a second but to entice you to return
from the lunch break on time
at 2PM on the DOT
I will be making a random drawing from
the list of attendees who have who have
gotten here today for a flipper zero
so come on back
and in SD card so you can actually start
using it immediately you're not just
like screwed with this thing and you're
you know your hand you can't do anything
with so be back by 2PM at the lunch
break
all right
okay
so
our next dynamic duo needs no
introduction in the world of
investigative journalism
please welcome Dan golden and Renee
Dudley Pro publica journalists and
authors of the highly acclaimed book The
ransomware Hunting team a band of
Misfits improbable crusade to save the
world from cyber crime
which incidentally I recently heard has
been optioned for production on the
television screen so very exciting could
be made into a movie could be made in a
TV series I don't know but you get to
you get to to meet him here today
uh they will take us on a thrilling
Journey as they narrate their remarkable
story discussing the hunt for cyber
criminals and the moral dilemmas the
hunters faced along the way presentation
is a must attend for anyone in this room
because you're in the room but also for
anyone interested in the battle against
ransomware and the future of malware
um
stick around after they are done for a
book signing session where you can
acquire your own copy of their
compelling work
please give a warm summer con welcome
to Renee Dudley and Dan golden
[Applause]
hi everyone we're
that's all right it's fine we're so
happy to be here today it's our first
tack or con so it's a different crowd
than we're used to but it's it's great
because you're the key audience for our
book and we'll hope you check it out
later
um before we dive in I just want to say
thanks to Mark and his whole family they
all seem to be here for inviting us to
be here I'm in a dawn for organizing
this awesome event
so I wanted to talk a little bit before
we get into the book about how I got
interested in ransomware which may
resonate with some of you
um back in 2018 I was a corporate
reporter for Reuters and covering you
know looking into trying to to find out
interesting things to report on from Big
household name companies Fortune 500
companies and I got to know some csos at
those companies who at the time
regularly complained to me that they
wanted to invest in cyber security
upgrades for their companies but they
couldn't get their Boards of directors
interested
they would explain to their boards
we need 20 million dollars 30 million 40
million 100 million for cyber security
upgrades to keep our company safe
and the boards weren't interested
um they would say things like you want
us to give you 50 million dollars for
something that at the end of the year
we're not going to have anything to show
for it we can't write a press release
off it we won't have a new product we
won't be able to announce r d and of
course the csos would say yeah that's
the point right that we don't want
anything to show for it we want no
attacks and as I was going along I would
ask what's what's the biggest threat
you're worried about and without fail
they'd say ransomware ransomware is the
thing that is going to absolutely blow
up over the next few years
um you know as I'm sure you know it had
gone from a kind of a little-known crime
you know you know
hackers attack malicious attackers
attacking home users for a few hundred
thousand dollars and around this point
it was the era became the era of the
bigger ransoms and the bigger threats to
bigger companies and they were really
worried and so
um when when I joined uh Dan at Pro
publica which is where we both work now
the investigative news site Dan asked
what I was interested in covering and I
brought it up
hi everybody
um yeah so uh uh just to pick up that
story so uh in 2018 I had been a pro
public a couple years and they made me
the tech editor even though I am no Tech
expert certainly not by the standards of
this audience I mean for this book I
learned about asymmetric and symmetric
and hybrid encryption enough to write
about it but that's about it but um I
knew more than anybody else the other
editors of propublica so I became Tech
editor I set about assembling a team uh
Renee because she's a great reporter was
a first person I hired so the team got
together in my living room up in the
Boston area and I said well what are we
going to write about and Renee brought
up ransomware and uh everybody else
pooh-pooed it they said oh it's for
small amounts of money and the attackers
are not in the United States you know
we're a U.S oriented publication why do
we care and you know
they were a little out of date and that
it was starting to get bigger as Renee
mentioned there had just been the first
major attack on a U.S city Atlanta and
the amounts of money were going up and I
was very confident that any cyber
problem this big would have to have some
kind of American angle so I said okay
Renee dig into it and she'll tell you
what happened from there
so so as I started digging in
pretty much everybody that I asked about
ransomware said that there's one guy in
particular I need to talk to before
anybody else and maybe some of you know
him he goes online by demon slay 335
and his his real name is Michael
Gillespie and you know I tracked him
down to his his workplace which was a
nerds on call I.T repair shop in the
town of Normal Illinois
and he um he was he was very humble and
just direct about the facts
um and helped me learn about ransomware
and the various players and how it
worked and
um just some of the players in the whole
economy and as time went on he was
really helpful in the stories that I was
writing and Dan was editing
um about the players in the ransomware
economy and he was instrumental in
helping me figure out uh you know find
the evidence of who these bad players
were
um you know on on the U.S side of things
these Shady companies that claim to
um be able to restore your data without
having to pay hackers they had these
secret Solutions but in reality they
were just
paying the hackers and slapping on a
huge fee on top of that and Michael
helped me help me find find the evidence
of that and as we were talking about
that
um he mentioned how he's a part of this
Global ransomware hunting team that does
the very thing that these that these you
know phony scam companies claim to do
but really really didn't which is he and
this team of 12 people across the world
um crack crack ransomware they have
decrypted hundreds of strains saving
millions of people from paying billions
of dollars to hackers and I thought that
was fascinating so
around the summer of 2019 I went to go
meet Michael in person because I wanted
to learn more about him learn more about
this team
and you know by this point I knew
Michael was the most prolific member of
this team cracked more ransomware than
anybody else
um and so when I when I when I flew out
to rural Illinois to meet him you know I
was expecting to see the you know I know
he's the greatest in the world at what
he does and he's done more of this than
anybody else and you know usually when
somebody is the best in the world at
what they do they have handlers and PR
people and executive assistants they
sort of have the trappings of being the
best
um but not Michael and that's what I
found out when I went to go visit him I
he greeted me from the front porch swing
of his modest home in rural Illinois and
this working class neighborhood and you
know as you may know from his Twitter
profile he loves cats bunnies and coding
and sure enough you know there were like
nine cats and a couple dogs and the
rabbit hopping around his his house and
we just started talking about ransomware
and
as we were talking he would open up his
Twitter and there'd be 40 direct
messages from people just desperate for
his help you know I lost my University
thesis uh I'm a lawyer in my firms
client files are locked up I lost all my
family photos just the the horrible
stories went on and on and on and he
would respond to these as we were
talking we talked some more he'd open up
his phone there'd be another few dozen
messages of people with the same kind of
thing and he responded to all of these
and I was really struck by that but as
the day wore on he got more comfortable
and he started telling me about his life
outside of ransomware you know he was
working at nerds on call during the day
cracking ransomware both there and in
his free time but it was taking a toll
um he wasn't making that much money at
nerds on call he and his wife were
struggling to pay their bills one month
they'd pay one utility and then have
another shut off and then the next month
they would reverse those because they
couldn't afford to pay all their bills
every month they had to surrender one of
their cars to the bank they started to
fall behind on their mortgage payments
they almost lost their home and all the
while he's cracking ransomware
developing these free tools that are
allowing millions of people to recover
without having to pay
billions to hackers and doing all of
this with no Fanfare
um just in you know just humbly
um and um
you know for the benefit of society and
so I I call Dan from the airport and I
said you know he's he's he's in really
interesting and special guy I think we
should do a profile of them and so it
became a profile and then the basis of
the ransomware hunting team which tells
the story of the rise and evolution of
ransomware as well as the story of this
amazing team of ransomware hunters that
are fighting it and what's so
fascinating about them is they all have
interesting stories to tell um like
Michael's they don't seem to be
motivated by the things that motivate
most people like fame or success or
money they're motivated by this almost
urge to help people you know they know
that they're some of the only people in
the world who
um are willing and able to spend the
time to crack this cryptography and
develop these tools so they just have
this sense of urgency in this compulsion
to do that they're fascinating too but
because you know this may this may feel
feel familiar to you but a lot of them
have never met in person even though
they're working together all day every
day
um to develop these free tools they live
their lives online where they feel the
most comfortable and they really upend
the traditional stories of success
um you know many of them came from
backgrounds of poverty some of them came
from backgrounds of abuse
um only one or two went to college one
of the most prolific members on the team
even dropped out of high school you know
they're mostly self-taught
and they they have this sense that they
told us about that the internet is
really their intellectual home in the
place where they feel safe and
since this is their territory their Turf
they want to protect it and they see
they see fighting ransomware as as their
way to do that and also perhaps to get
back at the boys of their youths another
more troubling similarity among the
members of the team is that a lot of
them have have have encountered
financial and personal hardship in doing
what they do they spend so much time
tackling ransomware that they they're
struggling to make ends meet
um when one when one is runs into some
kind of financial hardship usually
another person steps up
so they're really a fascinating group of
people who are there for each other in a
very real way and you know have helped
the world
um fight back against ransomware filling
uh avoid in society
so while Renee uh cultivated her
friendships with the hunt hunting team I
looked into some of the history of
ransomware and I found that the man who
invented ransomware about a little more
than 30 years ago around 1990 was a
crazy guy named Joe Pop I don't know if
any of you have heard this story it got
a lot of attention 30 years ago but not
much since then but pop was one
brilliant eccentric nutty guy and he
grew up in Cleveland you know even
though a lot of the hackers are you know
from Europe or or the Middle East he was
he was an American he grew up in
Cleveland went to Ohio State then he got
a PhD at Harvard in anthropology he was
supposed to be the next great you know
Diane Fosse or Jane Goodall the next
brilliant you know researcher his
specialty was baboons he was a big
darwinian theorist and so on so he went
to do his field research in Kenya and
Wally was there studying the baboons he
discovered that it really wasn't his
thing he just wasn't that interested in
researching it he was much more
interested in making money and it didn't
his graduate student stipend didn't pay
him enough so he had all these crazy get
rich quick schemes for example he would
put on a uh you know a pith helmet and
hunting outfit and they put an elephant
gun over his shoulder and charge all
these tourists outrageous amounts of
money and lead them on some tour of the
uh the game preserved that he was in
um he he contemplated setting up an
elephant graveyard because there was
this myth that um elephants know where
they're going to die and they all crawl
to die at the same place which is not
true but he was going to take elephant
Bones from all over the area put them in
one place put up a sign saying here's
the elephant graveyard 50 bucks to watch
visit it you know so he had all these
get rich quick schemes and finally this
got him in trouble with the Kenyan
government they kicked him off the Game
Preserve he goes to Nairobi he gets into
health health research stuff uh at the
peak of the AIDS epidemic and what he
does is he he he he actually did this
from London he sent out like 20 000
floppy disks to to come to most of the
health researchers also the computer
science magazines and so on and the disc
set out at AIDS education you know
supposed to be what you don't know about
AIDS but if you put it in your computer
the computer froze and the sign would
come up saying send 378 dollars to this
post office box in Panama and so uh he
sends this all over the country all over
the world and um it caused a panic you
know nobody ever heard of any crime like
this before made all the front pages he
realized that you know he was a dead
duck he he went he got caught went back
to they brought him back to U.S he was
extradited to England because that's
where they um investigated uh that's
where he had committed the crime and
there he pretended to be insane he like
did all kinds of crazy things he wore
like condoms on his nose and stuff and
and the judge eventually decided I don't
want to try this guy it's too much of a
circus if he goes back to the United
States and stays there we'll just you
know we won't do anything about him just
get him out of England so that's what
they did he went back to the U.S he
never did anything like ransomware again
he wrote a couple of nutty books and for
about that was in the early 90s for
about 20 years what he had done kind of
lay fallow because there was not a uh a
good delivery system for paying you know
the hackers and then Bitcoin came around
all of a sudden you could you know pay
with cyber currency relatively uh safely
and um from then on you know ransomware
exploded to the point where the the uh
the ransoms became millions of dollars
tens of millions of dollars of tax on
government agencies and universities and
hospitals and oil pipelines and you know
all the other ones you're familiar with
and now they don't just uh uh you know
uh freeze your files they also go in
there and steal the data so even if you
have backups or your files you still
have to pay so it's became this world
crisis but it all started with Joe pop
back in the day in uh having ideas in
this game Park in Kenya he no longer is
uh is uh living by the way he died in a
traffic accident in 2005 just as he was
about to open a butterfly conservatory
in Upstate New York and it still exists
it's called the you know the Joseph pop
Butterfly Conservatory you can visit it
as a tourist I did his his former
girlfriend runs it and there's a
beautiful plaque there saluting his
legacy as a as a genius and a scientist
and humanitarian and but nowhere does it
mention his biggest Legacy which is that
he invented ransomware
one of the things we wanted to do
um in the book is look on who's on the
other side of the equation because of
course we spent um you know a lot of the
book talking about the hunters and their
incredible work but who who's on the
other side who are who are the malicious
hackers hackers behind this and I
personally got to know um one of them in
2021 who went by the name of Adrian and
we talked over Telegram and he told me
about the ransomware that he was running
called Ziggy and Ziggy I mean by 2021
things had really taken off for
ransomware and sort of by contrast
um Ziggy was almost quaint you know it
would charge two hundred dollars
um Ransom to its victims
um and you know even at the time that
that was hardly anything
um and when I talked to Adrian about his
motivations uh he he described to me
um his living situation he was in the
Middle East uh and where where he was
there wasn't a lot of job opportunities
for people who were interested in in his
field which was I.T and cryptography
um that was his expertise and so he
turned to ransomware to help put food on
the table and earn a living so uh Adrian
went along he said he was mostly
politically motivated uh in his targets
he went after victims in the U.S and
Israel to achieve his political
objectives
um and eventually Adrian started to feel
guilty about what he was doing
coincidentally or not it was around the
same time as a global law enforcement
Crackdown but in any case Adrian decides
to to shut down to shut down his
ransomware
um so like everybody else in the
ransomware world he turns to demon slay
335 Michael Gillespie and asks if he can
dump his keys on Michael for Michael to
create a decrypter tool for victims to
use and of course Michael
obliges and and creates that and in a
very bizarre twist
um unusual twist Adrian actually gives
refunds to people who had already paid
um he he was feeling quite sorry about
what he did and uh also indicated that
this might help if he were ever be
discovered by law enforcement Authority
is a very long shot but never know and
so Adrian really represents the equator
days of ransomware
um and as you all know it's evolved into
something so so much more than that
um you know over the past decade I'm
sure many of you familiar with the fact
that ransomware gangs have really
organized and in many ways mirror
legitimate corporations in the
organizational structures
um they'll have
um sort of payroll departments and Human
Resources they post ads on the dark web
looking for people with very specific
skills like proficiency and Cobalt
strike so that they can use
um those skills to get into ever bigger
organizations with deeper pockets they
Outsource tasks beyond their purview
they work with crypto providers they
work with Bitcoin tumblers they work
with with any of a variety of
specialty organizations that have
cropped up to feed the the the
underworld ransomware economy um in all
of this specialization has allowed the
gangs to focus on the cryptography
itself which has become better and
better and better and harder and harder
for the ransomware hunting team to crack
and
as as this has evolved you know there's
been gangs that have have really become
absolutely prolific
um and the one that comes to mind is the
appropriately named evil Corp uh
ransomware gang run by a man named
Maxine mccubitz who's now under
indictment in the U.S but will probably
never face Justice because he's in
Russia where he seems to enjoy
um the protection of Putin
um but it it evil Corp is is is
indicative of of um of how ransomware
has really evolved
um it runs this this sort of structure
this organization with all of the
attributes that I mentioned
um and they they're they're yakubits
although he um you know he feels so
secure in his freedom
um that he actually drives around Moscow
with in a Lamborghini with a license
plate that translates to thief and you
know you can understand why he would
feel protected because his father-in-law
is a known friend of uh Putin they were
in the KGB together
um and it it really reflects another
alarming Trend which is like Dan
mentioned increasingly ransomware gangs
before they encrypt data are stealing it
and
when you think about who their targets
are people like evil Corp
um you know we're talking about every
segment of society from Health Care to
defense contractors
um and the kind of of of material that's
getting stolen could be intellectual
property National Secrets
um so it's it's it's it's an alarming
Trend to think about the kind of people
who are behind this data theft and
increasingly the thought is that
ransomware may be used as a cover for
intelligence gathering operations
affecting you know all of society
uh one of the
um
issues that we wanted that I wanted to
address in the book the underlying issue
is the kind of moral dilemma that
ransomware presents basically to pay or
not to pay you know and neither one it
turns out is a very appealing
alternative and this comes up of course
for the cases that the hunting team
can't crack I mean Michael Gillespie and
his and his cohorts can crack a lot of
ransomware which is a way out of that
dilemma but if the coding is is perfect
basically they're helpless they
capitalize on flaws and mistakes which
which often occur but often also don't
so if they can't do anything and nobody
can crack it you face this question
do I have do I should I pay the ransom
or shouldn't I now paying The Ransom of
course you're abetting you know
criminals who often are associated with
countries hostile to the United States
and you're encouraging more ransomware I
mean in the big picture it's hard it's
it's kind of you know difficult to
forgive which is why you know the FBI in
places like that encourage everybody uh
you know don't pay the ransom but not
paying the ransom uh is can be caused it
can be disastrous you know businesses
may not be able to you know maybe shut
down for weeks or months may not be able
to survive uh you know classes may not
be able to be held at least online at a
school or university and sometimes it
can have life or death consequences like
at a hospital so we wrote about a
hospital in Alabama which was hit by
ransomware and it uh knocked out the
sort of electronic monitoring system
systems and a woman was having a baby
there they failed to detect you know
fetal distress the boy the the baby was
born severely brain damaged and died
soon after you know in these kind of
cases can happen I I talked to a couple
uh that lived in Oregon and in a
mountainous part of Oregon and
um the husband had a very severe brain
tumor and
um you know he was about to go in for
his radiation and treatment at the local
hospital when it was hit by ransomware
so he they had to send him to another
hospital like a hundred miles away his
wife had to drive him there there and
back every day in the winter over the
mountains in Oregon and it just added an
extra level of uh hardship to what was
already a distressed situation so the
consequences can be very serious and
I focused in particular on the ex the
example of an attack on the city of
Baltimore in 2019. now uh it had there
was this ransomware attack on Baltimore
just as a new mayor was being about to
be sworn in so he comes in there's this
ransomware attack it stopped housing
sales in the city of Baltimore because
it knocked out the city's records of
taxes and liens and things like that so
without that information the ownership
could not be
you know proven the the amount to be
paid the taxes weren't known and so
insurers refused to ensure the
transactions and housing sales came to a
halt they couldn't do uh parking tickets
because uh you know the parking
enforcement was electronic they the the
towing Lots were put out of action
because nobody could keep track of what
spaces the cars were being placed in
they they couldn't build they couldn't
send out water bills so all these range
of unglamorous but important city
services were knocked out and yet the
mayor had strong feelings he did not
want to pay the ransom he did not want
to reward criminals The Ransom was maybe
75 000 but it could easily been paid the
city's business Community particularly
in real estate were begging this mayor
to pay the ransom like just pay it and
forget it who cares and he said no you
know this is not morally what we do and
so um the city ultimately took months to
recover cost about 18 million dollars to
recover and the the populace of the city
did not seem to look gratefully to the
mayor for his Brave stand he ran for
re-election the next year he got six
percent of the vote
so you know the I don't I'm not sure
what the moral of the story is you know
because I still admire the guy and
actually I visited him and he was doing
fine out of office he he was uh you know
actually becoming a baker he was
practicing he was his grandmother had
left him all these recipes and he was
making them and when I interviewed him I
kept being distracted by these wonderful
odors you know emanating from the
kitchen until he finally gave me like a
cinnamon bun or something but uh anyway
but it was it is disturbing and the fact
is
um there's no uh uh there's no real good
way out you know that obviously the best
way out is is preventative as far as
possible but as uh many in the audience
know you know the sentence Renee
mentioned the cyber security is often um
not to the level that it can be helpful
against these attacks and Renee will now
talk about the FBI and sort of how
effective or otherwise it's been in in
dealing with the uh the criminals thanks
you know one one of the questions we
wanted to address in the book is how did
ransomware get so out of control and you
know there's a lot of there are a number
of factors behind that but one of the
ones that cannot be ignored
um is the shortcomings of the federal
government in in tackling the ransomware
problem notably the FBI which as you
know is the federal Authority
responsible for containing containing
the threat and there's a number of
issues to unpack there but
um a lot of it comes down to the fact
that the FBI has long ignored the
ransomware up until recently it it
characterized it as an ankle biter crime
even as it was evolving into so much
more of that and I actually traced the
issues back to the the very beginning of
the FBI before cyber was on anybody's
Minds there there was a founding
principle by the legendary first
director Jake or Hoover that agents in
the FBI should be able to do any job
anywhere and that works okay if you're a
white-collar crime investigator who move
gets moved to a gang crime squad or vice
versa it's a lot harder to make a gang
crime investigator a Top Flight computer
scientist you know because those are
skills that are honed over a lifetime
and what the FBI tried to do was turn
people with a background in law or
accounting
um into a computer scientist in a Flash
they would send people to Sans courses
with titles like cyber security Boot
Camp or cyber Essentials 101 which gave
them a level of understanding but not
enough to move the needle on these
complex Global investigations into into
sometimes very sophisticated sometimes
state-sponsored hackers
but they they they clung to this Mantra
um and tried to turn tried to do exactly
that
um what that's not to say that there
aren't talented computer scientists in
the FBI there are there's just not
enough of them and they often feel
overwhelmed by the amount of work and
having to chip in on
um cases you know some of which don't
have anything to do with with cyber
crime or cyber security
um and there's also this feeling you
know the FBI is a very Macho place and
they they they they told me that they
often felt like their skills were viewed
as lesser than you know in the FBI you
know people who are on the SWAT team are
at the top of of um you know the top of
the Heap when it comes to respect and
people doing counterintelligence
encounter terrorism and cyber
Specialists agents who you know have
degrees in computer scientists are sort
of at the bottom and they have to deal
with jobs like you know of course as you
know like there's you know there's all
kinds of physical fitness requirements
to be an agent and they would deal with
jobs like do you have to do push-ups
with a with a keyboard in your backpack
and everybody's like but you know
rolling their eyes and it just
underscores this this sense that their
skills are viewed as
um less important
even though they're you know more
important than ever so the people who
are good don't stay long they don't need
the aggregation aggravation they can
make probably five times their
government's salary by moving to the
private sector where their skills are in
immediate demand so they just leave
