00:00:00.042-->00:00:05.375
>>Welcome! This is Secure Tokin’
and Doobiekeys: How to roll your
own cou- counterfeit hardware

00:00:05.375-->00:00:09.833
security devices. Um, so I know
it was a really, really long
line to get in so I know a lot

00:00:09.833-->00:00:13.875
of you sat through that last
talk just to be here. Right?
Just to make sure you got a

00:00:13.875-->00:00:18.333
really good seat in the front
row? [audience hollers] I'm sure
of that, right? Yea. Okay I

00:00:18.333-->00:00:23.542
thought so. [audience applause]
Um, so I'm securelyfitz, this is
r00tkillah and he’s figuring out

00:00:23.542-->00:00:28.708
how to use Lennox to display.
And, uh, you can push a button
somewhere, it makes that change.

00:00:28.708-->00:00:33.708
Um. [inaudible] Whoooa. Man I
can't see it but that's okay.
That's okay. I don't know, I

00:00:39.333-->00:00:44.333
just talk anyway, so. Anyway.
That’s you. >>Oh! >>Woo! >>Okay.
Hi. Uh, um I'm Mike Leibowitz

00:00:48.792-->00:00:53.792
also known as uh, I.. Awesome.
There’s actually a screen there
too so I can see everything. Uh,

00:00:56.875-->00:01:01.208
my name is Mike Leibowitz. I
work for uh, a large time
conductor company. Uh. I work

00:01:01.208-->00:01:05.625
for Intel. And Uh, they’re
likely to say that, uh, all of
the all of the things I present

00:01:05.625-->00:01:07.625
are not a representation of
Intel and not their opinion. And
all the, all of the uh,

00:01:07.625-->00:01:12.625
registered trademarks of all of
the things that we show are
theirs and we make no claim. Um,

00:01:20.417-->00:01:24.250
you know. And my day job is uh,
is working on the red team
there. I, I hacked the

00:01:24.250-->00:01:28.000
mothership and then the rest of
the time I just fooled around
with electronics and uh,

00:01:28.000-->00:01:33.000
submitted the DEF CON CFPs. >>So
I'm Joe Fitzpatrick. Um, I used
to work for a large time

00:01:36.417-->00:01:41.833
conductor company so now I can
say whatever the f**k I want.
[audience laughs] Um, I do

00:01:41.833-->00:01:45.833
hardware hacking, hardware
security training and stuff. I
own a pair of shoes with LEDs in

00:01:45.833-->00:01:51.250
them and a unicorn shirt. But
that's not what I'm wearing
today. Or at least now. I was

00:01:51.250-->00:01:56.667
wearing it yesterday but then
that turned into today. You know
how that goes. So, um yea but

00:01:56.667-->00:01:59.625
that’s that. You can find me if
you want to. Uh I was gonna
start out with a Call to

00:01:59.625-->00:02:05.708
Hacking. Um, So I'm just gonna
read an excerpt from the, uh,
first book of POC or GTFO. Um,

00:02:05.708-->00:02:10.708
uh, chapter 5, what, what is, 5?
7? Something, section 7 issue
5.. Whatever. Um. Dear Acolytes

00:02:14.625-->00:02:19.708
of electricity, let us spend a
moment remembering the daily
struggles from the time before

00:02:19.708-->00:02:24.000
enlightenment. For let us not
forget that there was a time
when even the most modest system

00:02:24.000-->00:02:29.125
upgrade required a screwdriver.
And let us recall the dark
moments when we were alone with

00:02:29.125-->00:02:35.083
DIP switches not knowing what to
set or where to seek divine
guidance. Thank you, Daniel, for

00:02:35.083-->00:02:40.083
letting me borrow this. So let's
get on to what you uh, came here
for. So wouldn't it be really

00:02:42.292-->00:02:46.167
cool if we had, like, some sort
of magical device oh wow I can
see it through the screen

00:02:46.167-->00:02:50.542
hanging up back there, that’s
kinda neat. Sorry. Um, [audience
laughs] it’s this cool device,

00:02:50.542-->00:02:55.958
uh it could encrypt things for
us, it could authenticate things
for us. Um, it authenticated us

00:02:55.958-->00:03:00.250
to others and pretty much solved
all our insecurities, you know,
whether they were digital,

00:03:00.250-->00:03:06.167
cyber, uh personal insecurities,
whatever. This would be great.
Um, and that, even better, like

00:03:06.167-->00:03:10.000
what if this thing only cost a
couple dollars? It fit in the
palm of our hand and it was easy

00:03:10.000-->00:03:15.708
to use. Like, this sounds great.
And, um, wouldn't it be really
lame if I turned this into a, a,