um but it only serves to exacerbate the
FBI's problem
um you know they would have they would
talk about having to dumb down reports
for their supervisors who really didn't
know the first thing about cyber having
to relate everything to something you
know an analogy you know making some
cyber problem uh relatable to cars or
mechanics and
um they just get they just get tired of
it and they leave
um what has happened is the FBI tries to
fill the void with civilian computer
scientists but these people I found get
even less respect than the agents
themselves you know if the AIDS if
computer scientists agents can't get
respect there's no way that these civil
million computer scientists will get
respect in the bureau so they too leave
you know I'm told that a three to five
year tenure for a civilian computer
scientist in the FBI is seen as really
good because they just can't convince
these people to stay around long enough
because of the aggravation and and the
money
um so who does it right well
it's useful to contrast the FBI to the
Dutch national police which is really
seen as the world's leading law
enforcement Authority when it comes to
fighting to fighting cyber crime
um and one of the reasons I found that
they were they've been so successful is
that from from its early days of its
high-tech crime unit
um first of all they put a priority on
fighting ransomware even 10 years ago as
it was just emerging as a threat but one
of their founding principles was
we're going to have a one-to-one ratio
of traditional Law Enforcement Officers
to computer scientists this is the only
way that people who will actually
understand the technical underpinnings
of a case will have a strong enough
Collective voice as if we put a lot of
them there so that's what they did
to get the right people in place they
did unconventional hiring they had
Capture the Flag competitions
um they would put this Capture the Flag
competition posted on the Dutch National
Police website and anybody was invited
to join people who solved it were
invited to interviews and what that did
was it got the attention of people who
thought it was cool who had the right
skills and it immediately weeded out
people who lacked the skills that they
really needed to fill the jobs on this
high-tech crime unit while also
highlighting people whose skills might
not jump off of a traditional resume and
it gave them something to talk about in
interviews and as time went on the
people who they were hiring through this
they didn't want you know they found
that they didn't want to carry guns or
handcuffs or chase suspects down the
street like is required of traditional
FBI agents so the Dutch said forget it
you don't need to do that anymore but
you're still eligible to the same
promotions and raises the same titles
and this is just something that you
could not envisioning happening uh with
the cyber division of the FBI but it's
exactly the kind of of people that are
needed to to fight the crime
um and you know I think about people
like members of of the hunting team you
know these are the folks that have the
kinds of skills that are needed to fight
ransomware and other types of cyber
crime and they first of all wouldn't
want to become agents they wouldn't want
to hold a gun and you wouldn't want them
holding a gun but they would never get
hired by the FBI you know some of them
the FBI wants college educated
athletic recruits who will move around
the country wherever they need to to to
to to fill jobs and who will be willing
to shift off of cyber
um as the agencies
needs evolve and they just would not
there's not a kind of apparatus in place
to get the right people into these jobs
um
one thing that I wanted to close on
um was to point out you know some of you
may be familiar with Michael Gillespie's
website which is ID ransomware
um it's the site that anybody can use
upload a sample encrypted file and he
tells you his site tells you what kind
of ransomware it is whether there's a
free tool to decrypt it and just showing
you know how essential this team's
efforts have been over the years
you know on a normal day Michael's site
gets two thousand to three thousand
submissions that's about the same number
of complaints of ransomware that the FBI
gets an entire year
um so
he and the team are are filling this
gaping societal void when it comes to
fighting ransomware and helping victims
and while their skills haven't been
fully embraced um by the FBI and by sisa
and other parts of the government
more historically I'll end on the
positive note by saying that more
recently they have been and they're
they're they're sharing what they know
and it's being taken seriously and it's
helping victims because when they are
able to share with
um people in law enforcement who you
know may have access to the victims
first they're able to get their
decryption tools to the right people
um and this helps prevent you know more
money from going to to criminals so
thank you very much for your time we've
loved being here and we are glad to take
any questions
I thought before we get the questions I
just mentioned because this audience
that you know some of the techniques
that the hunting team uses to crack the
codes are very interesting and you'd
find them in the book If you read it and
uh but like for example they will
sometimes do a little bit of hacking
back as Renee could describe there was
one case of a ransomware strength called
stop DJ Vu which is very very prevalent
and uh uh it one of its flaws was that
it's key included or it left in
computers uh it can include the MAC
address of the computer that it was
attacking and so uh Michael was able to
use this Mac address to pretend to the
server where which was sending the key
that he was you know they use the MAC
address to identify the different
victims keep them apart he was able to
use this Mac address to pretend that he
was you know a computer that was sending
back for the key and that's the way he
got the the key to decrypt the the
compute you know the computer so it's a
lot of interesting stealth techniques
that go beyond just uh uh you know
cryptographic analysis but yeah we so
we'd love to take uh any questions that
you have um
yeah
Renee and I yeah
um well you know it's interesting the
question was have
the question was have Renee and I ever
experienced any retaliation for doing
this work we haven't personally but just
before publication our publisher was uh
you know uh attacked by ransomware and
its operations went down for a week we
don't know if that was connected but
um the timing was you know coincidental
and some of the hunting team members
have you know uh experienced uh uh you
know touchy dangerous circumstances one
of them a guy named Fabian who's who's
now in England he was in he worked from
Germany which is where he grew up and he
he was very well known as a ransomware
uh breaker and uh he sent you know the
Russian mob was following him you know
he saw a bunch of suspicious faces there
were some worrisome things attacks on
him online and so on and so that's why
one of the reasons why he moved to
England and he keeps his whereabouts
very much um secret
if I say I have a question I hate to be
this guy because
the popularity of like
like beginning examples of that and how
much is this
I'll let Renee handle that
there there is some evidence that that
AI is already being used to write to
write ransomware
up but on the other side it's also being
used to counter it so I I think the uh
the the the AI revolution could help
both sides but there's certainly uh
evidence that it's it's already
happening
yeah
oh sorry uh I should do this here it is
it's called The ransomware Hunting team
a band of Misfits improbable crusade to
save the world from cyber crime right
after this there's a book purchasing and
signing ceremonies so you can get your
own copy and uh has Mark alluded it's
doing very well and you know it's an
option for a TV series and I've got very
good reviews and so on so we we think
it's a good read both for the expert and
the Layman
yeah
just repeat the question
so the question is is it it is more
ransomware on the way or if is it
plateaued
um
there was a lull for a while and now it
seemed to be back in bigger Force than
ever
and you brought up a good point which is
the next evolution of it what are the
hackers going to do next well
you know one of one of the things that
we unpacked in the book is this group
maze pioneered the strategy of double
extortion where instead of just
encrypting the files they're
exfiltrating them first you know and
then using that as leverage and
negotiation so even if people I mean
there's there's certainly evidence that
people's backups are getting better and
more robust and better tested but that
that helps you less than ever because
now
the hackers have your stolen data which
they leak on these leak sites if you
don't pay up so people who have the
ability to recover from backups or who
are able to be get the help of the
hunting team to recover still feel
pressured to pay because they've got you
know their their most sensitive data
their corporate Trade Secrets you know
their intellectual property their
patient health records are going to be
released if they don't pay well the
latest twist that is taken off like in
the past month or two is that hackers
are skipping encryption altogether
they're just there it's like a cyber
Ransom attack but without the actual
ransomware execution so now they're just
going in if you've been following this
move it file transfer Saga they're using
this vulnerability and move it software
to steal data from you know dozens and
dozens probably hundreds of high profile
users of the software and skipping
encrypt and just going right to Ransom
demands and this seems to be the latest
twist and it's um you know I I've seen
reports it's you know this is just this
is it's after a while it's back you know
worse than ever and demands
um you know are continuing to stretch
into the tens of Millions
believe
I believe there were recently a couple
of attacks big attacks by a Russian
group called klopp if I'm not mistaken
and they shut down and stole data from
parts of the federal government state
governments a major hospital where we're
from which is the Boston area and it was
you know one of the biggest and most
devastating attacks on record and so as
Renee said yeah it just seems to be
picking up more and more momentum and of
course whenever you see an attack from
Russia you have to wonder you know to
what degree is it state-sponsored and
and the answer is probably at least to
some degree because
Russia allows these people to operate
there you know there was a time when
after the colonial pipeline attack when
the Biden Administration was kind of
negotiating with Putin to try and get
him to crack down on some of the
ransomware gangs and they did you know
make some token arrests and stuff but
the deal seemed to be in Russia's mind
if you don't do anything about Ukraine
we'll help you with ransomware so when
the us made clear that it was you know
actively supporting Ukraine all all uh
all pretense to cooperate on ransomware
disappeared
yes
let me make one point
we're never know more knows more about
this than me but I'll make one point the
question is why are the ransomware gangs
better at innovating than the people who
are trying to stop them and one
interesting thing is that the ransomware
hunting team it helps like countless
victims but in the long run it
contributes unfortunately to the
Improvement of ransomware because you
know every time you know it it fixes a
it finds a flaw and it distributes that
flaw and people stop paying the
ransomware gang goes wait a minute why
aren't people paying us we must have a
mistake so they go back over their
coding and they improve it so in a weird
way the the hunting team kind of like
beta testing for the uh for the
ransomware hackers so that's one reason
Renee can speak I'm sure more
the reason is just how organized that
they've become come
um you know in the earlier days it was
sort of a One-Stop shop like one guy
we're doing the encryption and also
doing uh you know finding the vulnerable
networks and you know doing the actual
spreading and now it's become so
specialized so there's the people who
actually develop the encryption and then
there's the people who go out and find
the vulnerabilities and
um then there's the people who actually
do the negotiations and all of the
specialization has what I I mean it's
like any great you know cyber security
company
um they've got people who are experts in
one tiny element of it going very deep
on that element
um so that the whole organization works
works better and more efficiently and
more effectively
yeah well you know after um
so the question was are the um you know
the the members of the hunting team have
struggled financially over the years and
do they seem to be in a better place now
um
you know one of the things that has has
come up along the way is that there
always seems to be stepping up for one
another
um you know Fabian wosar is uh you know
he he he was a CTO at emsasoft and it
seemed like anytime somebody like
Michael you know couldn't pay his
mortgage magically msoft had a you know
an opening for a part-time consultant
that you know he would take the job
um you know I'll say that
um
it is after the after the propublica
profile on Michael Gillespie ran
um offer started coming in for him
um and now he and a number of members of
the team
um are you know either work directly for
or affiliated with a company called Cove
wear
um that that handles uh Ransom
negotiation
um and transaction for people who have
no choice but to pay
um and they they still feel like they're
fulfilling
um their goal of helping victims because
what happens is you know sometimes when
you pay you get a decryption tool back
from the hackers that either doesn't
work or you're worried about its quality
and so they they in their new work for
which they you know have enough money to
to live more comfortably
um are fixing these tools uh so that
victims who are on the unfortunate
position of having to pay at least have
a safe and reliable and quick easy to
use tool
oh yes hi
mentioned that
are you in your research did you hear
about maybe moving beyond Bitcoin or
moving to another payment model
well the so the question was you know
Bitcoin helped helped ransomware get off
the ground but it's not totally
Anonymous uh you know there's ways to
trace it
um so there's a few things there one is
you know a few years ago we were seeing
um instances of you know Dash or Monero
other types of cryptocurrency being used
um but there's enough tumblers and
mixers out there that you know the the
people who want to you know get their
Bitcoin laundered are are able to do so
um but it it you know it is you know a
dicey question and there has been
um you know there have been examples of
you know payments being traced and law
enforcement you know getting to the root
wallet and returning money that's that's
rare and for now it seems like this is
still a pretty safe bet for hackers
you know one other interesting thing is
that um
in you you'd find in the book is kind of
the tension of the struggle between the
hackers and the hunting team and one of
the interesting things is they seem to
be very similar in a lot of ways in
terms of their personalities and their
interests you know they they they like
the same Disney movies like The Lion
King you know and they uh uh they they a
lot of the the hackers did not have
any more formal education than the
hunting team and it's the kind of thing
where there's this weird love-hate
relationship there's a kind of tension
they're on opposite sides one side is
greedy and going for the money the other
side turns down all money but yet
there's a kind of sneaking respect that
goes back and forth and we we have some
very entertaining exchanges between them
uh in the book but I think
you know at this audience particularly
you guys might relate to the hunting
team you might also relate to the
hackers on the other side and this kind
of uh uh War that's going on between the
two of them where you know it's not
unlike soldiers on opposite sides of the
trenches but you know they take a truce
at uh Christmas Eve and toast each other
you know so it's uh it's a fascinating
dynamic
thank you so much for having us we've
really enjoyed it great questions and uh
and and we hope you'll stick around for
the the book uh purchase and signing
thank you
um yeah uh so uh as as Dan just said uh
book signing
um you can you can purchase and and and
get get autographed copies which you
know
it's better than Bitcoin
um
so that's that's the one thing second
um we are going to the lunch break now
um during lunch you know
sky's the limit but Park life is around
the corner they got tacos they're very
nice you can go there check it out love
those guys
and finally be back
by two for the flipper zero drawing
um if you are not here
when we call your name
you do not get the flipper zero we will
go to the next person on the list until
we find a person who is actually here so
do not miss your chance
oh and I am reminded that there is
merchandise available for sale like hats
and sweatshirts on a day like today a
sweatshirt would be great
uh there are tank tops there are
t-shirts there's other stuff that are
exclusive that are not the things that
you were given is a complimentary you
know part of your of your your
registration please hit the merch table
thanks everybody we'll see you after
lunch
yeah yeah
yeah
[Music]
so I made up my mind
up to
[Music]
up to it look at me now
will I ever learn I don't know how but I
suddenly lose control
There's A Fire Inside My Soul
[Music]
Here I Go Again
[Music]
does it show again
[Music]
too long you
you have strong
Just One Look and I can hear a bell ring
one more looking I forget everything
up
Here I Go Again
[Music]
I might just how much
[Music]
did I ever let you go
[Music]
it's a game we play goodbye
foreign
[Music]
will let you go
[Music]
again
[Music]
sweeter than candy ten times between
thinking about you
ding dong trick or treat I was knocking
at your door every week and I saw you in
my fortune cookie what a great gift like
a basket of goodies
it's a nice
gotta book your language
[Music]
ended up being a predator a horrible
person
I'm gonna keep the doctor away cause
you're my Apple every day every day
[Music]
over there
[Music]
foreign
[Music]
myself down
[Music]
you're a server admin just got served
[Music]
for you to know
yourself
[Music]
got the right one
[Music]
radio
[Music]
crying now
[Music]
out of me
[Music]
to come
back
[Music]
discover me
I try to call you everything
[Music]
foreign
[Music]
thank you
foreign
[Music]
and it's hard to not think about that
I love the school and I miss it so much
[Music]
still feels like your love feels like a
constant move up to us girl you've ever
seen from the blueness of her eyes to
the dimple on the cheek to her openness
of mine how simple it is to speak to it
keep me on track when I get on a detour
she's nothing less than my best friend
but much more and every night I think
those lucky stars above four if one fell
as obvious what my wish will be that
you'll be back home I just want you here
with me
not that long
race
fingers crossed like I hope we don't get
tacitored low-key she got the badass
curves I love her bubbly company Spirit
the way she held with my lyrics so
inadvertently she loves
me not be about hurting me lady made me
strong like I think I might be Hercules
swerving in a burgundy whip sipping he's
nursing with bliss hitting each other
with whips we just talking that's
on the regular might just hit her with
that ring on the cellular we steady
doing our own thing
and it's hard to not think about that
so much
girl I'm just waiting for the day to
come back
yes
[Music]
love make me fall in love why don't you
just make me fall in love again I can't
deny it I'm in love
with flowers
ask too many questions say to complicate
things so baby won't you help me
understand just what it means to be
[Music]
again
showers in the morning how the rain
starts pour in my imagination
the world opens always
happens to talk
whatever
that is my heart but it's all just
what is that
no other
people
[Music]
that hurts
I'm smart
appreciation why you sat just like a
Dragon I'm the one appreciating
and this is how
I'm the one that's baking tell me how
the you're so fake and you're
thinking about stopping your mistakes
I'm not that much of a ninja cause I'm a
bit of a sinner I'm not that much of a
loser
cause I'll stay with it
I call me cheddar all we do is make a
place
I'm doing me and they will never
close up it's
it's on the coffee
please
[Music]
into all
the way
[Music]
look I won't pretend I understand it
babe the afterlife and all but as you
died you promised me that you would try
to write or call and I've been waiting
ever since every Sunday I hold seances
with like-minded adults and roll your
corpse into the living room and try to
find your pulse and then repine at the
results I've even my window sills lined
up with ultraviolet bulbs Trucking
shrines of human skulls and other signs
of the occult but now I'm at a
loss cause honey nothing seems to work
like I've been actually projecting my
body Beyond My Dreams through the fabric
is facing time so you can spot me at the
seams I've entered through the upside
down hoping you'll caught me in between
but maybe
like you should infiltrate my newsfeed I
swear no one would notice you could
float beside some bogus BuzzFeed quiz
about the police be a pixelated Phantom
Ghost on clickbait propaganda post and
dictate what you're thinking through a
catchy headline like
the reason why it's great to be ethereal
are 20 signs you're dead now when your
soul is immaterial or if it's late at
night then you could swoop in from the
shadow realm and talk to me through Papa
bags that show up over adult films on
anything you're into we can start with
facial you could be me
you're interracial if you're feeling
sort of formal we could paint today on
Skype and I could call it a corner Rover
and we could share the corner slice but
it's time to go to bed then we could
leave our cameras on and if the
Netherworld has one day shipping free on
Amazon then you can slumber
yourself I swear this delivers
quick or send me the address and I could
meet you by the river stairs on Twitter
beef what's now I'm tired by the Tigers
and Euphrates I can snap you while I'm
snagging
into the photocopy pirate
the records and then have a Facebook
flame war with Osiris and either way I
can't wait to talk or reunite I've been
so lonely since you died I've tried to
walk towards the light
it's been far too long that you and I
have been alone
you could rectify that if you haunt me
through my phone no I don't wanna deal
with voodoo dolls and figurines
frustrated I guess I forgot to countless
graveyards draw pentagrams and
slaughtered goats and even took a course
on goes from Pentecostal folks folks
never once have gotten close last month
I sat with local psychics in their
Crystal jewels and tried to find my old
T-Mobile Sidekick phone for Middle
School just so maybe if you're bored or
fortune telling tarot cards and magic
words then you can tweet 140 characters
so I could throw away my voodoo dolls
and stop chanting my little mantras that
my Guru taught us and if you slide into
some YouTube comments you can scroll the
comment page or you could leave it blank
if you
if he's perceptible we tell them it's a
prank if you still don't send responses
I'd assume the problems Technical and I
would call Verizon just so someone could
inspect it all I tell them I just want a
close encounter with a spectral kind
he'd asked if we turned on our modem
router for a second time and plugged it
in correctly to the voltage power socket
line and tried to tear a portal hole
through to your paranormal Soul so mean
you could catch up on a toll-free Spirit
mortal caller we could see a witch
doctor she
metaphysical the convalescent soulless
at first your diagnosis could be
hypnosed the way that you're reborn I
hope you use the 3D phone
and point I don't really know why I
learned esp4 when you can descend and
settle in my USB port or my Nvidia G4 so
my video AV cord there's no need for
Santa Muerte when I've got a qwerty
keyboard we can play a game of Esports
you would not be on a team and
then audio so I'll put my audio on
stream
far too long
you could rectify that if you haunt me
through my phone no I don't wanna deal
green
I could do without them if you'd hold me
through my screen
you found
[Music]
all myself
or maybe I could watch certain Shores
smiling past a long night and drinking
and the lights above the island watch
watched you change
the thought there'd be a problem that we
couldn't solve when we
[Music]
break up those
words
[Music]
foreign
[Music]
[Applause]
[Music]
between
me
[Music]
I can't help but repeat myself
[Music]
[Applause]
[Music]
[Applause]
[Music]
[Applause]
[Music]
foreign
[Music]
first and dying
[Music]
he's sick he gave me asthma
to last one leaving
the son gave me cancer
the pavement hurt my feelings
[Music]
through the world
yeah I don't wanna
Touch Somebody
that's my department let's go
no appointment
no service or whatever
[Music]
hey Neil you could
can you hear that
[Music]
sounds good okay
[Music]
yeah I I hear it
okay
good I'm good
yeah yeah yeah okay neat
we are good
uh sure I mean I've half an hour right
yeah
I'll be safe
[Music]
here so we're gonna figure
out
[Music]
you think
she would go
to the majors
just fade the bad energy
I feel so hard like I'm chilling on the
beach
and it costs a lot
[Music]
Girl I Wanna Give You a ring
I'm spinning on the side
space
[Music]
because
[Music]
I
don't know
[Music]
sometimes
[Music]
so please
[Music]
do you mind if we try uh
turning it on I'm using it as a second
display Maybe
[Music]
the guys
hard to believe
thank you
there's the full screen
[Music]
foreign
right now
[Music]
foreign
requires okay so now we don't have
thank you
take a laugh
all right
[Music]
[Applause]
[Music]
thank you
[Music]
foreign
[Music]
thank you
[Music]
foreign
[Music]
thank you
[Music]
thank you
[Music]
foreign
[Music]
foreign
[Music]
foreign
[Music]
[Applause]
[Music]
[Applause]
[Music]
your family
[Music]
thank you
[Music]
[Applause]
[Music]
thank you
[Music]
[Applause]
[Music]
[Applause]
foreign
[Music]
all right it's two o'clock
on the nose
uh I don't know if you want to uh you
know get set up up here you just wanna
you know I can I can I can use the the
microphone
okay so I I do have
um a prize
for a lucky person it is not this laptop
um it is uh I will need your help with
the laptop I need you to hold it I need
to open it so I can read the name off
we took the list of people who are in
attendance today that were processed
through the Eventbrite check-in process
I assigned a random number to each
person we sorted by smallest
so that we have the number one person on
the list if you are here
Ken Chow no no I I swear this is not
this is the fix is not in I there's a
lot of people that
um I know at this conference I do know
Ken Chow full disclosure I swear to you
this was not this was not rigged
okay
um I will say that Ken deserves a little
bit of like you know luck to go his way
for a minute uh We've uh you know we've
we've we've we've we've seen we've seen
a few pretty exciting uh months um
um in the in the coal mine that we both
work in so you know congratulations Ken
um and thanks to everyone for getting
back on time that is the reason
um use that flipper zero in good health
do not get arrested
all right uh get ready to be amazed by
the Ingenuity of our next speaker on
here is uh the founder and chief
scientist of red balloon security he's a
leading cyber security expert with a
focus on protecting embedded devices
today he's going to take us on an
extraordinary journey into the world of
cryo mechanical robots in the extraction
of ram from Modern embedded devices
discover the Practical engineering
challenges and solutions behind adapting
the traditional cold boot attack
the good doctor here will even guide you
on building your own cryo-membrig
prepare to be inspired by the
possibilities as we dive into the
fascinating world of embedded system
Security on take it away
thank you for that thank you
um and yeah let's go for a
inspiration all right I think that audio
works I'm going to play a video that
Neil made that's super cool
does it work yeah
[Music]
wait wait wait wait un unhear that
that didn't happen
um
oh yeah okay how do I swap this place
swap display
yes
all right okay all right let's do that
again
okay now you can hear it now you can
hear it
VIP
let's kick it
all right stop collaborate and listen I
sit back with my brand new inventions
all right so uh Neil made that is he's
back over there somewhere and um that
this is a documentary so that's exactly
how the research happened that's that's
that's all there is to it
um but yeah let's talk about kobud robot
machine thing
um so this is uh from RE balloon it's
special presentation by the Revlon
security special effects Club yeah
um okay but before I get into this uh
there is a alarming Trend that I must
address and talk about with all of you
dear friends colleagues and other
peoples and things the trend that I'm
talking about of course is this current
unchecked replication
of Jordan so for those who know John
kataria uh he had a he had a baby last
week uh so Luca well done
[Applause]
all right okay so cryo mechanical memory
X traction
um what is it
it looks like this so just to give you
an idea the robot that we built is
actually back over there if you want to
you know come look at it and play with
it I definitely encourage you to do that
but this is um what the thing does
it stays completely still without moving
okay all right
[Music]
thank you
all right so now we're going to talk
about why why build this machine what
does it do you know what what is its
purpose so the thing underneath the the
copper block on the Piston is a DDR3
memory chip
um and we're cooling it we're taking it
putting it onto a computer we're letting
the computer do its thing to the memory
and
when it's done we pull it off and we put
it onto an fpga so we can you know get
some insight into what the computer is
thinking and doing and stuff by
extracting physical memory
all right so
um and this is uh I'll do this again
um work that
a number of us at Red Balloon have been
working on over the last 18 months it's
really nice to kind of reflect back and
talk about the process that we took
because um
it's 18 months of failure so the
greatest philosopher of all time once
said you know I can't
you know see him coming down my eyes I
gotta make these slides
cry yo
one person left that's good all right so
uh like I said you know so this is the
thing that we did
for the last 18 months or you know two
years this is a small portion of the
failure inside a larger story of more
failure
um but what do we win in the end we did
get some really interesting results uh
like a little drizzle of a win so here's
um you know on the surface that the
output right the outcome of what we did
so we wrote two papers um there are a
lot of details in in both of these
papers I definitely encourage you guys
to check them out and the uh the wood
paper is much more about just you know
the the engineering that went into
building this cardio mechanical memory
robot thing and the second paper that we
published that host is uh about all the
technical details that we found uh
inside the um the Siemens S7 1500 PLC so
what is that about so what is what is
this so here is um on the left side you
hear the in the burgundy kind of color
right you have the Siemens uh PLC market
share in North America and the bottom
one is uh in Europe but if you kind of
average out all the different major uh
markets the PLC that Seaman makes that's
their Prime Time offering is the S7 1500
and it makes up about I don't know like
30 35 maybe 40 percent of the the
world's uh sort of Market of currently
deployed plc's
um and this is the the version of the
PLC that they made after the host ducks
that thing if we remember that right so
they redesigned it put more Security in
place
um and uh and that's the that's the
platform that we looked at and the the
problem or the vulnerability that we
found and disclosed is um missing
immutable root of trust thing so secure
boot is broken and this is the the list
of devices that it affects
and then there's the second page
there's a third page
and a fourth page right there's a fifth
page six seven eight nine I think
there's 13 Pages all right so basically
at the time that we disclosed this I
think every single version of the S7
1500 plc's processor was vulnerable to
uh the thing that we're going to talk
about so
um and here's the uh the official sort
of um uh advising right so the basically
like every 1500 in the ground right now
is broken so what do you do about it uh
nothing so I read this email and my head
literally kind of exploded
um
yeah that's it's kind of nuts but their
official sort of workaround is we're not
going to fix it
that's it there's no second sentence or
a paragraph and then after that their
mitigation recommendation is
all that sneaky people near your PLC
right
I it
we can we can we can laugh at it but um
yeah well you know so but but here's the
right so you know if you look at the
market share you look at all the
different devices that that this thing
affects and the response to it right
this is probably actually
maybe 10 ish maybe even more of
literally all the plcs that are in the
ground in operation that controls the
world today right and if you look at the
the average lifespan or the service life
of these plc's and the fact that now
this vulnerability is is publicly known
and that there will not be a fix this is
the thing that's going to sit in the
ground and become basically a forever
day for the probably the next 10 12
years
and that's not okay I I think this is a
really big problem so you know there was
a win in here for for us as researchers
but I think this is actually a
problematic lose for the world right
like this is just not okay but this is
the state of the art of what
now
we didn't drink his actual trick so now
he's being forced to drink one okay all
right yeah
where would I be without friends you
know oh meow
meow meow meow
what you know
anyway so we drink we talk we think
about things all right so um that's
that's that I'm gonna get off my soapbox
and talk about the technical thing so
what did we actually win uh we we had to
stare at this stupid board for like two
years until he cried uncle right and if
you look at it you know it doesn't seem
like much it's kind of small it's the
size of like a I don't know like a
graphics card from 20 years ago and
right like it's tiny and it's got some
black rectangles in there and and those
are the chips and the rest of it you
don't have much but but why why did we
have to
stare at this for so long so this is um
okay so the the things that they did
okay so looking at the the hardware
design what I can say is they actually
did a really good job not at Hardware
security per se but but product
finishing so what what I mean by that is
you know they've taken away all
basically any useful introspection
interface so no debugging no no Ur
output of any kind uh the firmware is
stored encrypted at rest right and
decrypted at boot time and the key that
does all of that is uh in in practice
and in theory you know somewhere hidden
inside the hardware so
you can look at this thing boot up and
the little LEDs will turn on you know
once it's ready to go but aside from
that there was basically no way for us
to introspect or look into the device at
all let alone you know analyze their
firmware to see what the the at the
thing actually is doing at any given
time so
so that's uh that's the problem right
like no debugging no useful output uh
like I said when it once it turns on LED
blinks and then then you're done with
the the whole boot process so
you know it's in the secret is in the
computer but how do you get into the
computer right when you can't have any
sort of useful output and um the
standard sort of game plan at this point
I think is usually
I don't know let's poke let's poke the
thing with a weird stick of some kind
really let's cause a failure or a glitch
or something uh so standard approach one
would be you know let's uh let's sort of
try to inject some kind of fault right
so em clock power whatever it is
um but the problem there is um you know
you can if you crash the thing what do
you see you see nothing right like the
thing just kind of resets and you get
that stupid LED that like kind of turns
on uh it's just one pixel uh but not at
all useful information in terms of a
crash
okay so the second approach might be you
know take the the main sock right Decap
it uh and then question mark question
mark like do some fancy ninja stuff
um the problem is uh I don't we don't
have a scanning electron microscope
right so our chip decapping program is
basically me with Tupperware things
after everybody has gone home in the
office so
well yeah that that too yup yup so but
you know like and then this main sock is
also super duper proprietary a lot of
this is integrated so that whole thing
just screamed you know complicated
expensive
um
and maybe not doable for us
all right so the third one is um reject
reality right and and just go back and
say like okay I'm gonna try even harder
to find the JTAG port or the uart or
something but the problem here is like
this quickly devolves into an infinite
Loop you know like you say like ah it's
got to be there where is it I don't know
let's look more
um so that didn't really work either and
then the last one is just I don't know
say mean things to it and hope that
something falls out which wasn't
effective
so you know we looked at this Hardware
you know like we were defeated for like
a few weeks of just trying to get the
thing to tell us stuff that it it didn't
and then I sat down and I said maybe we
can get rid of all of this Hardware
finishing stuff if we can just like what
if we can just read its mind right what
if we take the memory of the thing when
it's running and then we rip it and we'd
take its face
uh which is um you know kind of what we
did and also right there all the other
ways are are valid but you know this uh
at the time and I still think this is
yeah yeah yeah I mean it's valid it
doesn't work great but you know it's a
valid thing uh but you know just looking
at some of the other Hardware that we're
seeing the trend certainly is you know
much more integrated sort of compact
right the devices with a single sock
that you can't really look inside or
touch the bus so maybe one so sort of
the device having encrypted memory maybe
one approach that can solve a lot of
these things would be to just physically
read the content of memory at a specific
time and if we can do that we can
actually get around a lot of this sort
of Hardware finishing things and solve
the problem for you know more than just
this one device but lots and lots of
other commercial devices that we're
seeing you know over the last two three
years
so
uh all right so I started thinking about
the idea and you know I talked to people
right and they say oh yeah of course
like kobut has been done like it's well
understood and that there's a paper you
check it out and this is the paper this
is um well so explaining data remnants
right in Dynamic like volatile storage
uh has been a thing I think people have
been talking about it since like the 70s
right so it's not all that new but you
know this was the first paper that I was
aware of that I read that you know
basically said hey if you take you know
like if you freeze memory like dram it's
uh and remove it from the device
um instead of the data evaporating you
can actually preserve the content of the
data inside the ram chip without power
for like maybe a few minutes the tens of
minutes and and from that you can
physically extract
the content of RAM and the advantage
there is okay like if you can do that
right like it doesn't matter if you have
I don't know trust Zone and blah blah
blah right like if the data and the
thing you're looking for is inside the
ram chip right at any kind of security
level uh you can take it and read it
right in in your own fixture
so that sounds great you know like
that's a cool thing but let's look
deeper into a closer at this right so
this was the original paper this was
like the graphic and um
I didn't Photoshop this this is
literally the person like upside down
can of air right spraying at the memory
chip like you know like like an abusing
that think pad which um yeah it worked
for for that for that purpose for that
for that thing but here's the problem
right like I don't have a laptop this
thing doesn't have a dim slot this is a
embedded device with the memory soldered
on it's DDR3 so the first problem that
we saw was uh
why come you have no dim slot right so
how how do you get the memory off the
thing you know like memory is still
memory right so data remnants effect
like by freezing the memory it should
still work but how do you how do you do
it right and then so that's the first
problem
um and then the lots and lots of other
problems came up right when we started
thinking about it for like two minutes
and here's one here's a specific problem
so unlike your modern you know desktop
or server or laptop well actually not
laptop those are glued in now but you
know like general purpose computers
right so you might have multiple sticks
or modules of ram that you can take out
from the interface one at a time
um this device not only had a single uh
piece of ram you know soldered onto the
board it had five right and they were
all used in parallel at the same time
you know with some error correction data
being stored on the you know across the
chips and then on top of that instead of
a five on like on the same side three on
top and two are on the bottom right so
if you think about how to actually go
about mechanically removing the thing
um that's that was hard so short of
building like a pie made like five
memory Ripper thing of death uh which is
mechanically super complicated right we
needed to um
maybe not do that but solve the problem
some other way so
basically here's the plan right so the
plan is you know we have we have cnc's
we have a little robots for like you
know like carving metal and then I'm
making things out of wood 3D printers so
what if we can Frankenstein you know
acnc machine right uh that at least
positions some kind of mechanical
Grabber thing at the right place at the
right time and then remove the memory
when we want to then we can at least
repeatably like repeatedly do the same
thing over maybe multiple chips all
right so that's number one if we can
break a CNC that could work and then we
have to figure out a way how to rip five
memory chips you know if you can't do
them all at the same time the other
approach is to find you know some period
of deterministic execution and rip the
the each one memory chip at a time at
the specific point of execution because
you can imagine like if you're you know
like half a second of it's ridiculous
you you feel like you know 100
milliseconds off all the bits are not
going to match up so reconstructing
memory is going to be really tricky but
if you can do it at the same time
over and over again repeatably that that
could work right and then after that you
have to maybe just figure out where the
error correction bits are and then smash
the memory content into something that
you can analyze and then all of a sudden
in theory if all that worked you would
have you know the code region the the
stack the Heap and and maybe be able to
reconstruct the bootloader code and all
of the intermediate data that the blue
loader uses so maybe it's whatever
crypto key and whatever crypto operation
it's doing right we can maybe get access
to the the content of that and who knows
what other thing we have to do and then
you know even if we did all of this
stuff right we didn't know that there
was a vulnerability in there at all so
you know let's see what the code says
but
I don't know maybe go from there and
maybe win right so here's what we did
so we started doing that
and this is the paper that talks a lot
about the uh sort of the engineering
challenges that we had but today I want
to you know keep this much more on a
practical level of if you want to do
something like this you can actually
build this machine for about two
thousand bucks and this is something
that's small enough that you can keep in
your office or apartment or garage or
wherever you guys live and it's really
doable from cod's Hardware
okay so here's uh basically what we need
right so this is a very early version of
of this robot but basically come up with
a precise-ish uh movement system that
picks up the thing and puts it down
right and then you know somehow if you
if you think about like a ram and Chip
text fixtures right they're usually like
hunky clamshell kind of things which is
kind of hard if you need to build a
robot that like unlatches that the
clamshell put the thing in the right
tension and put the show back on right
so maybe there's a better you know
socket that we can use uh but then on
top of that right so the third one is
important closed loop cooling so usually
you know this whole area of attack for
data remnants is referred to as cold
boot uh and the reason for that is first
you spray the can of cold onto the
memory chip and then you stop doing that
and then you take the memory off while
the memory is still cold but basically
you know as soon as you start executing
if you're not actively cluing the chip
right the thing's obviously going to
warm up over a period of minutes right
the things obvious going to warm up over
a period of minutes so if you had a
active cooling system right which is a
keeping the thing cold
for the entirety of runtime you don't
just you get the ability to
to do this not just a boot but pretty
much whenever you want so this is a way
that you can actually also rip like user
space you know program physical memory
content over the kernel so with cold uh
close active cooling you can pull the
mermaid trip up whenever you want right
so that gives us a whole lot of other
places to to do this sort of attack on
right and then get the timing and then
prove that we can do this for uh ddr1
lpddr1 ddr2 DDR3 uh and if it works then
great so
let's talk about how we did all this
stuff right so the first thing before
anything else uh you need something that
gives you like precise-ish sort of
mechanical linear movement right and um
the good news is uh
this you can just buy this this is like
500 bucks it's actually really good for
what it is people use it as like a hobby
as sort of like a wood router kind of
thing so if you want like an owl or
something carved out of wood this thing
can do it right uh and it's really cheap
so what for what you're getting
um the the controller is really that big
and it has like a parallel 25 port a 25
pin parallel port in the back that I
didn't know what to do with but like
that's not important but basically by
this and you take out the stuff that
really shouldn't be there so you junk
like pretty much all of this right so
you take off the motors you don't need a
spindle because the spindle like is the
thing that just you know carves things
right uh and this controller box is just
awesome and nonsense so you don't want
that what is good in here is you know
this is a platform that's basically you
know solid and it has a really good ball
screw like a ball lead screw uh and
these things are you know produced in
mass now so uh you for this money you
actually get something mechanically can
be really good
okay so so that's basically uh there and
then the thing to know about this is you
know when you buy this thing right it
gets shipped across the ocean and comes
to you and the thing looks like it's
solid and it's Square in parallel but it
is not right so every so basically you
get a collection of mini screws and all
of them are the random value of not
tight and for the kind of position that
we want uh you're gonna have to spend
some time to make sure that each of
these things are parallel and vertical
because otherwise you're going to get in
Precision that's going to just kill you
all the time right turn it into kind of
a nightmare
right so once we do that the next thing
that I did was I took the uh so instead
of using a stepper motor for the z-axis
where we're putting basically moving the
memory chip up and down uh we used a air
linear piston and the main reason for
this is because um you know that piston
is driven by air pressure so it has a
really nice soft pressure curve right so
this is a way for us to not have our
stepper motor like smash the the chip
into the board and destroy the whole
thing right so this is a really natural
way for us to apply the right amount of
pressure onto the socket with the memory
and the one thing that you control with
this is basically the pressure the PSI
right so we found this thing we
generally run it at like 10 psi which is
really little for what this thing is
actually supposed to do but it is really
good it is super cheap and very reliable
and you know talking about making sure
like things are parallel and true right
so what we're going to need is a shim
stock lots and lots of shim stock and
this is a activity that you you have to
do by yourself because if you're doing
this with a friend or any other person
for like you'd be doing this for like
five hours and by the end you want to
kill each other because you know let me
just shim this thing right everybody
does a little bit differently but lots
of patience uh and an indicator and we
actually got it to basically be pretty
good
um
yeah yeah I mean
no this is so boring all right now
anyway I have P I have not I have a lot
of patience okay anyway so once you have
the machine that in theory can move
reliably you know in vertical in
parallel like a X Y and Z axis
um the next thing is like okay so how do
we drive the the actual uh lead screw in
order to move the the thing to very
specific distances and a lot of people
would say like look man just get a
stepper motor step or step right like
you you tell it this is up like 20 you
figure out the revolution distance and
from there you're you're good but but
here's the problem you know like this is
like a very specific like you know
that's ideal case but what if you tell
it to go like you know 20 steps and it
loses a step right so you you can't
actually verify where you are in terms
of the expected place if you don't have
some other sensors and and also this is
uh in the real world right like backlash
is a thing leads Cruiser bent you know
so this is a all the sources of in
inaccuracy or in position that's going
to kill you over you know like a long
period right and also multiple
Dimensions so there is a standard answer
for this problem it's really simple so
you just take money
and then you convert it into Hardware
that works right so you buy the right
hardware and it becomes much more
precise and typically when it comes to
linear motion systems
um resolvers and encoders right so the
encoder is like pretty standard way to
do this and what it is is basically a
quadrature encoded sort of like a little
reading thing as we move uh your your
actuation system uh it basically counts
how many steps over the each of those
little ticks it has traveled so this is
a closed loop feedback system that tells
you okay I want you to go like 15
millimeters uh have you actually gone 15
millimeters and if not I can then
compensate and and change the the
stepping sort of commands that I give it
but you know so these are not terribly
expensive but like for a nice one you're
talking like 100 plus dollars plus you
have to write the code to actually drive
the thing and there are commercial
solutions for it but you know like
things can get pretty expensive pretty
quickly so
so the first thing that kind of was a
game changer for this sort of thing is
like there are all of these like really
interesting Motors that are coming onto
the market now so this is actually for
you know like small size CNC machines uh
mostly hobbyists but people make like
micronic stuff with with this and what
this is is it's the same form factor in
the same control basically as a stepper
motor but it has all this actual
real-time sensors encoders uh and and
the code that basically controls this
thing in a closed loop way right and it
basically is the same footprint as any
sort of drop-in replace stepper motor
and uh you know instead of like 20 bucks
this is 300 but what would you get this
thing is actually really really good
all right so that's one approach the
other approach is something that I
actually super like
um so instead of doing all of that with
all the sensors and monitoring the
current and the torque and stuff and the
real-time control right there was this
uh open source project that you know I
think a lot of Chinese manufacturers
have kind of adopted but basically you
have a board uh you have um a kind of
like a stm32 that does real-time control
and you have a hall effect sensor right
that keeps track of rotation through a
magnet and then you glue a round magnet
to the bottom of the shaft of your
stepper motor that costs you like 30
bucks so you can buy this right now on
Amazon for like yeah 20 27 and it comes
with all of that and basically gives you
real-time closed loop control at least
as far as rotation goes right so the
next thing you have to do is make sure
that you know once you rotate your lead
screw one turn that thing actually is
well made and manufactured correctly and
if you don't lose any steps uh this will
be pretty accurate so code
here's uh some videos all right so let's
look at this
so this is uh the CNC machine moving
with the Technic motor that I talked
about and that's a little indicator
we're basically moving the thing twice
uh and hitting you know basically
measuring the position right of that
edge and basically that's what they call
like dead nuts right so like for 300
bucks and the CNC where this little
mechanical machine we were able to get
reproducibility Precision around I mean
this is half a thousandth of an inch
which is like 12 and a half microns and
it basically is dead nuts so you know
like single digit Micron repeatability
on this machine that basically was like
800 bucks right so that's pretty cool
but so this one is uh essential another
little machine that we we built for
um doing a high resolution sort of like
photos of pcbs that we can then
reassemble right and we're getting
exactly the same result uh and these
motors are 30 bucks each right so this
is the hall effect sensor version of it
so you know you can go either way but
there are really affordable solutions
that allow you to take you know
mechanically something that's decent and
then add this kind of close loop control
to it to give you really really
impressive sort of precision and linear
actuation
okay so that's basically um the first
problem solved
all right so the second problem is okay
so if we can move the the memory like we
if we have the ability to position the
thing right how do we get the memory
chip like
onto the test pads or into the the
socket
um
in a in a repeatable way so here's the
game changer here right so uh unlike a
clamshell sort of test socket setup what
they have is um this is a like an
elastic polymer test socket which
basically is just silicone right that's
an insulator and then 3D printed Columns
of silicone with like dope silver or or
gold particles right they literally look
like little cupcakes right and the and
the thing over here is uh what that test
socket looks like under microscope just
you know with a standard Cisco phone
that we have back over there and so this
um it's compliant so it's squishy right
it has like the consistency of like a
little bit denser than Gummy Bear right
and what it does is basically if you
press like just hard enough then the
balls will compress the the vertical
Columns of conductive material and um
it it just works and the way you put the
socket on we literally just position it
uh with our fingers under microscope and
we add a little bit of Capstone tape to
keep it there on the surface no
soldering nothing right it's actually
super duper awesome and this has been
around for probably 20 years but you
know in the past uh you can get one of
these and they're really you know rated
for like awesome specs but you have to
like these are super expensive you know
Japan and Germany makes them but you're
talking probably about like a few
hundred dollars to a few thousand
dollars to get something like this
working
but we're in the future now so that's no
longer true we found I mean this is a
basically a standard supplier on
AliExpress or taobao one of these things
so we bought
um
what is it 40 of those sockets and they
do like short run custom socket fixers
because these are essentially 3D printed
so we got 40 of those for like a
thousand bucks
right and these things you know have uh
like a lifespan of you know something
ridiculous like a hundred thousand
compression cycles and they take up to
like you know Amsterdam's of power at
normal voltages and they can basically
do like up to 40 gigahertz blah blah
blah testing bandwidth not exactly
something we need but definitely
definitely enough for memory ripping and
also for uh it's definitely cheap enough
so once we have that right the next
thing is how do we make a thing that's
like close loop cooling right so you
know this is uh you would think this is
like a solved problem and it kind of is