00:03:15.708-->00:03:21.500
a, like, a hardware sales pitch?
Okay I won't do that. So, um,
these things are all

00:03:21.500-->00:03:27.083
improvements and, um, we’ve got
an RSA security token, a UB key
in the middle and a TPM on the

00:03:27.083-->00:03:31.750
right. So, they're all
improvements. They're all
devices that allow us to use

00:03:31.750-->00:03:37.292
hardware stuff to make our
software more secure, right? The
problem is they're not magic and

00:03:37.292-->00:03:41.000
I'm gonna try to jump over to
that mic right now so I can walk
around because I don't like

00:03:41.000-->00:03:46.000
standing still. [inaudible
speaking in the background]
[laughter] So I'm gonna stand

00:03:54.292-->00:03:59.292
right here. Maybe I’ll walk
around like this. [audience
laughs] [mic noise] So, um,

00:04:04.625-->00:04:07.333
[laughter and applause] so
anybody who’s, like, looked at a
lot of the hardware attacks that

00:04:07.333-->00:04:11.708
can happen, um there are, uh, a
lot of common attacks that
people talk about, right? There

00:04:11.708-->00:04:15.458
is the evil maid attack, this is
where you leave your laptop or
your phone or your tablet in

00:04:15.458-->00:04:21.167
your hotel room and the evil
maid comes in and fails to clean
your room but does manage to

00:04:21.167-->00:04:26.417
implant some sort of hardware or
software, something, on your
laptop while you’re not there.

00:04:26.417-->00:04:30.500
There’s a supply chain, uh,
attackers. Those are the ones
who, like, go in and say “okay

00:04:30.500-->00:04:34.625
well you know, we know you buy
these chips from this source so
we’re gonna go and, like, uh

00:04:34.625-->00:04:39.000
swap out some of our malicious
ones.” Um, or even like, you
know, we’ll, we’ll go and, like,

00:04:39.000-->00:04:44.458
redirect all your packages from,
you know, where you are to some
strange warehouse in, uh, I

00:04:44.458-->00:04:48.375
don't know, North Dakota, and
then back to you and modify
things in the ware in the

00:04:48.375-->00:04:52.750
process. And of course there’s
the end user hardware attacks.
And when you think about a lot

00:04:52.750-->00:04:57.250
of the video game consoles and
jailbreaking type things, a lot
of times this is an end user who

00:04:57.250-->00:05:02.500
owns the hardware who just wants
to use it for their own
purposes. Um, but as a video

00:05:02.500-->00:05:08.333
game consoles, uh, vendor or a
uh, cell phone network you kinda
wanna protect, uh, against those

00:05:08.333-->00:05:13.083
end users actually using things
that they bought because then
all hell would break loose. So,

00:05:13.083-->00:05:17.083
yeah we also have common
vectors. These are the ways
people would usually get into

00:05:17.083-->00:05:21.083
hardware devices, so, right?
Well you, we’ll go after the
external ports, we’ll see, like,

00:05:21.083-->00:05:25.583
if we open up and we find some
pins and also there’s some
interesting cases where we might

00:05:25.583-->00:05:29.292
have counterfeit chips and the
last thing would be, like,
intrusive techniques. Like, you

00:05:29.292-->00:05:33.500
go and you decap your silicon
and, like, shoot it with ion
beams and lasers to modify how

00:05:33.500-->00:05:38.625
it works. So it’s kinda like, it
gets very complicated very
quickly and very expensive very

00:05:38.625-->00:05:43.833
quickly. But, who’s ever, like,
seen someone say this? I'm sure
I'm quoting someone that I don't

00:05:43.833-->00:05:47.542
remember. But, like, don’t
attack the standard, attack the
implementation. When you think

00:05:47.542-->00:05:52.125
about encryption, right?
Encryption’s hard. Right? And
people usually don’t get it

00:05:52.125-->00:05:56.250
right. So, the, the math is
usually sound and mathematically
proven but how people implement

00:05:56.250-->00:06:01.875
it is usually what's all messed
up. Um, so, here though let’s,
let’s be more specific. We’re

00:06:01.875-->00:06:05.625
not gonna refer to the hardware
implementation, we’re gonna
refer to the use cases and how

00:06:05.625-->00:06:09.708
people actually commonly use
these devices. Because that
happens to be a little bit

00:06:09.708-->00:06:14.458
different, uh, when you deal
with hardware things than
software things. So who’s seen

00:06:14.458-->00:06:21.083
one of these before? Who’s,
who’s used one of these? Who,
who hates these things? Okay.