but you know we need the temperatures
for this to be down like negative 50
Celsius and water freezes at zero right
so you know but I thought like if
there's one group of people that has
solved this problem it would be the
gaming sort of like overclocking
community and I started doing some
research and here's the state of the art
of how we cool computers like that
all right so
yeah like the thing on the right upper
right hand corner is a liquid nitrogen
evaporator cup and I was like I don't
understand how how how work right you
you what does it do so the way people do
this for overclocking high performance
Computing thing is you take a thermos of
liquid nitrogen and a torch okay you
have to have both and you pour the
liquid nitrogen well first you put the
evaporator cup which is a piece of metal
right on top of the thing you want to
cool which is generally like the
processor of the CPU or the GPU and then
you pour the liquid nitrogen by hand and
then you kind of like go with your gut
and say huh if it gets too cold
condensation will form so you take the
torch and then you heat the other side
of the board uh and that's the state of
the art
yeah I I know I know like it took me
like two nights to figure out like this
is this is how you guys do it so like we
can't do that right like I wanted and
needed something that uh doesn't require
this level of manual intervention so we
went to the machine shop and we built
this thing
it looks like a little piggy face but it
really is like a copper like a brass uh
water block
um and this thing gets uh so the liquid
inside can't be you know water it can't
really even be anti-freeze because
antifreeze generally freezes at like -30
ish Celsius so we ended up using
isopropyl alcohol like IPA 99 IPA which
I think free has a freezing point of
like minus 60 Celsius which is you know
pretty good uh and then uh basically you
push the liquid inside this uh tube
through a pump and you have a heat
exchanger that sits inside a bath of IPA
as well right and then you just toss
whatever cold thing into that ice bath
right or IPA bath as long as it's cold
it exchanges heat you know with the the
liquid inside and then the pump
circulates uh the liquid to the the
brass block and there you go right so
this is um this works so the thing that
you have to watch out for is uh well so
um dry ice it has a vapor point of I
think something like minus 50 which is
kind of perfect liquid nitrogen was
easier to get for us but has a vapor or
has a vapor point of 100 minus 198
Celsius right so that's like way past
the freezing point of any of these
liquids that you know we had access to
and then the stuff that doesn't really
freeze at that temperatures like crazy
Benzene stuff that I just didn't want to
touch so uh basically like you need to
have a pump that is
almost always like pushing ice or
isopropyl alcohol slushy
through the tube right because it's
generally not really all that liquid
but um but we did it and then another
thing that we found out is uh any kind
of impeller pump right creates heat and
it creates more heat than we can take
away from the diameter of the liquid
flowing through the thing so the only
type of pump that kind of works for this
is uh this thing called the parasolic
pump so this is the sort of thing that
they use in like uh dialysis machines
and stuff like that basically it this
machine pushes liquid through without
ever having the impeller or the
mechanical setup touch the liquid that
you're pushing through and it has like
basically this roller that is just
squeezing the tube and moving the water
or the liquid through that and it has
this really nice uh sort of effect of
not imparting too much heat right into
the liquid which is uh the thing that we
needed so that totally worked and this
is what it looks like
and we went liquid nitrogen last year
because I don't know if you guys
remember but like New York City had a
dry ice shortage because of the cold
chain it was really hot so we couldn't
even get dry ice when we wanted so we
built the system they handle both dry
ice and uh liquid nitrogen
so the thing goes Burr right like the
the water block gets cold and if you
keep the the ram chip on it it keeps the
the chip certainly below minus 50
degrees Celsius when things are just
working right
condensation is always a problem
and we have some practical ways of
solving that but basically like unless
you're in a really dry room you're going
to get ice build up on your memory right
and the way to prevent that is
essentially uh keeping the the memory
chip on the elastomer's socket so that
way ice doesn't get a chance to form on
the surface of the metal because it's
being compressed on the socket when
you're not using it and that was a kind
of like a pretty easy way to solve that
problem
okay all right so now we have the CNC we
have the magical socket we have a way to
cool it right how do we pull a five
memory chips off at the same time in the
same point of execution uh and
reconstruct the memory so we're doing
this at the bootloader and we've through
basically like guesses uh we confirmed
that this is essentially very
deterministic execution of code because
it is just a bootloader right it doesn't
have random weights so think about this
though right like this is probably the
800 megahertz processor Uh custom you
know like memory manager but you know
how do you pull the same well how do you
pull memory chip off at the same time in
execution you know even on something
like that's 800 megahertz you're
probably talking about like less than
100 nanoseconds of time where you have
some chance of basically pulling the
memory off right so that's that's really
fast and you know we don't have that or
we don't want to really have to engineer
out that precision
so here's what we did
we took a near field probe and we put it
onto the thing right and what we're
looking for is basically memory
stability right like we want to pull the
memory chip off when the memory doesn't
change that much and what does that look
like it looks like CPU bound operation
right so if you're bound by CPU
operations guess what you're not doing
you're not writing to memory so using
the the spec hand and EM uh emissions we
just basically found periods where the
execution is completely CPU bound where
we have memory stability so this took
the thing from like maybe tens of
nanoseconds of timing requirement to I
don't know like
had dozens of milliseconds right so like
a long time for us to be able to just
pull the memory off one chip at a time
where we have memory stability
okay and then we did that it worked
and
uh the next thing we have to do is build
the physical thing that actually reads
the the ram chip once we've called it
how to run on the computer Target uh and
and it's frozen so basically we just
wrote a like we made a little fpga board
so we actually wrote our first one
ourselves for lpddr1 for the uh the
Siemens PLC but we that sucked and it
was really hard and you have to keep you
know the inductance and the timing of
all of these lines uh the same or
controlled but then we saw that like
once we are talking about ddr2 and three
like fairly cheap modern fpga dead
boards just have that memory interface
built into it so we started using these
digital and uh you know like fpga dead
boards that uh had exactly the same
memory physical memory footprint layout
as the the chip that we wanted and all
we had to do was basically desolder the
chip put the socket on and and use this
thing which is like 200 bucks right
versus a custom board that we had to
roll out
all right and then the last thing we
have to do is
write some verilog right
I am not an fpga person so like other
people way smarter than me help helped
us do this uh
there's nothing more to say about this
that's it like
it was easy you know like nothing went
wrong at all like the timing was all
cool but yeah it took a lot of tweaking
but basically what we're doing is this
so this is the actual diagram for uh the
state transition diagram for DDR3 memory
so it's not as simple as just power the
thing up and then like send it to
command for read right there there's a
whole lot of State here for refresh
cycos for writing and reading right and
for idle but essentially you know if you
had to uh for the reader you don't
really want to you don't have to enforce
this as long as the chip gives you data
from the physical you know device so we
basically wrote our own little verilog
thing that had some of the state machine
stuff uh requirements less strict
basically as soon as we can pop the
memory chip on it will just try to put
it out of idle and continue to read
and and it worked actually so that was
pretty cool all right so here's what we
did right we uh built a CNC thing that's
pretty precise we found the magical
elastomer compression socket that worked
super awesomely and they're very cheap
and then we figured out this way to do
actual like close loop cooling with uh
that takes either dry ice or liquid
nitrogen we figured out how to extract
the thing at the right time and we
basically reassembled the memory chip
data across the five chips saw the blue
loader did the thing and then and then
it basically all worked
um and uh
you know so the actual robot is like
back over there is instead of me showing
you the the video like you should go
play with it but um after all of that
right then it became the the task of
like figuring out how the the PLC worked
and the Heart of the vulnerability is
this and this is you know super duper
interesting maybe for another date
another talk but um what we found is the
Siemens S7 1500 PLC like the secure boot
algorithm uses symmetric encryption
instead of signature verification
think about that right like I
you know like I how to express so
yeah instead of taking the signature of
the thing that it wants to boot if the
thing decrypts then it boots
that's it right and you know that's a
kind of dumb but like you know they're
like hold on hold on hold on right it's
symmetric encryption true but we have an
external security chip that escrows that
key right it's the A-Tech chip this is
like very frequently used I've seen you
know this used in like I don't know
security at several different radios and
car fobs uh and and things like this and
basically this is an external security
module that does a lot of what TPM does
but this speaks i2c and it's like a
hundred times cheaper and easier to
integrate and it does have the
functionality of like escrowing the keys
so you can't actually read out the
decryption key right which is fine
except like if we just remember one
second how
symmetric encryption works right so like
the same firmware has the boot on all of
the PLC instances so they have to use
the same symmetric key it has to be
literally inside the PLC right and this
is a whole thing about like mistress and
trust that secured chip is built into
the circuit board of the PLC but it
speaks i2c and it doesn't actually do
any uh authentication or security at on
that interface and basically it trusts
whatever speaks iqc to it so we just
bought one of these things and we
soldered the pin over there and we speak
i2c to it and we use this as an oracle
to encrypt whatever we want and as soon
as we do that you can make the thing
that's one block like one 4K block of
code that Boots the system so again
right this is like single digit possibly
double digit percentage of the entire
world's PLC infrastructure in the ground
today
there's no fix for this and this is
probably going to be around for like I
don't know yeah seven to twelve years
that's the situation of all of this and
we would have not been able to look into
this code and do this research without
our little robot friend who you know
helped us a lot so basically yeah that's
what we found that's the problem
um
I think that's it that's that's that's
all that's how I got
it oh yeah and right if you want to play
with the robot back over there like you
should come in and poke at it so
all right yeah
I mean not only yeah because like it
requires a lot of attention you know
like you have to like watch the thing
Sweat Right and it is so dumb like it's
it's not a good way to do it
um this way is better so yeah
do I okay so the question is um do I
have any insights on why they engineered
this so
the answer is like I don't have any
actual data like here's in my mind
though like me trying to think about
like how a lot of like many many very
competent Engineers designed this thing
with security in mind and somehow they
still made this so here's my hypothesis
right and this is a thing that's much
more interesting that speaks things
about the organization the way people
kind of work in engineering rather than
like technology but there was a group
that wrote like the user space code and
they said like we write the firmware
update OTA you know algorithm right and
we checked the signature right and once
we check the signature we then
re-encrypt the thing and put it on flash
so if we did this already like bull load
our group why do you need to do it again
right so I think there was a sort of
organizational boundary BS that
basically made people say like well we
checked the signature ones we trust that
group and because of that we just
decrypt the thing for performance and
reliability
that doesn't really actually answer the
question but like that's that's what I
think happened but yeah go figure you
know this is horrible
all right any other there was a any
other questions
huh
no homage is good what
oh yeah that's right that's right yeah
look at that oh you forgot you know I
run a company called Rebel and security
and we're hiring people so this is the
sort of embedded security that you want
to do we're in Manhattan uh we're hiring
people who wanted to do embedded
security stuff
um and there's a bunch of us over there
so please come talk to us
all right that's it thank you
really good
really good get it trust me when I tell
you there ain't no one else
[Music]
don't wanna be my best friend baby
[Music]
baby
say that I'm happy
[Music]
can't wait to be your number
[Music]
[Applause]
[Music]
[Applause]
[Music]
I might just be the one
before
[Music]
where everything's
but don't change
and it didn't take forever to find it
I was all on my own almost glad to be
alone until love came in
on time
off time
to be so hard to see
and loving is easy
everything's perfect
for me
[Music]
when you can't even hide it
and it didn't take forever to find it
I was all on my own almost glad to be
alone until love came in
time
[Music]
[Applause]
loving is easy you haven't up
history
for me
me
[Music]
[Applause]
[Music]
Express
[Music]
place
[Music]
you're a server admin just got served
[Applause]
[Music]
what you saying
[Music]
[Applause]
[Music]
I ran away from my feelings
my baby love songs
[Music]
hi everybody
uh thank you for tipping your bartender
uh we'll get some kind of a count on
where we are and the amount of drinking
we're supposed to have done by this
point in the conference
there is a there is a benchmark number
actually
um part of the uh way we we arrange our
agreement with Littlefield is in terms
of the bar
expense expenditure here and we have a
number we have to hit every day and I
don't know if we're doing a good job or
not but we'll get some details for you
soon
um one other announcement I wanted to
make
um a member of our of our of our family
here some some guest uh evidently lost a
stud earring
so if you find a stud earring you will
you will be saving someone's life
by turning it into a person with a red
summer con staff shirt and they will
help reunite it with its owner thank you
for your vigilance
now
our next speaker
Julian vennig
is a brilliant security researcher who
specializes in applying logic to offense
and defense
today Julian will introduce us to a new
kind of formal logic called
incorrectness logic
this under approximate program analysis
guarantees
let me repeat that
guarantees the detection of every bug
making it a powerful tool for formal bug
finding yeah that got the room quiet
foreign
Julian will also discuss an exciting
extension called adversarial logic which
brings explicit adversaries into the
equation
join us as we explore the world of
reasoning and exploit detection and
buggy programs please give a warm summer
con welcome to Julian vennig
hello
welcome to my talk my name is Julia and
I'm gonna work with you throughout some
interesting topic about
formal logic
to some I'm a mathematicians to others
I'm a hacker but truth is I love to talk
mathematics with hackers like you guys
the goal really for me is to try to
share knowledge as much as possible so
in this particular talk I will actually
go over
the
fundamentals first and not lose you into
technical detail that do not really
matter for your understanding
do a little bit of history about what
those mathematical techniques for
security has have been about in the last
20 25 years
and really
um
also share the latest three years of
research I've been up to with some of my
collaborators and before I started this
journey I was kind of feeling like that
a little monkey and I thought maybe if I
duplicate myself a million times I'd be
able to write Shakespeare
so before before we do we start with uh
some interesting interesting stuff I
want to really talk about some some of
the basic definitions that you guys may
probably be familiar with
what I love to do with these two find
bugs and especially those words that are
exploitable
and in order to
do this at scale back in the days I was
doing lots of code reviews I was looking
for bugs manually and try to write
exports manually
and really I love doing that but at some
point I really wanted to to do this as
at scale and in order to be able to do
this you need to write tools you need to
really sharpen up your programming
skills and make your hands dirty try to
understand the kind of bugs that are
true security vulnerabilities versus
those that are just benign bugs
in order to do this there are a few
fundamental concepts that you need to be
familiar with
the first one is the concept
[Music]
of program State let's let's assume you
have a little function function is
called func takes the Boolean argument
count
it's got a variable a local variable
let's say x you initialize these to zero
and if the condition is true
you increment this variable and if the
condition is not true it's false in that
case you recommend a variable
well what what are the program states of
this little function
first of all we'd like to differentiate
between the three states and the poor
states the pre-states are those program
variable values that are
before you execute a piece of code
and the post States is really the values
of those variables after you execute a
piece of code
for example in this particular program
we start the code we don't know what the
value of cone is could be zero it could
be one but one thing we know pretty much
for sure that x equals zero because you
initialize X to Zero at the beginning
and after you execute those two lines of
code you have two states possible either
x equal one because cone whatever was
one so you incremented x x plus plus E2
the state that contains the two
variables x with value one and the con
with value one or
in case the condition was Zero was false
then you're going to the else branch and
in that case the post state will be the
value of x minus one and the value of
the condition zero
and this is not much more complicated
than that a program state is just a
vector of value that contain the value
of variables at that point in the
program
so that's interesting to talk about
individual states of a program but it's
very cumbersome of course you have very
large programs these days we work with
programs that are not anymore just a few
hundred and thousand lines of code we
work on programs that have millions of
lines of code tens of millions of lines
of code so do we want to enumerate a
reprogram state to make sense of what
the program is supposed to do probably
not so there is a way to abstract this
understating abstract
the how you will look at the program and
that's where logic comes into play and
particularly I want to talk about this
notation course sequence calculus
the sequence calculus is really a
on the left hand side here it's a a
two-fold structure where you have the
premises meaning that what you assume
your assumptions
and the big line was under the big line
is the conclusion so when I whatever you
actually know something and you want to
derive you want to infer some new
knowledge based on the fact that you
know you want to derive more knowledge
you write that line to say premise what
I assume what I can deduce from that
knowledge I have
an example of such rule is very famous
it's called emojisponents
which specifically means late input in
place for example in the Modi spawn is a
bonus rules what it tells you or it
allows you to do is to say if I have the
knowledge that a holds that a is true or
a is provable depending on your
interpretation and I also know that from
a I can't derive B
I can derive B
meaning another way to take a look at
that if I have a a Coke machine and I
put a one dollar bill in that cook
machine is a and if I put a dollar bill
in the cook machine a that gives me a
coke B then I have a Coke B
okay
and interestingly you can combine you
can combine those Concepts so what a
triple a semantic triple actually is is
this notion of free condition and post
condition typically where you try to
characterize the pre-states of the
program and the post states of the
program using a relation and that
relation is really a function or a
mapping if you will between what the
states of the program actually are at
the beginning versus what they're going
to be after you execute your piece of
code
and typically we know that pcq saying
that the fragment of code C or the
program C executes in a pre-stage that
satisfy the precondition p and the
program piece of code C terminates that
is going to end up in a post state that
satisfy post condition queue
for example if I start in a state where
x equals 42 and I execute X plus plus I
increment X well my post height is going
to be that
um is basically the value of memory that
satisfy x equals 43. the beauty of that
first of all it doesn't necessarily talk
about any part any program in particular
those are rules that you can use for any
programs
and in fact some folks describe those
rules for every possible program grammar
programming language grammar that you
can come up with and basically Define
the semantic of a programming language
or programs written in that programming
language based on the rules and chaining
of those rules
so if you combine this concept of triple
and this concept of
inference or this concept of sequence
calculus you have what happens at the
bottom left
you have something known as the
consequence rule the consequence rule
say the following
if you know that a program starts in a
state satisfying precondition p executes
and terminate and end up in a state
satisfying post condition queue and I
know that I have a logical inference or
a logical consequence that tells me that
if Q holds an S holds as well
then I can derive a new triple and that
triple is PCS
a little example if I have a program
where the state is x equals 42 and I do
X plus plus then I know that x equals 43
we've seen that before but I also know
that if x equals 43 then X is bigger
than zero right it's a logical
consequence of x equals 43 to be bigger
than zero therefore I can derive a new
triple that says if I start in a state
satisfying x equal 42 and I execute a
piece of code fragment X plus plus then
I can know that X is bigger than 0 after
that
and in fact somebody called Tony
in 1969 wrote a paper called an
axiomatic basis for computer programming
for which he won a touring award
and what Tony Hawk did in 1969
was that he actually created a logic
like this based on derivations and he
basically defined every
you know conditional
and assignments in various program
constructs like this the semantic of
such construct based on this notion of
triple for example in order to model an
if else
if I have a piece of code C1 let's say
in that piece of code C1 if executed in
a pre-state satisfying p and B
leading to post opposed to a satisfying
q1
and I have also another piece of code C2
if executed in a pre-stay satisfying p
and not b and provided C2 terminate
terminate in a state a post-state
satisfying post condition Q2
then I can actually form I can combine
that knowledge to explain why the
semantic Governor if statement is
what the symmetic code if statement if B
is an SLT basically says if I start in a
pre-state satisfying precondition P
independently of whether or not B holds
B is true or B is false I know that I'm
going to end in a state satisfying
either post condition q1 or post
condition Q2 either I'm going to go into
the if Branch or I'm going to go to the
else branch
for example if I take my little program
here down there my function f that takes
an argument Y and I start doing x equals
zero I have a little conditional if Y is
smaller than 10 X plus plus otherwise
x minus minus or apologies for the typo
else minus minus and then I want to know
whether that defi that um
that particular that particular line of
code x equal y divided by X is is safe I
want to know for example if x can be
zero otherwise I would have a division
by zero and division by zero is bad
right for those of you who've done some
programming I'm sure you had some
division by zero errors or exception in
the past or signals sent to you or your
program
and so the way you derive the
symmetrical program like this is in
Google logic and the rules of whole
logic is that that you start with the
precondition assuming I know that or I'm
just stating that the value of variable
Y is V independently of what the value
of V actually is just a value I go
pre-state to pole State using the rules
of the program construct that my program
is made of and I derive a new
condition for my program let's say that
x y equals V and X equals zero so far
not complicated the little hat means and
in logic if you confuse you can just
think of an end it's vertically logical
end
and then I continue I continue to
interpret my program and I say okay now
what if I enter the if well if that's
the case and there's a very convenient
way of encoding those conditionals in
logic is to use the implication
I can say things like Y is more than 10
implies x equal one right I rewrote X
which was 0 to a new value X plus plus
which is equal one so my new post
condition after the if if is y equal v
and y is smaller than 10 implies x equal
one and then I keep going I keep going
or I may actually want to know what's
happening in the else Branch y equal v
and y is more than 10 implies x equal
one or Little V on the other side you
say or or Y is bigger or equal to 10
implies x minus one so again little typo
here this should be a x minus minus
and then I want to know if that's safe
well yes it is safe right the possible
values the state of X in that case are
minus one or one and it's perfectly fine
to divide by minus one or by one
therefore no problem
little scale problem however as you can
see for five lines of code we already
have a formula that basically takes the
entire screen
if I imagine this on a million lines of
code obviously you're going to have very
very large formulas and that becomes too
large to actually be practical to solve
so how do we solve that
and as he stage I started to understand
a little bit more about program analysis
although I didn't look
not much more than you know somebody
from a Disney Channel movie
um any questions so far
everybody is an expert in program now
this is beautiful
all right so how do we solve this
problem of of having very large programs
in tracking the states of a program
based on those free and post conditions
well
a little while ago but program
abstractions were introduced where now
not only we're working on concrete
values of the program but we're working
on abstract values and those
abstractions can be anything
as long as they satisfy certain
criterias
one abstraction I want to talk about a
little bit is the interval abstraction
because interval abstractions are
extremely popular
in here instead of actually having a set
of values that my variables actually
hold I have an interval of values in
which my variable is located so
obviously there's a kind of formula you
can
generate or you can derive are much
smaller when you use an abstraction like
that because you don't need to track the
value of every single possible path you
just need to track intervals of values
so you do exactly the same thing same
program you start y equal v y equals V
and X equals zero y equal v and y
smaller than 10 implies x equal one
y equals v and y smaller than 10 implies
x equal 1 or Y big or equal to 10
implies x equals 1 is 1.