00:06:21.083-->00:06:27.250
So, like, if you wanna hack,
like, like, RSA, like, what’s
the easiest way to do it? Right?

00:06:27.250-->00:06:31.750
A sortof extremely sophisticated
cyber attack is really your best
approach. So no one's gonna go

00:06:31.750-->00:06:36.292
after the hardware, you just do
the phishing email. It works a
lot better, it’s a lot cheaper.

00:06:36.292-->00:06:40.375
But that’s not why we’re here.
We’re hardware hackers and we
like to talk about the hardware

00:06:40.375-->00:06:46.542
that we broke and bricked and
maybe even hacked successfully
occasionally. So hardware can be

00:06:46.542-->00:06:51.083
hard but hardened hardware is
harder. This is right off of
RSA’s page about, like, what

00:06:51.083-->00:06:56.167
they expect in terms of, uh,
hardware security or tamper
resistance. That’s designed to

00:06:56.167-->00:07:00.625
withstand extreme physical
conditions including temperature
variations, submersion in water

00:07:00.625-->00:07:05.042
and mechanical shock. Right? So
really, like, when they’re
talking about hardware security

00:07:05.042-->00:07:07.917
they’re, like, talking about
durability. Like, “you’re,
you’re device is gonna keep

00:07:07.917-->00:07:14.125
working even if you spill water
on it or spill beer on it.” Um,
seriously, like, [audience

00:07:14.125-->00:07:19.000
laughs] we gotta realize that
we’ve got a hardware device that
is more privileged than our

00:07:19.000-->00:07:23.000
software stuff so maybe we
should protect it a little more,
be more careful with it. And

00:07:23.000-->00:07:27.500
they said, uh, submersion in
water? Submersion in acetone
seems to work a little bit

00:07:27.500-->00:07:31.875
differently. [audience laughs
and applauds] So, I mean
there’s, there’s a lot of ways

00:07:31.875-->00:07:36.667
to get this case open. We can go
and we can , like, pry it off.
We can get a dremel and cut it

00:07:36.667-->00:07:40.333
out. Um, there’s actually a
little panel on the bottom that
you can pop off that exposes the

00:07:40.333-->00:07:44.125
debug port, which, you know,
normally that would be the
interesting way in but we were

00:07:44.125-->00:07:48.583
thinking of a more destructive
path. So, you know, when you
when you when you have hardware

00:07:48.583-->00:07:53.750
to hack you usually wanna, like,
grab, like, lots of things to,
to break. And luckily nearly

00:07:53.750-->00:07:58.417
expired RSA tokens are really
cheap on Ebay. So I think I
bought a bag of, like, a hundred

00:07:58.417-->00:08:02.625
of them for twenty bucks. Um,
and of course they’re all
expiring they last for three

00:08:02.625-->00:08:07.792
years so three years after they
were, um, provisioned, or
something they stopped working.

00:08:07.792-->00:08:11.833
Um, but then you just hardware
reset them and they start
working again. Um, thanks Travis

00:08:11.833-->00:08:17.042
Goodspeed for figuring that one
out. Um, so, when we talk about
these things this is the model

00:08:17.042-->00:08:21.167
that we come up with. Like,
okay your computer might be
owned but this token is separate

00:08:21.167-->00:08:26.542
and you’re not gonna own the
token, right? Inside this, this
little token is a master key

00:08:26.542-->00:08:30.958
that is used to generate these,
these one time uh, codes that
you’re supposed to enter. And

00:08:30.958-->00:08:35.417
we’re like, the mindset is this
is what the attacker is after
and that getting that key out is

00:08:35.417-->00:08:39.333
either gonna be really, really
destructive meaning you’re gonna
destroy the token. And now the

00:08:39.333-->00:08:43.500
person is gonna notice it’s
missing and, you know, report it
missing and then the

00:08:43.500-->00:08:49.250
infrastructure gets fixed. Or
it’s gonna be really time
consuming so you’re gonna have

00:08:49.250-->00:08:53.083
to take it away from the person
for a matter of days, hours,
something to, to destroy it or

00:08:53.083-->00:08:57.500
get the key off and then get it
back to them in a way that they
can’t notice that it has

00:08:57.500-->00:09:03.625
changed. Um, so, that’s kinda,
like, how everybody thinks about
these things but, let's take a

00:09:03.625-->00:09:08.750
different approach. What do we
want? We want that verification
code, that six digit pin. Right?