and at the end when you merge you have
the you know these diamond shape right
in the control flow graph you have
you're like you start and you have the
if you have the else and then you merge
the program so what do you do do you
actually keep track of all the values
for every path or you do some merging
and these are interval abstraction
allows you to do that where simply
you'll have one particular numerical
object to track every possible values of
that variable for every path
well in that particular case we can say
that X is an interval minus 1 1.
well is it safe now of no because zero
is part of the interval minus one one
and therefore what we just discovered is
that when you introduce abstraction in
program analysis then it leads to
something called incompleteness which
basically introduce false positives
you've used static analysis before and
you you probably hate all your species
for uh for spot achieve or that's
exactly why they show up because people
use two strong abstractions
and what's what's key a key inside
around abstraction is this notion of
over versus Under approximation
and
this notion of over approximation has
been
studied for a very long time with
abstractions abstractions are typical
typically over approximation of the
program Behavior because in some sense
the number of program behaviors that you
are allowing the program to take
is a bigger is a superset of the real
possible program behaviors like for
example I had a program behavior that
led to my variable X having value 0 at 0
by is else and I know it's not possible
according to my program
so I over approximated the semantic of
the program
in the other hand I can also do under
approximation
so if you look at the top left you see
the exact tracking of the state you
start with a state where value of x
equals zero and you do X plus plus you
go to a state where a value of x equal
one on the other side if you do minus
one is you go to a state where value of
x equal minus one there is no State
merge you track all states separately
and you that leads up to very very large
State space for your program
or you can actually be smarter than that
you can try to to merge nodes as we
explained say I have intervals and I'm
saying you know what I don't want those
nodes to be separated in my
representation I'm going to just use one
node and I'm going to call that minus
one one for you know the value of the
interval so 0 would be the value the
interval 0 0 1 would be the interval one
one minus one would be interval minus
one minus one and then finally after you
emerge minus one one
that's over approximating or o x
as you can notice over approximation
doesn't mean you have more nodes you
typically means you have less nodes
either the hand I can also
do under approximation using a technical
path dropping
let's say I really care about one
particular behavior of the program
because I'm trying to basically do some
testing or maximize my cooperation I
really want to go on the left side of
the if else well I can decide just to
drop the entire right or bottom path
here and focus on the one where the
value of x equal one well what's
interesting about that is that I
diminish the amount of nodes that is
needed to represent my program and I
introduce no abstraction no approach no
over approximation
right I still have the same state as
before I just have less States
and that's a key insight for the modern
Logics we're going to talk about a
little bit later
another really key idea so instead of
doing these abstractions
what can we do to manage those very
large program analysis there are two
particular techniques I want to talk
about one is based on something called
separation logic
and the second one is incorrectness
logic which I'll talk about just after
that
separation logic is also a formal logic
using the same secret calculus notation
where you derive new Knowledge from
premises to conclusions and it allows
you to do three things one it allows you
to manipulate or analyze programs with
pointed data structures such as list
trees graphs and all that
it does this by introducing a new
conjunct a new end and that new end is
the star end
so instead of writing a little Hat B to
say A and B in separation logic we write
a star B that you can read by a and
separately B
for example on the right hand side here
if I start a program in the precondition
p
or stay satisfying for condition p and I
execute an allocation say x equal alloc
of n n bytes well what I can derive from
that in separation logic is that
p
is still holds provided actually X was
not part of P
and separately I know that X point on a
valid location l
or let's say L1 in that particular case
you know one here
and I execute another allocation y equal
m well I know that the Y is going to be
a separate location and x and provided Y
is not part of p i can now derive the
post Collision that P and separately
exponent on value location L1 and
separately again I know that exponent
value location L2
there's no initialization of those
variables here so I didn't actually put
any value they just point on a location
so what's interesting about that is that
what you're doing when you introduce the
star of star conjunct is to basically
say you know what I can express my
programs internal logic by having sub
formulas and those sub formulas they
don't have any common variables between
them
so if I see a piece of code and that
piece of code touch variable X I just
have to actually select which of that
sub formula this is a part of the big
formula the sub formula part that
contains X and update that thing and I
don't need to touch anything else
because nothing else actually contains X
knowing that it's a separated conjunct
so this basically allows me to do local
reasoning it's called where you can
actually
um
derive the pre to the post from the pre
and just update specific sub formulas of
your logic
this is one way that you can actually
tame this
um this state space explosion because
instead of having a big product space of
every possible value you have more like
a union space right you is a union
between the sub programs
the state of the sub programs
another really important
um core idea of separation logic is
something called a frame role
the frame rule allows you to do two
things what I call begin anywhere
analysis and also compositional analysis
begin anywhere now this is what you
expect it to be compositional analysis
is really that you can analyze typically
each function separately and Stitch the
logic at the end so you don't need to
follow every call Path and go and come
with a return and the calls and the
return Etc that leads to very long
traces what you can do is to basically
analyze each function separately and
Stitch it at the end because you're
using those separating conjunction you
know that each of those function logic
are independent from one another
and particularly when you have these
function call say function G being
called with argument X
and you know that p g of x q hold
well if x if there is
a sub formula of p and Q say let's say f
where
X is not part of f
is
preserved across the call GX
for example
if F describes the value of x at the
bottom here I'm calling p g x of Q
and then I know that P star x equals V
holds and I call G of X well I know that
x if x is a local variable to my caller
X the value of x is not going to change
by calling G therefore I know that the
whatever value was in X before the call
will also even be in X after the call
so I have these frame F this Frame
condition or this uh
the sub formularity that allows me to
really make sure that I don't have to
rewrite the entire formula every single
time
I factor those three and post conditions
independent from one another
so those are two main IDs of Separation
logic where you can begin anywhere you
want you can compose local analysis
together
and you have this notion of of locations
where now you're able to deal with heat
variables and hip data structures by
having this concept of locations and the
points to set that correspond to that
location
so that's a very very important advance
in large-scale analysis for some of you
who may know some tools for example like
meta
infer
which is pretty pretty famous it's all
based on separation logic
these State space explosion is to use a
technique
um from incorrect nostalgic
incorrectance logic was created by Peter
o'herne
and published the principle of
programming languages 2020 2012. I'll
dragon 2020.
Jake has two concepts that are really
makes it new and really Innovative
fundamentally Innovative the first one
is that it has pass dropping on the
right side
pass dropping is basically just
formalizing what we have seen here a
little couple of sides before the bottom
right where you can basically decide to
draw a path that you don't care about
and that still make you analysis correct
right you just analyze less behaviors of
your program
and what you're saying is that if I have
a piece of code C that starts in a
precondition p and it finishes by either
q1 or Q2 let's say you know C was an if
else okay it finishes in state q1 if he
goes to the if or if you should say Q2
if it goes to the Earth
well it happened that you can drop
whatever q1 or Q2 you want with AI being
either one or two in that particular
case so you can Define this derivation
in your logic that goes from a triple
that says p c q one or Q2 to p c q1 or p
c q two you don't have to keep the
entire disjunction the entire or in your
logic you draw a path
and that doesn't introduce any
abstraction in fact it's an under
approximation
and similarly if you have two paths that
leads to the same conclusion Q P1 or P2
those two path and that leads to the
same result Q well you can drop either
P1 or P2 because you know that the past
p1cq is valid and the path P2 CQ is
valid as well so you can actually keep
one of the two P ones or p2s in your
derivation path dropping by the
precondition
and one additional
characteristic of incorrect nostalgic is
that it has two kinds of post conditions
it has what's called the OK post
condition and the error post condition
where if C succeeds you can actually
derive The Logical facts of your program
in queue well if C fails you actually
derive the error conditions in post
condition r
and that is key
if you want to actually start
understanding what can be made of those
errors for example if you're a security
researcher and you want to know you
don't want to track possible error
states of your program you don't want to
just say oh I'm sorry there's a bug in
your program stop right here no you want
to basically continue analysis statement
after statement and track those error
conditions that you can reach well
that's why the Air Attack here allows
you to do it allows you to basically
keep going and keep deriving more and
more knowledge not just of what the
expected behavior of the program is but
also the error behavior of the program
and after I've learned about that about
three years ago I felt like I was you
know almost ready to go for a planet of
the ape casting
so I felt a little bit better about
myself but still I couldn't make sense
of all of these mathematical symbols
behind
any questions so far
[Music]
speak louder
oh boy
it requires it
nice good luck
kimina it's very hard for me to hear
what but we can we can take this offline
so if you want to ask a question please
Shout
any other question
the question was if you have multiple
branches how do you choose the interval
is that the means in the max yes that's
what it is it's typically the union you
take you you want the interval to be
dense right so you basically want to
have just a Min and a Max you don't want
to have a union of intervals so you have
two intervals from zero to ten and from
10 to 20 then unionizing that makes one
interval of zero to twenty
more questions
very good
why can't we be the questions as well
what is what if you have a very large
program that has a potentially
unbalanced amount of executions for
example a loop that never terminates
good question what's interesting about
under approximation is that empty set is
a valid under approximation
right so as long as you are a subset
maybe a finite subset
that is under approximately potentially
an infinite set of execution that's the
valid under approximation so you can do
that
last question
do you have to rely on the user to
Define what the error behavior is
yes and no
if you have the semantic of a
programming language that is defined
once and for all
the user doesn't have to actually modify
the defining it's like for example if
you have a pointer and that pointer
value is null and you do star P equal 42
while the user doesn't have to tell you
anything to know that star P equal 42 is
a bad thing when p is equal no
right if however you want to do you know
you want to use that too as more like a
cyborg like AI assistant let's call well
you you may insert have some assertions
right you may add a session in your
program and you try to say okay what
paths can lead to that assertion being
violated being unsatisfied
so you can combine you can do both
okay and in fact in many programs people
actually create their own specification
you create a specification and then you
use a logic to derive facts and you see
if those facts imply your assertions
okay
next
concrete Logics are we getting to the
serious stuff
another another operator that people
started adding to program logic is the
parallel composition operator noted two
bars
okay if I say C1 two bars C2 it
basically means that C2 C1 is partly
composed with C2
for example if I have a program C1 I
start in precondition P1 ends up in the
post condition q1 and I have another one
C2 that start in precondition P2 and
goes to post condition Q2 well the way I
write that triple is by saying P1 and
separately P2 C1 parallel P2 C2
post condition q1 and separately Q2
and I can track the state of a pilot
program like that of course here there
is an assumption we say that the
variables appearing in P1 are strictly
this drawn from the variables appearing
in P2
and same between q1 and Q2 so those two
programs can execute in parallel but
they can never share anything
it's pretty Limited
and so
how can you analyze programs that are
potentially sharing ownership right they
have variables where some variables
actually shared across the threads you
know they're not there's no clear
ownership between thread one or thread
two says there's a variable X that's
manipulated into two different parts of
the multi-thread program
well a few last year as a matter of fact
Azalea arrived and her like her
collaborators created neurological
Sizzle concurrent and correctness
separation logic and this allowed you to
actually combine the incorrectness
principle with this concept of
concurrency where now you don't
necessarily require that those variables
are actually separated for example you
can start analyzing programs like that
with race conditions where you have one
program on the left it's allocating a
variable x x equal alloc n and then you
write something into X star x equals V
well too bad if you have a parallel
program composed with your program and
that does 3x and we're talking about the
same x what happens when if you do one
three two if you execute one the
scheduler actually swap to this other
thread execute free x and then comes
back to your your previous thread and uh
star x equal V well you have a bug right
because then you try to run into a
pointer that was free
so these concurrent incorrectness
separation logic allows you to reason
about programs like that
even further
last year I took the same concept of
parallel
parallel or concrete logic except that
this time I wanted to start analyzing
exploit programs
where I say okay that's fun you can have
two programs P1 is in parallel to P2 but
what if in fact I have a program that's
an adversarial program a in that program
just as an encoding trick for the logic
I'm going to compose in parallel with my
programs I'm trying to Target
well say P1 in parallel with a or P1 and
P2 in parallel is a well it's kind of an
at least in Bob logic but except that
the Alison bar representation typically
used for cryptographic protocol analysis
can also be used for implementation of
protocols as such so instead of actually
analyzing necessarily just raise
conditions using this concrete logic
you start to use
that encoding in the logic to actually
analyze the interactions between a
program and an adversible program
for example you may have a program all
it does is to actually write X and read
Z in another program that read why and
then write write y plus one
let's say you execute one two three four
in fact
I mean one three four two I'm sorry in
fact it says the only execution you can
actually do because the read at line
three expects the right at line one and
the reader line two expect the right at
line four
so you can start shading execution
between multiple programs composed in
parallel potentially with shared
variables or not
and then you can start to say okay what
does that mean to do execution one three
four two what that means I start in a
pre-stage satisfying x equal v and y
equal whatever value doesn't matter and
also Z equal whatever value doesn't
matter and then I execute my program
this final composition of write X read X
write y read write y plus one and the
result is guaranteed to be that if I had
x equals V at the beginning then I'm
gonna have that Z equal V plus 1 at the
end
so he started allowing me to actually
reason about interactive programs and
with the reads and write Primitives and
that start to become interesting to
study exploits let's take a small
example it's a quite straightforward
example for the sake of of this
let's assume that you have these program
on the left this program on the left is
a little server piece of code and all it
does it basically reads on the socket
into this cred this credential
byte and if uh the specific secret was a
randomly generated value is actually
what I provided my error code is going
to be zero or if my secret was too was
smaller than what I provided it's going
to write error equal one and if my
secret was bigger than credit he's gonna
write R2
of course if I provided the right value
for the secret it's going to serve the
client as it should
and no matter what is going to write the
error code back into the socket that it
reads from
well there is a little problem with this
program right well
we're standing the fact that the secret
is on 8 Bits which is ridiculously small
the problem is that there is a
information disclosure variability I'm
not going to call it a side Channel
because I got picked on for that but
let's call it indirect information
disclosure where somebody can actually
guess the value of the cred or the
secret
based on a very small amount of
interaction you can have with the
program that's why the program on the
right side does which is the adversarial
program The Air Resource program's goal
is really to
find a state
for the program a compose B well P
compose a the my program composed with
my adversarial program for which this
particular assertion can be satisfied at
line 14 where I basically have radical
zero meaning I guess the right Secret
so one interesting change that you can
notice in other serial logic is that
assertions in adversary logic they are
attack assertions they are not
verification assertions they are not
program contracts call contract they are
conditioned that the attacker actually
drives in order to bring the program in
an error state
so you only need to have one particular
path satisfying this particular
assertion for your program to be
vulnerable
hence
such analysis fundamentally
underapproximate because you don't care
about all possible behaviors of the
program what you care about is to
isolate one particular behavior of the
program for which your attack assertion
holds
so let's look at the program on the
right side a little bit
what it does is that you start by a
random value or a guess get a random
guess let's say maximum on on of you
into eight and then it's got the step
variable
where what it does is I basically divide
the step by two
and add one as an initial step value and
until my step is not zero what I do is
that I keep dividing the step by two so
it will eventually reach zero
here what you can do is uh in a in fact
in a linear amount of attempt in the
side of the secret and in that case
let's say eight in eight plus one
attempt you'll be able to discover the
value of the secret because you you can
leak one bit of the secret per
interaction every time I'm actually
trying a value a credential value either
it's going to be the right value or it's
going to be too big or it's going to be
too small
and if it's too small
when I'm going to do that I'm going to
diminish my guess by the value of the
step if it's
um
if it's too big you might guess it's too
big I'm going to diminish that very by
the side of the step if my value is too
small my guess I've got to add this step
and I divide this step by two
and if I do this a little amount of time
it's gonna lead to me actually
understanding what Rand uh the rent
eight the random value for the secret or
actually was in a very small amount of
Step
of course this particular scale
this particular example scales very well
as end growth for example if if the
secret was a 64-bit number or 128 bit
number or more
then you would only need that amount of
attempt to actually derive the secret
so in fact the the fact that the the
secret was just on 8bit for this
particular case was just for the sake of
explanation
so I call this one the oscillating beat
protocol because what's happening is
that you overshoot you on the shoot you
overshoot a little bit less you
understood a little bit less and you end
up converging towards the credential
and this kind of example can be
expressed in adversary logic
one level further
what if what if we took all of that that
we just thought about and we put into
one logic
I want to have the Chrome currency I
want to have the adversarial reasoning I
want to have the separation logic and I
want to have it in one log on logic that
can reason up with for everything I can
deal with sports programs I can deal
with concurrency issues I have this
notion of addressing or reasoning where
I have somebody trying to sabotage my
program within the logic
well it happens that we can actually
prove quite a lot of things with that
with that particular logic as I earlier
rad myself is George Berlin and Peter
Orrin just
um got a paper accident at the
International
Conference on concurrency Theory concur
where we actually uh explain quite a
number of examples including information
disclosure and things related to
pointers that can all be done within
that framework
and you can actually take a look at the
preprint on my Twitter
at this stage I'm you see I'm almost
almost not a nape anymore actually
pretty much near the final stage of this
Kafka is transformation
I'm not an animal even though I have
some ears and my dog is actually tagging
along
so are we done there's nothing else for
us to do
is as formal logic solve our problem of
adversarial exploitability analysis can
actually start generating exploit from
that
for everything I want well not quite
some of those some historical properties
are well known to be undecidable for
example
for I cannot for any program tell you
whether that program is going to
terminate eventually that's also known
as the Turing halting problem between
machine altering problem
and in Logic on computer heroes are
entering in Kurt color in the 1930s
actually uh worked quite had some
fundamental seminal work on this topic
where Kurt girl came up with his
incomplete theorem while Alan drink of
course came up with this halting problem
that is very known by everybody we ever
took a look at I guess a
complexity Theory
so what we wanted to do and we which we
have done is to understand whether we
could actually tackle this termination
property in the under proximate subject
meaning that we're not pretending to
actually tell whether a program is going
to stop for any input it means that we
are potentially we are able to actually
extract those subsets of behavior of the
program for which the program is
guaranteed to not terminate
so can I actually have some Magic by and
I send it to your service to your server
and your service is going to basically
get stuck into an infinite flow
or can I actually
exhibit this particular execution that
leads to a termination bug without me
necessarily having to prove termination
on the termination of a program
well the answer is yes
and
stay tuned for uh for this work that is
not released quite yet but you submitted
to the principle of programming
languages 2024.
if you want to learn more about this
topic you can read the seminal papers
and some of those recent papers of
course Tony horror and axiomatic basis
for computer programming probably a
really good introduction for anybody who
is not familiar with this topic you can
look at the concept or the theory of
abstract interpretation by Patrick and
rajakuzo came out quite a while ago and
you probably have about 100 different
papers to read on this topic if you like
or more
separation logic by John Reynolds and
Peter O'Hearn in back more 20 years more
than 20 years ago conquering separation
logic by Owen Brooks gave them the
guttle award
in 2016 from the work on concurrent
separation logic
still Peter or her in a few years back
incorrect on separation logic Azalea rod
and her collaborators concurrent anger
consideration logic mixing out the CSL
the concurrent separation logic and the
incorrectness
the adversial logic and finally the
latest evolution of those Logics Castle
for concurrent adversarial separation
logic
so as you go through your journey to
learn about program analysis bug finding
and exploitability to remember there are
always two sides to every story
Choose Wisely
and I'd like to sing sphere Martin and
chocolate for having piggy with the
dally images
and after all that I think there is just
one logical conclusion
we need more drinks
thank you
I have maybe five ten minutes for
questions
absolutely I didn't actually write large
scale examples here for the sake of you
know the presentation however if you
really look at any of those references I
listed you'll see plenty of those
temporal logic a really good question
has there been any attempt to actually
encode temporal properties in those
languages
temporal property like LTL linear
temporal logic or CTL computational tree
Logics is another logic part of family
called moral Logics where that have no
connectivity new connectors diamond and
square that says
roughly
eventually and necessarily
to my knowledge there is no
underapproximate temporologic to them
it's a very interesting Avenue for more
research however
last chance
well that's it then thank you
[Applause]
so uh two very quick announcements let's
take 10 for uh you know to to hydrate
very important to tip your bartender
um
also if you were interested in a place
where you could hear the presentations
and scream at the top of your lungs well
maybe not exactly that but be noisy
um Park life is running the stream of
the the conference you can go there you
can
drink there
and you can get food
thank you we'll see you in 10.
[Music]
foreign
[Music]
thank you
[Music]
foreign
[Music]
foreign
[Music]
foreign
[Music]
thank you
[Music]
foreign
[Music]
[Applause]
[Music]
thank you
[Music]
foreign
[Music]
thank you
[Music]
foreign
[Music]
[Applause]
[Music]
[Applause]
Target
[Applause]
[Music]
s
[Music]
[Applause]
[Music]
[Applause]
thank you
[Music]
[Applause]
[Music]
[Applause]
[Music]
[Applause]
very much
all right we're ready to get this thing
going again we have a tight tight
timeline
so here we go
I am just gonna hand directly over
two uh so we need to I guess switch the
inputs or something so that this screen
and that screen and whatever like I
don't know what the
I don't know what the the deal is here
but he's plugged in so we gotta you know
that's the one there's that's what I was
looking for okay good work everybody
it takes a village
a video Village in our case
um okay uh the relationship between
summer con and the pony Awards is uh it
it goes It goes back many many years
um
not enough time to talk about that
history but
the nominees have been uh released
at summercon and then voting can happen
and then people receive their Pony
Awards
or the news that they did not win the
pony award
at black hat in Las Vegas so we're very
excited to have
Ian and Sophia here to talk about
this year's this is it like this is the
world premiere
this year's nominees take it away
[Applause]
thank you
how is summercon feeling are we like
Tipsy yet are you still kind of working
on it
you're working on it all right I think
they're is there still a happy hour
all right
uh can you turn Sophia's mic on as well
please
awesome thank you all right all right we
got it okay so um you're gonna notice
that I'm just stepping through a uh like
docs document and don't worry about it
um so yeah this is the pony Awards uh to
get some things off uh right off the bat
um I want to say a huge shout out as uh
uh Mark mentioned uh we rely very
heavily on summer con they offer a
massive amount of support whether it's
like hosting a website uh infrastructure
uh you know like holding me while I cry
about this um uh but um this year
they they want the extra mile and they
were able to provide some uh materials
or they offered to provide some material
Security in order to stop
um Google tag from sending
assassins after us after that stuff
happened last year it's a long story
five years after it turns out it wasn't
an issue because they all got laid off
but
um
so uh let's get into it um
so uh over we had over 80 nominations
this year and you have to understand
what that means is we uh I also have
like around 30 nominations to go through
in about 30 minutes so we're gonna kind
of fly here
um all those have like research papers
attached to them so if you feel like we
didn't do an effective job of
characterizing how important your
special bug was it's because we didn't
um
so let's get going
um uh yeah uh bring out the yeah oh
these are the ponies
[Music]
um
so one of those is uh one that uh Neil
Durkin put some very hard work into from
Red Balloon and the other one is uh well
you'll find out uh but it's another uh
very special Pony award and if it looks
like a spray painted Candlestick with a
plastic horse glued to it uh it's not
it's a pony award all right so chill
um all right let's get into this stuff
um so first off we've got a count
exposure it's a local previsk and
windows performance counters by b2a hex
uh what's important about this
um was the first bug that's been
released at least in you know last
decade about performance counters in uh
in Windows oh I'm glad you read these um
all right so we've got uh OPN and rce
and render dock uh from our good friends
at qualis uh they always submit a lot of
really good stuff it's a One-Shot remote
exploit against g-lib C malloc in 2020.
I think the cool thing to shout out here
is qualis has made Pony nominations for
at least the last like five years yeah
they do some great work
and then we have a very we love some you
know video game hacking it's always very
close to our heart and they're like no
some of the best guys out there um
or individuals uh so this is a CS go uh
o day where they're using some logic
bucks uh to rce Counter-Strike uh very
very fun um there will be additional
information about all of these posted on
the website later on if you want to read
the research for yourself life hacks for
money when you can hack for internet
points exactly very important
then we have uh some mobile bugs
um it's uh I know Sophia has uh some
stuff to say here but we didn't get any
nominations for this this year uh but we
did get a nomination from Eric who
pointed out that he moves around a lot
and bugs people so he qualifies as a
mobile bug so we can thank you Eric for
dominating something and thankfully
there aren't going to be any
opportunities for a uh hit piece from a
voice about a supporting NSO group so
sorry guys but the neat thing about this
category is over the last few years
we've seen a decrease in the amount of
bucks for
um nominated for the pony Awards also
just publicized a line uh related to
mobile specifically I mean we estimate
that this is probably due to the fact
that Mobile's getting harder uh there's
less you know bugs that you can just
burn on a tweet or a blog post or
something
basically right uh so this category
we're now officially nuking because no
one uh submitted anything this year this
doesn't mean mobile bugs don't exist it
just means you're using them right now
you're not public yeah you don't know it
but you're using them right now it all
comes down to Mark incentives you know
it's all economics yeah all right so now
we have our favorite difficult to
understand a cryptographic uh attacks we
always need some extra help for this
category yeah and we did uh shout out to
Kai uh who helped us uh dig through a
lot of that I don't know where you
are but you can wave at you oh look at
this
um
uh so very fun uh interesting one
straight up uh practically exploitable
cryptographic vulnerabilities and Matrix
um from Martin Albrecht from Clary of
course clause
there you go um this is fun because uh
they found cryptographic vulnerabilities
in Matrix and element which is you know
I mean those are widely used pieces of
software for encrypted communication
we've seen mostly about Al-Qaeda
I'm not joking
um uh Mega uh very cool you guys
remember that like kim.com like weirdo
uh that's his thing I think still
so you know they were hacking at that a
little bit uh Ben Nasi with some video
game Crypt analysis uh yeah with the
video games yeah this is a really cool
one um they basically recorded an LED on
a phone and then through the RGB values
we're able to uh cryptographically break
it
then apparently it works
um so that's we believe him that's what
we determined from the reason so it's a
tough we don't always have time to like
vet these things so please don't lie in
your nomination
um don't tell the daddy yeah sorry
we have uh some songs I don't think
we're gonna like have the timer ability
to play them
but uh you want me to like beatbox it
it's no I know I'm I'm dressed for the
part but it's not going to deliver uh
got get in it from YT cracker which
sounds like an angry British person
um
clicking from Omi uh just uh describing
a phishing attack a theoretical fishing
the theoretical fishing attack no one I
I miss the scam wrappers
they were literally recording themselves
like doing credit card fraud in a
Walmart and that was the music video and
it was with complete location
information and everything spectacular
um and then we have Pegasus from
laughing Manus he does a lot of music
um and shout out to Hugo from Recon for
taking the time to submit like 10 yeah
which weren't necessarily songs
um
but it's the thought that counts and it
kind of delivered so um it takes the
community to make the pony Awards happen
exactly a lot of these were actually
from uh Recon as well uh there's a lot
of good research that happens there
shout out to Montreal
um you've got most Innovative research
now uh inside Apple's lightning uh
jtagging the iPhone for fuzzing and
profit from guidra Ninja this is a
really really cool one uh as I
understand you basically built uh like
iPhone uh jtagger using a lightning
connector for like 10 bucks which is
baller it's a good return on investment
yeah
it's a very common one
um so this is single instruction
multiple data leaks and Cutting Edge
CPUs AKA downfall from some folks at
Google
um it's embargoed and you can't know
about it so keep an eye out at uh it's
coming out at black hat on I think
Tuesday and then we're presenting Awards
Wednesday so
yeah and the interesting thing about
this submission that's a good point
actually yes
this year over the last two we've seen a
lot of of Chip related uh submissions
which makes sense because we you know
instead of seeing a critical
vulnerabilities or a lot of those and
major pieces of software the last year
seems to have had a trend of
people doing research on ships I know
the quarks lab guys had their research
on the the pixel uh phone and their
chips they presented at Recon actually
um but a few others like that and so we
were seeing a bunch of that this year
and speaking of uh we have another
really interesting one uh row Hammer
fingerprinting where these guys figure
out a way to uh take row hammer and then
use it to fingerprint a device
um which you know is cool and just kind
of weird so
um love that uh I'm not gonna
we're back we're back
Google Tags shooting around
again
I'm kidding I'm not man uh Shane Huntley
please don't like beat me up outside or
some um
so most underhyped research once again
qualis
um I guess we hype them up a lot but you
know
um we love you yeah we have no clue who
we are uh LP and rce in render doc uh
it's a One-Shot remote exploit against
um
oh this got nominated twice I guess
unless I scrolled up
no that's correct that's right yeah all
right
um
yeah cool stuff uh yeah the interesting
thing about this one again is
in terms of vulnerability patterns
the days of One-Shot rces are few and
far between now and this is one of the
few that that we've seen submitted at
least this year which is an interesting
Trend and then we've got um activation
contacts cash poisoning from uh Simon
Zucker Braun at Trend Micro
um this is interesting because it's a
new type of Prevost one uh there's
activation context cash poisoning
mouthful uh and as I understand it uh
the technique was attributed to an
actively used uh
uh campaign from an Austrian hacker hire
group identified as not weed and when I
first read this I read Australian and
I'm like really yeah
Austrian which makes Austria is somehow
weirder
but yeah I guess so it's very odd
so uh then we have the apparelson
mitigation of security risks and of
cooperation and mobilize Gateway iot
uh by these guys
um and the side note here we do uh
prioritize submissions with more
information but succinctly presented yes
so please be kind simply it's a lot of
this got compressed by chat GPT and it
might not have done you all the favors
you hoped um
it's not me you know you know uh
so uh yeah found a lot of
vulnerabilities in Mobile as a Gateway
devices and then also built a bunch of
secure cryptographic protocols to help
protect those users
um and the interesting one there of
course is just the wide the spread that
they got and the coverage of of the bugs
that they found all right now we're off
to best privilege escalation nominees uh
right off the bat very interesting fun
one that I like a lot uh you RB
Excalibur slicing through the gordian
not a VMware VM escapes from Dennis Jung
and uh some hexadecimal
um
so
I love this because uh VM VMware escapes
are really difficult and these guys
manage to find one and then for some
reason decide to use it upon to
own because they got paid or something I
don't know
it'll change the subject but
um they uh it's very hard work to do
they pulled it off uh props
um right after that we have bypassing
cluster isolation and databricks
platform from Florian Roth and Marius
bartholdi uh this is cool because it's
uh you know you're punching between
different databricks compute clusters uh
again very hard target and uh they did
it and they published some research if
you think you're forgetting that they
also nominated themselves 12 times oh
you're right yeah uh so we don't
get really like formal sponsorships um
you know we'll throw some bones around
but uh
maybe pay I don't know like
12 times from one company just shot
you're supposed to get other people to
at least pretend to nominate you yeah I
love seeing it when I mean
self-promotion is always important and
great but uh you know it's it's nice
when you see uh people support other
researchers that they think really just
aren't getting enough
um attention yeah I think a few of our
submissions at least were people
submitting from their phones in a
conference Hall like being blown away by
a talk which yeah that's the spirit of
the pony 100
um
so I don't know how our mobile
optimization is Mark you know you want
to weigh on that yeah get the website
design going okay
um all right so we've got uncontained uh
uncovering container confusion the links
kernel
um this is a really kind of fun one
um from Jacob casual Peter Pietro urello
I think has a Pony
um Danielle conodalia Herbert boss and
Cristiano yeah they've been raking in
the ponies
yeah uh so this is a fun one just using
a container of macro and the Linux
kernel uh basically if it's a really
large project it becomes really
difficult to kind of remember where you
are and there's a lot of bugs in the
Linux kernel because of this so that was
fun and they found most of them which
sucks but
um next we have uh the best remote code
execution nominees uh I'm covering
vulnerabilities and windows Network load
balancing uh b2a hex
they found rce in Windows Network load
balancing
um
yeah that you know good job um
next we have uh clam AV rce clam AV is
always kind of fun and aslr bypass uh it
gives you kind of a zero click is always
fun we hate aslr get rid of it
actually it's a terrible idea um
uh check check mark Checkmate uh rce
chain from scray H uh so it's a limited
ssrf full-blown rce chaining five
vulnerabilities together
um pretty hard extra points because they
had great graphics on their blog posts
um come on you guys like rce that you
think Chrome browsers uh chat apps
things like that
clam AV and check mark That's the best
the QD could do
what are you guys doing all day or
everyone has a full-time job now I guess
all right now for
everyone's well maybe favorite a word
out Lamas vendor because you're all a
bunch of bloodthirsty bastards
um so first up we've got uh Mira
software uh these guys claimed credit
for a bug that was disclosed to them and
then charged their customers five
thousand dollars to fix it
which they received for free so you know
that sounds like a great SAS product
incredible
pin duo duo uh some of you may be
familiar kind of blew up on CNN
they got knocked off the Android store
for installing actual back doors into
their own app in order to spy on their
users
um
oops uh they got exposed by everyone
denied it uh interestingly the entire
team in charge of that got fired shortly
after we were just trying to make better
ads and yeah it's our targeting you know
we're just selling sneakers out here
it's a service
um and then we've got uh three lessons
from threema in which uh this company
posted a very cranky blog post uh
dunking on some Holdings reported from a
student's Master's thesis which is like
you know kind of you're a student be
kind they were very mad it's definitely
worth a read uh check it out on the
website later on is it still up that
would be insane it doesn't go to it
right now Ian
don't read my tabs
yeah it is it's still up oh my gosh okay
um if you're a company in the audience
this is not the right solution the
solution is just to ignore it and hope
the problem goes away
yeah
unusual cooperation by the targeted user
you're right
[Laughter]
so moving on um another very fun one
Epic Fail nominees so you're reading
ahead
um uh the bug is titled a holy
Bingo we have the no-fly list uh
you remember uh the TSA uh kind of had a
little oopsie Daisy
um so this nomination goes to Maya kramu
uh uh who discovered the entire TSA
no-fly list lying on around on the
internet and then shared it which very
uh very fun read though yeah the TSA got
nominated for something did anyone else
like search for themselves
did anyone find themselves no all right
um uh I was sentenced to 18 months in
prison for hacking back uh this guy
Jonathan manzi who retaliated against an
employee quitting and joining a
competitor by hacking the employee and
the competitor and actively defaming
them
um he did 18 months in prison uh it was
pretty much unrepentant and the blog
kind of concludes I read that blog too
he found yoga and um Peace he he talked
he had a come to God moment with a
homeless woman in San Francisco and ends
it with a bad metaphor about quantum
physics there was quite over there it's
worth a read I mentioned it we should
send them back and we should send Kevin
with him I think
bringing that dead meme back um
and then of course our favorite uh the
disreputable kick the job of Scott
um a quote from one of the Consultants
on the pony Awards the only reason he
hasn't violated uh pharah the foreign
agents registration Act is because he's
probably too stupid to be a foreign
agent in the first place
which is a better position than the
alternative that's true
um you can still get in trouble yeah uh
we're thinking about just asking him to
stop tweeting
um but you know maybe we all should
um now uh we're pretty good time
actually we
um and first one up uh we've got Clem
one who uh burned 33 in the wild o days
since 2014 and found eight so far this
year though he didn't find them all
himself oh no
well if you find it in the wild I don't
know if that counts as your bug or not
oh that's a good one just Keepers maybe
I don't know that's a very good point
um
yeah I don't know it's like uh worth a
debate at least it's all about
collections voting starts today
um we have a branch history injection uh
inspector BHB uh it was someone at v v u
SEC um they didn't tell us who but
um it's the micro architecturally
tampered with a branch history buffer uh
in order to leak arbitrary kernel memory
I don't know about you guys but I'm
tired of hearing about variants of
Specter
yeah oh you've had a different feature
of the CPU great and then uh swap GS
um
talking about punching down uh decided
to beat the out of PHP
um
and which you know like it found a
pretty prolific one uh hundreds of
millions of devices you know
but um cool so that is uh all of the
nominees we are not done yet
um first off uh want to do a huge uh
thanks uh to summarcon
um Mark uh particularly has helped us
out a ton
you give us a space to hold the awards
every year
thank you Sophia for helping out with
this presentation also yeah American
Research responsibility like dig through
and understand some of these uh
vulnerabilities uh red balloon for uh
helping out with manufacturing the pony
Awards and also building out some arts
and crafts for Media stuff like that and
of course thank all of you for
submitting all these things in the first
please submit more yes we were very
disappointed at this message shouting
out um we have a light sponsorship from
the new book on Amazon CNO for babies
CNE for babies
um you can find it now and the discount
five bucks off that's a good deal yeah
exactly you got to jump on that um now
we have one more thing so uh sometime
last year we kind of realized that we
had an extra Pony lying around and we
were like well what the hell do we do
with this thing it was kind of
interesting looking at some wings on it
and we thought well you know we should
probably like celebrate some of the like
people that kind of fundamentally
support the entire industry in the first
place so we decided to give that pony to
dino as the first ever Lifetime
Achievement Award for the pony Awards
and since then we've decided that we're
going to keep doing that and uh this
year
um we're giving out another one right
now so
this is going to go to someone that
honestly kind of had in mind when I was
thinking about the notion of a Lifetime
Achievement Award in the first place
um they
don't need it um
uh they they've kind of fundamentally
supported and built the industry from
the ground up and turned it from what
was like basically a bunch of people
kind of doing vaguely criminal things to
a bunch of people with full-time jobs
doing vaguely criminal things
um so uh if you haven't already guessed
uh we are going to give the Lifetime
Achievement Award for 2023 for the pony
Awards to Mudge
where's much it's in the green room we
know he's here has to be here
all right
this is a Lifetime Achievement Award for
everything you've done to kind of invent
the industry and put it into a place
where you know it exists and it's real
so thank you
oh
do you wanna
you wanna say anything
no I just um I
it's the community and it's everybody
else who's enabled all of this uh and I
love this community this is this means a
lot to me it's been tough at times but
you've always been there and I hope I've
been there for you as well
all right thanks
all right that's it
all right all right then we have one
brief word from the CDC
apparently there's some CDC thing
happening oh CDC
is that you are you the CDC person oh
you're the all right all right not
exactly from the CDC
Center for Disease Control thank you
what you thought as much
Dear God
yeah four reasons
that are either legal legal or aesthetic
I don't know which uh we will not be
live streaming this specific
announcement
all right
right on schedule it is amazing we are
like a Swiss Train here I can't believe
it
all right ladies and gentlemen it's time
to delve into the exciting world of
security and cryptography
bringing crypto back
our speaker
our speakers Nick Sullivan and Doug
McKenzie in today's round of spot the
Canadian I don't know which one is the
Canadian here
um
our um uh gonna provide a a really
Illuminating presentation Nick is a
renowned technologist with a wealth of
experience in enhancing encryption and
secure network protocols having made
significant contribution to Apple's
security Technologies and playing a
vital role at cloudflare Nick's
expertise is unmatched
join them as they take us through a
recap of the latest developments in the
crypto landscape
with their extensive knowledge and
passion for internet standards and
sleight of hand
Nick and Doug are here to share
invaluable insights with all of us give
the warm welcome
all right thanks everybody
thank you
okay hello everybody it's great to be
back here at summercon
uh
so this year in crypto
yeah so um
I will make the signal okay great so
quick aside before we start here
my favorite show
something's not aligning properly
one second
no I think we're good
all right so quick aside uh so summercon
is you know the one of the longest
running hacker conferences starting in
1986 but cryptography has its own
long-running conference it's called
crypto and it's been held every summer
in Santa Barbara since 1981. so uh you
know it's 2023 cryptocurrency is you
know rotting in the sun it's time to
reclaim the word so from now on during
this talk crypto means cryptography
all right
yes
okay so
um the theme of this talk is because
crypto is Magic and and you'll see why
so uh cryptography is about hiding
information with mathematics using
cryptographic algorithms you can
scramble data in a way that's hard to
unscramble unless you have you know a
special hint or a mathematical ability
that is beyond the best mathematicians
who are you know are able to share their
work at least and this is what makes
cryptography magical it leverages
information asymmetry so things like a
password or 128 bits of information and
bootstraps it with hard problems like
um
factoring numbers and and from there
um
this is how you get the get get some
some of the perfect things that
cryptography brings you so
um one of the fun Parts about
cryptography is that
um in fact this is a this is a tweet
from Matthew green a previous uh speaker
here at summercon
cryptography might not even exist most
of it might not even exist there are no
proofs that
um the hard problems that we rely on are
actually unable to be solved in
polynomial time and uh so this ignorance
of the world around us it's what gives
cryptographers
uh the power and that's what makes
cryptography really the ultimate version
of security by obscurity
um and so this liminal space is what
makes
practitioners of cryptography and
magicians uh it's the ultimate sleight
of hand and uh just to convince you that
this talk isn't just isn't a gimmick
um this is something that I believe for
a long time I've actually had
mathematician as as my job title in a
former role
um so since this is summer con we're
going to talk about vulnerabilities
right
um and it when it comes to cryptography
they fall into usually three categories
something is wrong with this thing um
in any case um they boil down to
mathematics so sometimes something new
is discovered in math that obsolete's
previous assumptions and this happens
more frequently than you would expect
hash functions for example is a recent
example so
um that's one one aspect the second is
implementation bugs so perfectly
translating math to code is also uh is
something that's very difficult to do
keeping these secrets uh in your code
hiding them from side channels very very
difficult
um and the third part is composition so
taking these mathematical Primitives and
combining them into a protocol that
can't really be exploited uh these this
basically covers 99 of the issues in
cryptography and uh if doing
cryptography is akin to doing magic
trick these three categories of volts
correspond in ways that Illusions can
fail you can design a trick in a way
that uh information asymmetry is
leveraged and you can do that poorly you
can perform the illusion improperly and
uh and and this you know breaks
everything breaks sort of the the view
of the folks in the audience what they
see and and the third is is choreography
so are the steps of the trick done in
the right order and if not uh you you
don't get the the the real solution
okay so with that in mind there are a
ton of topics I could talk about
um these are these are just four of them
I don't have a a whole hour or two hours
or whatever so we're just gonna pick
these two
um starting with uh Quantum cryptography
quantum computers right post Quantum
cryptography this is like a buzzword you
might have heard for a while
um and uh they're they're just computers
that rather than using binary logic
gates they use properties of quantum
mechanics to perform calculations so in
a quantum computer instead of bits being
represented by ones and zeros in
transistors and on and off States
they're represented by physical states
of Elementary particles like photons and
uh and electrons
and uh these bits are called qubits and
so well what you can do
with these bits rather than just you
know ones and zeros xores and ands and
all these logical Gates what you can do
is you can entangle these bits together
and apply Quantum functions on them so
uh just like uh
just like you have the the concept here
of Schrodinger's cat
um that's what a quantum computer can do
it's uh you take your bits you can
scramble them up and then you can look
at them and then they represent
um a certain distribution based on the
quantum superposition of state so having
n qubits qubits doesn't give you these
magical ability to do two to the end
parallel operations at once or anything
like that it just gives you the ability
to perform some algorithms that
um okay just so slightly faster than you
can with a classical computer
asymptotically so these include
searching through a list and uh
strangely enough
factoring numbers and so
factoring numbers being one of the
problems that you can solve in
polynomial time no or at least the ones
that we've deployed but we haven't built
quantum computers yet that are big
enough we're basically in the 1940s with
respect to these
um so what is post Quantum cryptography
well this is just cryptography that's
resistant to all known algorithms that
run on a quantum computer that that's
about it and quantum computers they
really can't do that much uh compared to
regular computers and they're very slow
so what's the what's the big deal right
and what why would you want post Quantum
cryptography
um so you know even if a quantum
computer is that's big enough to break
RSA or ECC is 10 years away a
conservative view is that we as a
society should start this process of
swapping out current algorithms for
resistant algorithms as soon as we can
so that our current Secrets things that
we encrypt today everything's
transmitted over the Internet is safe
from
attackers 10 years into the future and
so this really started in Earnest in
2015 when the NSA made this strange
announcement to stop
um basically anybody who's transitioning
from uh to Suite B which is their uh
Security Suite of cryptography to stop
just stop wait you know just transition
to post Quantum when it's ready and at
that time nist uh started this process
to
um decide hey which which algorithms
should we use which one should we
standardize which of these uh potential
Replacements that are not based on
factoring or on you know similar
problems elliptic curves
um could happen so this has progressed
pretty pretty significantly
um uh to the point where in 2019 it was
down to two different types of
algorithms one that was based on a hard
problem based on lattices another based
on isogenase and uh we don't have to go
into there's there's not that deep of
math in this so we don't have to go into
what what each of those are but um an
example here is is called psych and
another one's called in true and these
were tested wide scale on the internet
in 2019 and uh it turns out that the
lattices actually work you can you can
deploy lattice based cryptography online
um and and it's totally fine and so in
July in the last year or so this year in
cryptography this is one year ago uh
nist announced the finalist which is
called kyber and uh kyber has been
deployed
um in these production environments and
so that's a lattice algorithm what about
isogenase well one of the biggest
vulnerabilities that was found in the
year was uh having to do with isogenes
and the ironically named algorithm Psych
which is very new and very cool uh it
had you know small keys and it was by
far the smallest keys of any PQ
candidate although it's expensive
um but you know alas mathematicians
found a way to get from the public key
to the private key using very Advanced
algebra and uh it took them less than 10
minutes on One Core to do that so Psych
is absolutely dead dead as can be at at
age 11.
and um to help demonstrate this time of
this type of algebraic trick I'd like to
introduce uh Doug McKenzie who is
going to be demonstrating thank you
thank you hi everybody my name is Doug I
am a magician I'll be showing a card
trick to the analogous to the uh
demonstration of how that was broken so
we could turn that screen on so we get
the camera right here that'd be great
are some secrets that we will be
revealed
thank you
thanks so what this is demonstrated in a
very crude way it was analogous to what
what attack was found on
um sidh so uh the they found a way to uh
look at the permutation and reverse it
uh using a very short application so
let's go back to the slides
if we can
slides
can we magic time all right magic time's
over all right thanks um Okay so we've
covered mathematics this is uh this is
one of the one of the big categories and
um
you know I wouldn't be able to explain
with even an hour uh the math behind how
that worked because you know super
singular isogeneity helmet is a is a
super uh mouthful and uh and the mouth
is even worse so
um once we've covered this math but
there's actually more in PQ in this time
in implementation so uh kyber kyber was
the chosen candidate right it was uh
very long keys that are actually really
fast to compute faster than ECC
um and they were shown to work on the
internet and uh you may have seen this
headline about kyber being broken by AI
um so kyber is actually based on an
older mathematical problem it's um it's
been known since 1996 the category
problems which is you know three years
before the crypto Nomicon was published
so uh no card tricks there but
um uh and you know I had big Keys one
kilobyte but this is the this is the
single public key algorithm chosen by
Miss how did this
um publication
how did security week say that was
cracked right
um and in fact it wasn't broken the math
wasn't broken the math was is still
found to be sound but this was just a
flesh wound um and we saw this this is a
great series of talks to lead up to this
but um there was a problem in the
implementation and uh we saw how power
analysis work Works
um and you look for patterns to extract
data uh secret data ones and zeros a
very very common counter
um countermeasure for this is called
masking you effectively take random bits
and random bytes and you xor them into
the data so that uh the power
signature of a computation doesn't
reveal the structure of the numbers
um this is this is applied in kyber and
uh what happened in this attack this
publication
um was that they basically trained a
neural network with a new method called
recursive learning and we're able to
even though things were masked
find the little tiny gaps that uh
Illustrated what bits were in the key so
this was a power analysis attack slash
timing analysis attack if you want to do
it that way on steroids
um powered by AI but in the end it
didn't break the math it just break
broke this one counter proposal so kyber
is still the choice it's still secure
it's just you have to be very careful
when implementing it
um and so to uh demonstrate this type of
issue uh side Channel attacks uh Doug I
would like to invite Doug back to uh do
another magic trick perfect thank you I
need someone knows how to riffle Shuffle
so riffle shuffles where you Shuffle
like this anybody know how to roof a
shuffle here
and and in their pockets uh end-to-end
secure messaging uh so you know signal
the protocol was created 10 years ago
that you know the same year that Snowden
came out with his uh
um Revelations or whatnot
um and uh actually this picture right
here is from Snowden swag website so you
know it's been 10 years since then and
uh the world has changed so here's a not
so secret secret practitioners hate
using the signal protocol you know it
doesn't scale to Big groups uh source
code is kind of poorly documented and
it's not really designed for
interoperability and Federation which is
the new hotness with things like
Mastodon and now threads so trying to
shoehorn Signal into other systems has
proven a little bit challenging
um even for the best Engineers so like
in some signal is is quirky but it works
for the signal app and it's it's
fantastic it does have it's it's like a
Trailblazer in the uh secure end-to-end
messaging world but
um you know the the last category of
vulnerability we haven't gone into yet
which is uh exploit systems that have
good math implemented correctly but uh
are insecure because of the way that
things are assembled into a protocol so
signal was proven secure but that can't
be said for other attempts so you know
WhatsApp and Facebook Messenger made the
effort to implement signal but those
that couldn't or wouldn't you know pay
the Moxie tax or whatever have uh tried
to roll their own and this hasn't always
gone well uh just like in Magic good
choreography is uh is is hard to do good
Protocols are hard to invent so there's
three examples here one iMessage which
this was actually presented here at
summercon in 2016 my Matthew green so
summer con
um and uh and you know matrix.org which
was just mentioned in the ponies uh
there was a huge issue there Matrix
which is all about Federation uh had
their own end-to-end secure messaging
protocol and uh and and now you know
Elon musk's Twitter the uh they said
they just just implemented and deployed
a new one if you have a blue check you
can use it
um but uh while you know the details of
both the of these attacks first by green
and then by Albrecht and then um well
just by reading the code for the for the
Twitter one
um and the documentation honestly um
while the details differ they were all
major issues that allowed impersonation
of some sort uh and none of these
protocols had a formal list of security
requirements and formal proofs of
security and gone through the whole
industry and all these sort of things so
um you know in Twitter's case they even
if you read the documentation this is a
quote from it currently we do not offer
protections against men in the middle
attacks okay so
um
in in this case the party controlling
the distribution of of authentication
Keys is Twitter itself and they can
silently inject their own keys and this
is this is a very um common thing to
happen I know we're
we're a little bit over but but um
this
is also demonstratable by magic
Doug magic uh I need someone to pick a
card
foreign
here's how it works
this is your signature that's not what I
showed you guys
okay
I am the man in the middle here so
I have two cards that have the same
signature
one goes to Nick's Park
I forced him a card I make him pick it
whole different discussion he picks a
six of Hearts I show it to everyone he
signs it okay
here's where choreography comes in I
make sure he's all the way over here so
I can show all of you a different card
and not everyone here okay
for the duplicate card over here and I
show everyone in this side of the room
this duplicate signature so you think
this is signed card
goes back in the deck
into Nick's pocket
careful not to show him the card
he switches it when he shows it to him
mitm monster man in the middle machine
in the middle
yeah whole different discussion
all right
so yeah group messaging is hard
and uh and so this is the last slide
here so like what what is the solution
for the industry
um well five years ago several Engineers
from Cisco Mozilla Facebook and Academia
decided to take a collaborative approach
and develop a new protocol that scales
to larger groups uh this effort LED uh
it leaned in on The View that strength
comes from diversity so it took lessons
from the development of things like TLS
1.3 and it's called MLS and
um well it wasn't announced today but it
will be announced soon that the timing
didn't line up perfectly
um but uh take a look this is an RFC
it's got some institutional credibility
ads formal proofs designed for use and
Federated systems it kind of fills in
some of the gaps that um we're missing
from signal for something that can be
used across all sorts of platforms it's
also deployed in in Cisco WebEx so
this isn't ended to be the intend
encrypted messaging protocol and uh and
and and and and it's coming out soon so
uh with that uh that's just a part of
what happened in the magical world of
cryptography this year thanks for
listening
[Applause]
all right uh we are in the home stretch
we have
very little time to get through the last
two speakers
I can't see God damn it okay there we go
do
you work
uh
uh there we go great thank you okay
um our next speaker has a lightning
presentation
are you ready to challenge your digital
forensics knowledge our next presenter
Emily Wiki is a prominent member of the
NYC digital forensics community
it has an expert working in a famous
financial institution
whose name is not on the screen right
now I assure you
Emily knows the ins and outs of the
field in her spare time she's been a
valuable contributor to Summer con today
in addition to those contributions
Emily's going to set the record straight
on a few things unraveling the
misconceptions and outdated practices in
digital forensics get ready to have your
perspectives adjusted and your
understanding
challenged as Emily Wiki takes the stage
welcome Emily
[Applause]
all right hey guys thanks Mark uh like
Mark said I'm Emily Wiki I'm the global
digital forensic Fleet at Morgan Stanley
and today I want to use this time to
have like a large scale heart to heart
with all of you about digital forensics
role in the cyber security space and
also cover a few things that your
neighborhood for educator wishes you
knew as non-forensics people
all right so a lot of you have actually
heard had this conversation with me but
we're gonna do it on a bigger scale when
I say hi I'm Emily and I do digital
forensics what do you what comes to mind
when you hear the digital forensics part
just start shouting things out it can be
mean and
yeah the FBI okay what else
what
vlogs
what else
incident response
browser history
nice
great
all right so you yelled out most of them
um and here are some that I often get
and I crowdsource some of my team for
these two but forensics uh you just sit
in DD all day or you're working out uh
waiting for a disc to decrypt so that
you can sit in DD all day it takes
forever you just start looking at awful
things all day if you work for someone
like the FBI
um oh I use the smooth kit ones but it
was in college like 15 years ago that's
forensics right it is we love the smooth
kit but
um oh P caps you have peacaps for
everything right it must make your job
so easy
so these are all the things that you
kind of smile and say excuse me I need
to either go to the bathroom and get
another drink whichever one works in
that conversation
um so ideally uh in this few minutes the
lightning talk on Lightning friends like
well I'll sort some of that out
15 30 50 years ago you're right it was
slow all you did is image all the
computers you needed to do different
forensics there's the only way we didn't
have targeted collections we didn't have
tools to enable targeted collections so
you kind of had to grab everything
because there's the only way uh to
ensure that you had everything you
needed
and it's kind of great because you just
click one button and you have everything
you need if only it really worked that
way
but of course the cons in this that are
what are mostly coming to mind when we
lament about how slow and sluggish
digital forensics is is that it's really
time consuming it doesn't scale even if
let's say you're working on a one and a
half terabyte drive which is unrealistic
for storage sizes these days
um and things are working at Optimum
speeds right and Optimum configurations
which is never what happens in reality
only in textbooks and file system
forensic books
um Imaging that drive alone will take at
least four hours right if all of your
conditions are perfect and beautiful and
that gives us a bad wrap right because
that doesn't scale
um there's no definitive retention of
the artifacts you could go through that
process of Imaging all of those drives
and you still don't even have everything
you need it's not there anymore it's
overwritten you have these huge chunks
of data to copy back and forth over
places process blah blah blah you're
right forensics is old it's things it's
time consuming it's just what you do for
cleanup
but then finally our trusty in-house
security Engineers
um started to have these really great
ideas to make their lives easier blog
repositories who here uses something
like Splunk
is great we can put our logs in a
repository and analyze them there what
that's so cool they're at our fingertips
um but at the same time they're still
segregated by different repositories
organized which means more processing
time uh independent searches so instead
of getting a nice pretty disk image at
the end of our four hours we have now
all these disparate data sources so it's
great but like is it really that great
um
oh and you're in control of your
retention so you kind of know exactly
when you're going to search your data uh
what data you're going to get back so
this is an improvement it makes things a
little bit faster we're not sitting
around twiddling our thumbs or banging
our heads on the keyboard while we're
waiting for TV to finish or realize that
we just corrupted all our data or erased
it instead
um we have our centrally accessible
on-demand blogs
and as I already alluded to there are
cons to that too it's really great to
have all of your organized logs at your
fingertips in and out analytics platform
but at the same time uh there is
post-processing involved in segregation
um and lots don't give you the whole
picture I am I guess a little
old-fashioned despite the theme of this
talk and I love having all of the data I
could possibly need
um and nothing really deep having access
to an endpoint in addition to logs about
the endpoint
so the new way we're all moving to the
cloud and we all think we're not we all
necessarily in this room but all of
those people above us think this is the
coolest thing in the world and it's
going to make our lives so much easier
and so much more efficient but alas
um well no we're not gonna go to the
last part yet it does make our lives
better and more efficient we have dozens
and dozens of log types available for
our fingertips so instead of using like
application Level logs and system level
logs for forensics we actually have
utilities that people have designed uh
two log user activity and things that we
care about doing forensics on not just
making best
with something that's not intended to be
used for the purpose of figuring out
what a user has done on an endpoint
uh so for example if we're talking about
Azure now you have this fancy Microsoft
portal that you can log into see all the
fancy native Microsoft logs that tell
you exactly what the person did with the
Microsoft products
um and there's documentation about it
and there are definitions like what is
this this is no more
what's that sorry
that is a perfect segue thank you into
some of the cons
um so
um some of the cons there yes of course
with having these portals and these
access to these native Logs with great
documentation
um is that if you're a DFI or a
consultant uh you don't have access to
these pretty portals on some on your
clients network with all the permissions
you could possibly want to leverage
these things so you're kind of out of
deficit there and if you're on a budget
you also don't necessarily uh have that
portal that level licensing
um so you're kind of out of deficit
there
um so if you don't have in-house dfir
and you're or you are a DFI or a
consultant here's where we're getting to
the real Crux of what modern digital
forensic should be is having a digital
forensics team in-house it's not
practical for everyone it's not scalable
for everyone but it makes a huge
difference in your overall security
posture so doing the front doing
forensics the right way is doing it
in-house
um this is because it enables you to
create a feedback loop of the Intel from
your investigations uh logs you need
resources you need stumbling points you
have
feeds back into your organization and
improves your overall security posture
to by providing that feedback
and input into the overall design
and accessibility of your logs what
you're logging even your personnel right
so I specifically focus on Insider
threat investigations so as an Insider
I'm very well positioned to understand
maybe why someone circumvented a control
and now I can prove it fix the control
uh give them maybe the support they need
to do something in a safer way
um and in overall make the company more
secure every day
so the Aging way in the new way really
are the way forward right no it's not
practical necessarily to have the best
licenses that give you all of the access
to all of the logs
um but having that one centralized
location of logs that are actually uh
created for the point of investigating
and for security not just for just
admins 50 years ago to try to put
together a puzzle really having forensic
artifacts that are meant to do forensics
and support them
um means that we really drive more
intelligence from our investigations
forensics can be done a lot faster and
if you're feeding it back into your
organization your investigations come
out a lot smoother quicker and everybody
gets along
all right
so that's pretty much why uh you should
be doing forensics in-house and really
quickly and just for fun because uh this
is summer con and I don't believe most
of you do digital forensics here are the
top five things that your neighborhood
forensicator wishes you would think
about when you're either designing
something or implementing it
um
and great
thanks very much
[Applause]
all right we're very close to being on
schedule which uh is weird uh but in an
effort to ruin that
um I have a
um a small
thing I would like to do before our next
presentation if you all don't mind and
you can indulge me for a moment
um
I was wondering if I could get Chris
valasek
and much to come up on stage for a
minute are you guys around are you guys
somewhere
yeah uh
[Applause]
okay you look you look exactly like I
remember you that's for sure
uh back when we used to do this thing
together a lot Chris is the yeah it's
true he is very nervous on stage Chris
Chris
is the chairman emeritus of uh the
summer con Foundation uh we're proud of
uh all the work that he did to get
Summer Khan into a position where it
could be the event before you now uh and
into a position of being a charitable
Foundation even where we can do things
that the IRS allows us to do
um oh there you are
I see you
um he's coming he's coming yeah yeah
he's going to come through this way yeah
Mudge doesn't require a lot of uh
introduction although I will do that
because his presentation is next
but one of the things that we have
wanted to do for a long time here at
summarcon is to develop something that
we call the summer con Hall of Fame
and our two
the first two inductees into the summer
con Hall of Fame are Chris balasek
foreign
much
so with that if we can please make the
presentation
of of the official
[Music]
summer con jacket
the Blazer
congratulations to you both
please wear them with pride we expect to
see you here every year with them
hey
you are the first class and you were
always first class in my book so you
know that makes sense all right thank
you both beautiful again a round of
applause again
okay now
it is
um as you can imagine an honor to
introduce our next speaker who is trying
to work out one last tiny logistical
wrinkle for his presentation uh maybe
you are aware of his background in music
and his reputation as a skilled guitar
player
uh but I I strongly suspect you know him
for other exploits
um as one of the pioneers of the
security Community he has made
significant contributions to
vulnerability research the full
disclosure movement and he's been
building bridges between hackers
government and Industry
today Mudge is here to share his hot
takes on so-called
best practices in security so brace
yourself for a thought-provoking session
that will challenge conventional wisdom
let's give them a warm welcome
Mudge will share his unconventional
thoughts on tried and true security
beliefs wherever he is give him a give
him a hand
[Applause]
he's uh he's he's trying to work out
this one logistical wrinkle I think
Jimbo is gonna like take care of that
take care of the business though it's
pretty good the teamwork the dream work
okay here you go
thank you
all right so it does it's it's perfectly
tailored you guys are amazing
okay uh I am the talk between you and an
open bar we are going to try to figure
out some way of getting a bunch of
drinks up here that will be comped to
try and ease that way into the open bar
uh for you and also to make this talk a
little less painful
um and I think you'll understand why I
say that in just a moment so
this talk is about data actually
contradicting and refuting a lot of our
industry's prize beliefs best practices
um and you know just what our foundation
is built on
I took it from the approach of something
called the tenth person rule the tenth
man rule and that's something that was
created for
intelligence to prevent intelligence
failures when an organization or a
country in this case it was Israel
um was stuck in an incorrect belief
system based on stale data
the 10th person rule is simple if nine
people all say like well yeah that's how
that works this is how we've always done
it or this is the Assumption the tenth
person has to take a contrarian point of
view whether they disagree or not and
work to refute the beliefs to make sure
it's not a stale belief system
So today we're going to do that on a
bunch of things and the data uh doesn't
look good for a lot of our Industries
best practices
uh I like the adage of it's not what you
don't know that'll get you
it's what you know to be true that just
ain't
so
I think earlier today you heard some
comments on you know cisos and infosec
teams asking for some pretty large sums
of money to the executives and the
boards and the boards kind of being well
I'm not sure that's the right way to
invest it
every other part of the company you know
goes in and says
we're going to show you what the return
on the previous quarter or previous
year's investment was sales is like hey
with the extra sales people we have a
bigger pipeline we have we we close this
many more sales we upsold engineering
the efficiency of the number of patches
the number of versions the number of new
products even HR it's like well what's
our retention what's our diversity
numbers how did it improve but you'll
find that what an executive asks uh you
know the infosec leader like hey give me
a number
how what is our security number this
month and what was it last month or last
year so not just oh I think we're
getting better because we're spending
money quantify it and if you can't
quantify that movement quantify the
Lesser you know the the lower
probability of these scary things that
you're telling me about
so
the next slide is real quickly going to
hit the high level of like the sort of
reasoning or excuses as to why cyber
just can't be measured and can't be
treated like these other disciplines or
other parts of the company and then
we're going to go into the technical
examples
and larger data sets
I guarantee just about everybody in here
has heard
at least one of these four if not all of
them and probably even has said some of
them I know I have in my past you know
the first one is well one of the reasons
why cyber is different is that the
fields just riddled with unknown
unknowns you know we can't tell what's
going to blow up and fundamentally
change how we view the scariness and it
could be company ending Etc et cetera so
how could you measure for that
the second one is um hey only an infosec
does the defender fundamentally start at
a disadvantage and the adversary unless
the boogeyman they've got all these
powers and capabilities and time is on
their side but we have to figure out how
to defend against all of them that's a
little strange because no other field
has that and the third which I find a
little interesting throws in this hey
attribution is an unsolved problem we
don't know who it is that's actually
attacking us they could be pretending to
be another place that wants to attack us
why they're doing it or what they're
even after so how do you quantify or
measure for that
and all of those lead to the statement
of cyber is fundamentally different and
you just can't put a number on it like
you can all of these other fields
let's quickly challenge these before we
move on to some big numbers
so oh I'm sorry the red is a little
difficult there
unknown unknowns
if the field is littered with them
why is it
that
all of the zero days for the past 10 20
years
have been variations on a theme
they've been known classes they might be
novel variations and they manifest in
places where we know they can happen oh
there's a buffer overflow and a new
program we're using it was a you know
not a strongly typed language or wow a
command injection go figure we took in
information and data yep line them up
here and people can come up to the stage
and help themselves I think they can
open them themselves you're just asking
for
give us one moment
delegate I just I just have to do things
so I'm delegating all right
and then there's a lot more wants to
talk uh ends
um so
zero days are actually known unknowns
and you can you can plan for that you
can account for that the big giveaway is
that most of the patches and fixes for
them
are known patches and fixes we do the
same thing to fix them that is not what
happens with an unknown unknown
it's okay no unknown unknowns in the
past 10 20 years and I'd love to have
conversations if people have examples of
them
the defender being at a disadvantage
there are some people in here I know who
have seen if not been on the pro teams
of the attackers we're talking state or
even organized crime
um you know a little bit beyond red team
because it's a different sort of attack
the attacker has tremendous resource
constraints
they have to hit a whole bunch of
targets they have risk
concerns they have to learn a new
environment they have to gain initial
access they have to figure out where
everything is and they have to do this
without knocking anything over or
breaking anything or drawing attention
to themselves you know the defender gets
those for free they create the
environment they own it now the defender
can not do those things and hence seed
or give away that Advantage by going I
don't know where everything is you know
and I don't know like you know who's got
access or I keep granting new uh
privileges and never pulling them back
so it just grows out of control but the
attacker actually is at the disadvantage
at least initially and actually
quite a lot through most of the
operation
and then cyber being fundamentally
different
every other field
has that has had that same thought
medicine was magic you know put the put
the leeches on your eyeballs it's the
black bile buy this Elixir uh same thing
with
um uh everything from economics to
astronomy you know we're not nailing as
many people up to uh doors and crosses
and burning them at this point as many
and even insurance insurance was like
how do we measure risk because that's
often the hey cyber is risk and how do
you really quantify that go talk to
Warren Buffett you know go talk to
anybody who's made fortunes and built
out the models for it so
okay that's at the high level that I've
heard personally in boardrooms uh in
executive meetings as to like look these
aren't
valid reasons why cyber can't be
measured
let's actually dive into some of the
technical examples and some of the
numbers and data behind them
I'm going to start with a little story
oh it's actually not a GameStop thing I
just realized I'm like why do I have
GameStop there I'm I want you to picture
a kind of rainy August morning on the
northeast of the United States and we
have this protagonist named Oscar
and Oscar is about to walk into a
T-Mobile store
and he's going to social engineer
his Target's phone number to be given to
his Sim
okay now
in order to do this there was a lot of
Prior work and I want you to keep track
of the costs to the attackers here
um
and the costs start to add up
so he had to identify who was worthwhile
to simslam and in this case it was
somebody who had five million dollars in
their Bitcoin wallet okay to find that
person Oscar worked with a team for
months they scoured the crypto message
boards they walked the blockchain to
verify things they even set up fake tech
support websites for bitfie binex
coinbase all of the other ones that
probably no longer exist anymore and
that was just to get the username and
the passwords that were associated with
a particular wallet
um
from that point they still had to become
classic private investigators because
they needed the social security number
they needed to the home address all the
other stuff so that Oscar can walk in
and say hey I lost that phone it's
really my number I could convince you
for it you know it could convince you of
that and you know put it on my SIM card
oh not for me thanks yep
yeah you could go around like a like
like one of those movie theaters where
you kind of serve them meals during the
the presentation I like it so Oscar did
manage to get that phone number and from
that point there's still more work
because what did Oscar have to do
well he needed to take over the email
account which he could do now because he
could answer the SMS challenge once
you've taken over the email account then
you could go to coinbase or whoever it
was and say hey I lost my password send
the password reset email over to that
other email account and now the wallet
is compromised and this was a true story
um you know based on that the five
million dollars with the Bitcoin was
drained
Oscar and his team also got caught a few
months later but the takeaway here is
two things one that was a lot of effort
even just to identify the target
and the second thing was the media
coverage was unified and their takeaway
was SMS is broken
because SMS was bypassed and look five
million dollars were lost because
somebody relied upon SMS as an
authentication uh there was even a
headline saying Microsoft says don't use
SMS
um so
now let's go into the data because I
agree SMS is flawed there are better
Solutions there's u2f yubikey and
everything
luckily we have large amounts of data
this should um this was a Google study
where they took an entire year
and they
looked at account takeover attempts
and in that one year time
3.3 billion username and passwords were
dumped or compromised or revealed every
single one of those immediately was
plugged into automated uh uh password
you know uh Bots for password stuffing
SMS was a hundred percent
successful at preventing the account
compromise
for those which I'm like hey that's not
bad that's the most common attack it's a
cheap attack but that's probably what
everybody's dealing with
they looked at bulk fishing you all know
what bulk fishing is because this is
where you're getting an email or you're
getting a text that says hey your UPS
package couldn't be delivered or a
problem with your Amazon account or hey
I'm the IRS you know we're going to find
you you know log into this website and
it's a horrible link but the website
looks a little bit like it and they want
your username and account
only 12 million in the entire year 12
million sounds like a lot
that's minuscule compared to 3.3 billion
why because it takes a lot more cost and
effort for an adversary to do it there's
a reduced number of adversaries that can
pull this off with the resources
um
and SMS this part you know
curls My Curls my toes 96
effective against this
and we can explain later as to why
that's so high but it is valid the
targeted attacks
this is the tailored access this is the
stuff that you read about like Oscar
beforehand
not a lot of these happen per year
the study showed it was somewhere
between seven thousand and nine thousand
per year
but
they've got to be against targets that
are actually worth it so you want you
know like a multi-million dollar payoff
because you're going to spend months as
the attacker going after it it's a mess
was successful at preventing 76 of these
it raised the cost just enough to the
adversary that it put it Out Of Reach
so we're seeing a few things here we're
starting to see economics of attackers
the capabilities the breadth the
specific specificity
and we're also seeing that defensive
Solutions even when flawed you can
measure the efficacy
because it's a Mini Max game which we'll
talk about a little bit later it's
what's the minimum amount I can spend as
a Defender to move the greatest amount
of cost to the attacker
and here we are if you want to make it
look difficult and math-like you know
sure go grab some Game Theory but all
that means is as an attacker what's the
least amount of effort and resources I
can use to realize the greatest amount
of gain and as a Defender what's the
minimal amount of effort I could expend
to move cost and friction to the
adversary
we heard about ransomware earlier and I
think that's a really good uh example uh
here so the headlines are pretty
Sensational wow they're like 500
ransomware attacks you know in this
particular interest industry or some of
them are asking for millions of dollars
on attribution which was one of the
earlier ones
attribution is a solve problems in many
ways it's not solved for Espionage but
for the business World Espionage isn't
something they can quantify the losses
about very easily
effect based operations
title 10 for those who are paying
attention in that particular world
have after attribution as a requirement
of the attack
if you are being ransomed and you don't
notice it and it doesn't impact you who
cares if Gru is going after Ukraine and
Ukraine's like yeah I'm not feeling any
impact or you know problem it's a failed
effort from the attacker similarly if
you don't know who's doing it it's a
failed effort because hey I'm ransoming
you yeah I can tell my systems are
locked up
um but I'm not going to tell you who I
am or where you should send the money
okay you kind of need that for part of
the effect similar for like let's say a
military offensive effect based Gru if
they're knocking down the I.T systems or
the satellite modems in Ukraine but
Ukraine doesn't know it's Russia it's
like well there's no incentive to
capitulate to whatever Russia's demands
are so attribution is solved from the
business point of view that folks care
about
real quickly
the top 21 ransomware teams the you know
the actual kind of pro teams if you want
to you know look at them that way the
organized crime this ones that are
staffed with people working on it you
know they're hitting on on Max in many
cases 200 targets 200 victims a year
many of the top 20 really haven't even
hit 200 over the past five years yes
Conti hit 390 or whatever but if you
look at it that way
there are 516
000 manufacturing businesses in the
United States
so let's do the math real quickly that's
if we say you know let's let's assume
there's a dozen teams hitting 200
targets uh victims a year that's 2400
2400 out of 516 000. that's point zero
zero six
so yes ransomware is scary and maybe
your team is asking for a few million
dollars for a ransomware solution but if
you already have like a a two-factor
authentication in place and you're not
flopping the internal networks you know
wide open on the Internet or whatever as
we saw in the SMS stuff you've already
raised the cost and the likelihood of
one of these pro teams hitting a
particular industry assuming all other
things are equal
is point four percent
so 99.6 chance that
if you do nothing other than what you've
already put in place
you're not getting hit
that part of the context with these
numbers is not normally brought forward
and we see a lot of this like the
targeted attacks seven thousand of those
there are how many billions of people in
the in the world how many different
Industries if you put it in context it
doesn't mean
it's not something to care about but you
can start to show what the likelihood of
a problem is
and what the effect of things that you
were putting in place is going to do
because I'm not driving I'm not going to
brag to the executive team that I
reduced our likelihood of being hit from
point four percent to 0.2 for 10 million
dollars I'm gonna brag to them that I
rolled out something as
flawed as SMS and I reduced 3.3 billion
I reduced everything except for the
let's say targeted attack so I moved an
80 likelihood of roll the dice down to
like two percent likelihood
so that's the Mini Max Maxim in there's
an easy way first adversaries are
already doing this two-part two-party
Game Theory if if you don't understand
why ransomware hits
manufacturing as a biased Target it's
because it's real easy for the executive
team to say how much is it going to cost
if our assembly lines are offline for
the next two weeks or three weeks okay
how does that compare to the 10 million
dollar Ransom
the attackers already did that otherwise
it wouldn't be worth their while to
spend two three weeks as Conti sometimes
does to like you know put things in
place
you can break yourself of of not doing
it by just going through the different
best practices take oh wasp take miter
attack take whatever and just say one to
five for each of these how much does it
cost my organization to put it in place
okay one to five on the attacker hat on
how much friction was introduced by that
being in place
the ones where you spend a one and it
moves a five to them that's a good buy
the ones where you're spending a five
and it's only a one to them
Maybe reevaluated
okay now let's offend everybody who's
building software security products
so there's a software security product
for everything out there
and very few of the companies or the the
vendors will come in and say yeah here's
how you measure the effectiveness and
the change to your environment
um and they'll just instead say like oh
well if you don't buy us and you get hit
by something you'll wish you had sort of
set up so well if they're not going to
quantify that
can we quantify how much extra
vulnerability putting security software
into our environment actually introduces
yes we can so first I should point out
that um there's a company that for many
years has done security code analysis
like looking at
products from companies and trying to
figure out where vulnerabilities are the
hygiene and helping improve it a little
while back they did a study and they
released stats they said out of all of
the industries that make software out of
all of the different sort of categories
which categories are the strongest most
hygienic best security written code and
which ones are the worst
I give you two guesses as to which one
was the worst by a long shot well it's
actually QA software but I'm not putting
that in production and I'm not putting
that like in Ingress egress positions
the second one and this was a huge step
function to the next one is just just
how far down it was were the security
products themselves
since that's a large amount of the
customer this country I'm not of of that
company I'm not surprised they stopped
releasing that stat
but let's take a look at security
software this is a slide that I've used
in various forms for a while but what
you have here is on the y-axis lines of
code and in the blue line it's security
products and on the red line it's
malware offensive kit you know exploits
uh and implants and stuff like that and
it's tracked on the x-axis for 20 years
and from 20 years the security products
went from a thousand lines of code up to
10 million and that's several years ago
it has continued to go up
the attacker code
remained relatively constant
at
125 measly lines of code
and before some people so the takeaway
but then I'll go in because some people
are like that's wrong I've seen
something that's got more lines of code
than that
um
the takeaway is the shape
so the shape is a very disturbing shape
and lines of code isn't the magic value
the magic of lines of code is that it's
a beautiful proxy it's a proxy for time
money uh expertise level of effort it's
resources
and this is the resource Gap that's been
going on and continues to go on so real
quickly for folks who are like hey that
red line is because I've seen
like a 125 000 you know line of code
there are recent studies that are
showing that a few are there the
majority is less than that still
um but it does appear to be going up
if you look at where I put the red line
it's it's not at 125. if I had it at 125
you wouldn't be able to differentiate it
from the x-axis that's already at 125
000.
so yeah the shape doesn't change
okay
that's talking about sort of a like well
yeah that's potential vulnerabilities
you know maybe there are exploits there
and we know it's a crappy you know sort
of like industry for code hygiene and we
also know that they're put in very
important spaces with significant uh
permissions and visibility but how does
that actually map to real world
vulnerabilities and problems
glad you asked
over four month period this measurement
was taken from 20
000 networks millions and millions of
computers on them this was actually
across the Department of Defense
um this was the national vulnerability
watch list and
the really disturbing part was at any
given time
a third of all the security
vulnerabilities that they were tracking
down that were actively being exploited
or being attacked were in the Security
Solutions that they had deployed to
protect themselves
so
one of the beliefs obviously was hey the
more security software I deploy the
safer I'm going to be right and a lot of
expectations that security software is
secure software and that's just not the
case
um I recognize a few faces from some
particular teams that will get a kick
out of this so I'll share
there were a few times when I was
working with let's just say pro teams
Pro attackers
um and they had a few targets to choose
from
one target had a bunch of the latest and
greatest Security Solutions deployed
throughout it and they had all the
dashboards up and running
the other Target had about three
Security Solutions of mean of
meaningfulness deployed
um authentication kind of a privacy-ish
stack
um and they weren't using the dashboards
they were connected in it entirely
through the apis for these different
ones
which one did the pro team know was the
softer Target and which one was the
harder Target
yeah the one with the minimal amount of
security products uh deployed because a
few things
the first organization that had all of
them
that's indicative of a company that says
I have a bunch of things I don't know
about my network and I don't know how to
solve them I'm going to buy a solution
and throw it in place and hope that that
will magically make the problem go away
or give me the visibility I'm hoping for
that I don't even know how to scope
and the second one was the default
dashboards well that means they didn't
need one of those things can go down and
not be working correctly and you know
unless you're actively manually looking
at the dashboard each day you're not
going to see it
when an API is wired into your
operations and your operational Cadence
and you know exactly what you are using
these products for
it's going to be a lot more difficult to
be in there with and remain unnoticed
[Applause]
two more here
um
this one was funny just because I have a
a real world example but uh and this
isn't a ransomware talk but it's such a
good example it's accessible for folks
for effect based attack
um and a lot of experts as you'll see
this person is cited as a uh senior a
Senor director of security strategy and
some sort of Professor in cyber at a
university and the takeaway and the
common belief is hey one thing about
ransomware if you pay a ransom
you identify yourself as a chump and a
mark and everybody else is going to
Target you to Ransom you as well maybe
even some of the people in the actual
team Ransom in you
a lot of folks here already know the
problem with that but that's a common
belief uh and then the second one is
that hey even if you pay the ransom
these are dirty unwashed criminals and
you can't even know that they're going
to live up to their statements and
Promises they might not unlock your
systems and maybe they'll still DDOS you
anyway and spend the money in resources
to do that for no reason I don't
understand why
those were two things that were
literally told to me by the FBI when I
went to them when a company brought me
in who was being threatened with
ransomware and they said you know much
give us the stats and the data how many
other companies pay How likely is it for
them to do this you know et cetera et
cetera I'm like great I'll go ask the
feds and those were the two things they
said and I said can you give me data
backing up those statements they're like
no no we don't we don't have that data
okay
we've seen the inside Communications
of ransomware teams sometimes they've
been frustrated and they've released
them intentionally other times go cyber
command cnmf
sorry
um
hypothetically or allegedly who knows if
it was if it was them
and when a ransomware organization
Ransom somebody and doesn't live up to
the promise of releasing them or
following through or when a ransomware
company hits a Target and then hits them
again immediately afterwards guess what
the inside emails show
the big boys and the Heavy Hitters
would go after them and put them out of
business the way organized crime does to
people
so not just a Stern no no no it's like
yeah they're not a problem ever again
why it's a business it's an industry
look at any organized crime look at any
payment racket if uh if if a crime
family is making companies you know pay
for protection
and you know they all pay protection and
then there's no protection or the crime
family itself you know vandalizes the
store
pretty soon they stop paying
and the industry knows this so they
self-police and they self-regulate the
other thing
about measurements and I'm not gonna you
know walk you through this this was a
payout Matrix and a probability Matrix
from a company that was being uh
threatened for ransom and it had been
demonstrated that the organization was
capable of doing it and first off I'm
not saying don't pay ransoms and I'm not
saying to pay ransoms this is a talk
about data
um you know I won't judge I will a
little bit
um and they said hey
what what cost to us you know do we
incur if we don't pay and they hit us
what cost do we incur if they hit us and
even if they hit us repeatedly after it
and you can plug in your your beliefs
your percentage your probabilities you
could plug in the num you know the
amount lost and everything else and you
know there's I I xed out most of it but
you know there are simple equations
behind the cells and you can see this is
how much you're going to lose this is
how much it's going to cost this is the
you know the pros and cons just from a
financial perspective
in every case it was just from the bean
counter point of view the right thing to
do to pay the ransom now this company
was able to we figured out a way of not
having to pay the ransom and still avoid
this but they made that as an ethical
choice
but they made it as an informed decision
you know they literally said hey you
know we'll just make our customers whole
from whatever if this happens
um
but if you're making decisions without
them being informed by data
well you're right back into that 10th
person problem where you're one of the
nine people
and now for my favorite controversial
one
what could be wrong with software
updates or the advice that software
updates are the most important thing
that you can do to keep your systems uh
and networks secure and safe
and the data that I found here that
we're going to 10th person approach was
a study uh non-experts advice and
recommendations and experts advice on
the right hand side it was 300 Security
Experts
um and first off when you find that a
lot of the data supporting one of these
basic beliefs ends up being a survey of
opinions even expert opinions
that should be a little bit of a flag to
say let's let's play 10th person on this
and you know five four three and two are
all password related including like
two-factor sort of stuff and we've
talked about that the number one
recommendation from Security Experts
this is uh the usenix uh paper was
always update all your software as soon
as available immediately full stop
well what sort of data do we have that
contradicts that
well we have the first ever longitudinal
study of what is the impact of software
updates on improving or not improving
the software hygiene and base software
configurations and status of products
and across 22 companies 15 years of
their products over a thousand products
with more than 3 million binaries and
libraries you know uh affected by this
here's the takeaway most updates have
zero impact on the security of the
product
the ones that do were more likely to
make the security worse
than it was to make them better
and that's really confusing
because you know we all know it's like
no no no
you better how could this be possible
you know everybody knows that and you
look around and you say well wait a
second
big businesses that have to do this they
already don't patch immediately they
already don't roll out updates
immediately they put them in a holding
area they bake them for a few days or if
it's a third party software like an npm
or something else several weeks to make
sure that it's not going to break things
it's not going to roll out we also know
as attackers or even red team that you
know uh well mostly attackers that once
you're inside an environment you're
normally not using a novel exploit to
get to the next system inside you've got
your initial credentials for it
it turns out that it does correlate to
better security and there were some
studies showing that strong update
capabilities and practices correlate
with companies being less likely to
experience significant impacts but it's
not causal
and that's what these figures show so
what is the causal aspect well if you
can roll out patches because you know
where everything is you have positive
control over everything and you've got
the operational bandwidth and Cadence
that you're not running around grabbing
all of the engineers off their products
going help me figure out what's in
production help me figure out what needs
to be passed and everything else
that is the positive control of your
environment and that is the causal
aspect the patching and updates are a
secondary possibly tertiary feature for
correlation
now
security updates are a subset of
software updates importance to say some
of those it's a race how can I get my
new code for the security update on a
system before somebody else gets their
new code on the system
and the other thing is that there were
three
um products slash companies that were
not in this study
and they're actually interesting because
they're outliers oh one of the reasons
they're outliers is not a single one of
these companies or product lines showed
a positive trend of the basic hygiene of
their products improving over time it
was random in most case most cases they
actually declined it was easier to
remove a fundamental security feature
than it was to take the risk of turning
it on what would that break for some
customer somewhere
the three outliers
Google Chrome
not all of the other Google products but
Google Chrome
mic uh Microsoft's Windows 10 and
Windows 10 applications basically all of
them
and Apple's IOS
those had positive Trends across updates
for multiple years
they are not the rest of the world
uh and hence you know but that is a bias
of uh of of visibility and presence and
you know that we see that so we biased
to thinking that's how everything else
is Microsoft Google and Apple spend more
money and resources and time and effort
and have the ability to run this
patching systems and processes I forget
how many thousands of patches Google is
rolling out like per week on Google
Chrome as they do this sort of like
rolling a b testing and everything
almost no other company can match that
and it's unrealistic to expect them to
here's why I'm actually okay with
telling most people yeah go ahead update
all your software all the time
most English-speaking people in
English-speaking countries and five eye
countries and everything
Google Chrome Windows 10 and Apple iOS
that's their entire world so yeah take
those
okay
the closing what do we do with this well
there are a few takeaways we talked
about how if there's something that
you're like we always do it that way
that's a really good opportunity to
challenge it and say where's the data
behind that is the data just surveys of
opinions is it a few anecdotes you know
the the plural of anecdote is not
evidence
um and you know starting to bring data
to it and it's not difficult to get a
lot of this data
when you don't have data that's what
Bayesian statistics are for
um the other thing is that there is a
silver lining to all of this
and the Silver Lining is
we're facing a global recession
that's right that's the silver lining
what that means is we're already seeing
infosec orgs getting huge cuts in their
budgets and I know you're like much this
doesn't sound like a silver lining yet
huge cuts of the budgets we're seeing
entire teams being lost and dropped
what's going to happen is part of the
evolutionary process the teams and
companies that make it through are the
ones that are going to be able to
quantify and understand which things
they're doing that are actually yielding
disproportionate value and impact to
their environment not the amount of
effort they put into rolling out a
product but what that product actually
did for changing in a quantifiable and
easy to convey way to the executives of
the board and they're going to keep
those and they're going to cut the other
ones
the majority of teams in leadership out
there
um
aren't doing that they're not going to
do that and at best they're going to
randomly choose what to do or they're
just going to look and see what their
next door neighbor is doing or the other
or the other company is and they're the
ones that are at risk of going extinct
so there is an opportunity right now
to go get some data go get some
measurements you don't need
ultimate very fancy stuff this is basic
math stats probability
and use it to try and evolve the
industry so that's it there are one two
three four something like that Beer's up
here please help yourself enjoy the
happy hour thank you all so much for
everything you've done for the industry
for myself
um I love you
[Applause]
all right folks so that is the last
speaker for tonight uh or today it's
it's it's still light up uh but this
does kick off the happy hour
um it starts now it goes till seven we
are going to kick you out at seven the
bartenders will stop serving you uh but
very graciously uh Mudge and our
sponsors have covered this we want to
thank the sponsors the speakers and of
course all of you uh number one rule
though is to help your bartenders
thank you we will see you all tomorrow
[Applause]