00:09:08.750-->00:09:13.667
And that needs to be output into
some human readable form to
actually use it, right? So why

00:09:13.667-->00:09:19.250
don't we just sniff and relay
the display? So, we gotta open
these up and start looking at

00:09:19.250-->00:09:24.042
them. Uh, they do have some anti
tamper elements to them so, you
know, if you, if you open up and

00:09:24.042-->00:09:27.875
show a bunch of wires sometimes
they turn off. Or they, they put
a little thing marking that they

00:09:27.875-->00:09:32.833
may have detected tampering. Um,
so, you know, the first pass I
went and I plugged this thing in

00:09:32.833-->00:09:36.375
and, and tried to start
soldering it. I got about, you
know, a dozen wires in when I

00:09:36.375-->00:09:40.625
realized it was no longer
functioning so I said “Okay!
Next one.” Um, I, you know,

00:09:40.625-->00:09:46.042
learned. And so what I did is I,
you know, to, to give you an
idea I dremeled off the bottom

00:09:46.042-->00:09:51.542
of, or actually, r00tkillah
dremeled off the bottom of the
token. I taped it between two of

00:09:51.542-->00:09:55.917
these breakout boards and put,
uh, little headers in there. And
then I soldered little bits of

00:09:55.917-->00:10:00.500
wire between the pins and the
headers. And that was a lot
easier and, uh, worked pretty,

00:10:00.500-->00:10:05.250
pretty, uh, smoothly. One thing
I always like to remind people,
like, it looks that I mean

00:10:05.250-->00:10:09.708
this is a lot bigger on that
screen than it is in real life.
And it is kind of small, but,

00:10:09.708-->00:10:13.875
like, don't doubt soldering
skills. Even if you don't have
them, soldering skills are

00:10:13.875-->00:10:18.667
actually very readily available
so you can find someone who’s
really good at soldering to help

00:10:18.667-->00:10:23.375
you with these projects and, um,
there are lots of people with
fine soldering skills. So don’t,

00:10:23.375-->00:10:28.375
don’t rule that out. Don’t say
“Oh, it's too small to solder,
no one’s gonna hack this.” So I

00:10:28.375-->00:10:33.000
started looking at it and, uh, I
used my logic analyzer on the
bottom. And I look at all the

00:10:33.000-->00:10:36.875
pins, trying to figure out which
is which. And sure enough I can
see I don’t know if you can see

00:10:36.875-->00:10:41.167
the, the resolution but we, we
see two different patterns. We
see, like, solid grey which is

00:10:41.167-->00:10:44.792
constantly going up and down.
And then, like, light, or, dark
grey which is where there’s a

00:10:44.792-->00:10:50.375
little bit of space between
those toggles. Um, so if looking
close it looks like this, right?

00:10:50.375-->00:10:55.333
When it’s on and off very fast,
that display that bit is being
displayed. When it’s on and off

00:10:55.333-->00:11:00.417
very slow that bit is not being
displayed. So if we take a look,
we have that bar on the left

00:11:00.417-->00:11:04.750
side that bills every ten
seconds another bar shows up.
And sure enough if we look at

00:11:04.750-->00:11:11.250
our logic analyzer we can see
where is the mouse? Can I see
the mouse? Oh well. Forget it.

00:11:11.250-->00:11:16.250
Um, we can see on the left side.
We see one uh, oh you don't use
a touch pad? Why not? Um

00:11:19.625-->00:11:23.375
[laughter] so, you can see over
here, um, that, you know, we’ve
got this one that, that toggles

00:11:23.375-->00:11:27.792
right here switches on. And then
ten seconds later if we look at
the timing this one switches on.

00:11:27.792-->00:11:31.833
And then ten seconds later the
next one switches on. So it’s
pretty easy, like, once we get

00:11:31.833-->00:11:36.083
the wires stubbed out to figure
out what this thing’s doing and
how it can, uh, see how it’s

00:11:36.083-->00:11:41.917
going. So let’s make [inaudible]
some pseudocode ‘cause
pseudocode is about as technical

00:11:41.917-->00:11:48.792
as I would like to get. Um, is
LCD on? We sample a pin three
times at 128 hertz. If we get

00:11:48.792-->00:11:53.792
101 or 010 we assume that it’s
on, right? We return true. So
LCD is on. This works because

00:11:56.083-->00:12:01.000
when we have these fast toggles,
it’s on. I believe I may have
set up the opposite just a

00:12:01.000-->00:12:07.083
moment ago. If we see the fast
toggles, it’s on. If we see the
slow toggles, it’s off. Okay?

00:12:07.083-->00:12:11.250
Um, now so, what we’re gonna do
on the main thing is we’re
gonna, we’re gonna wait until

00:12:11.250-->00:12:16.625
the LCD is on, right? So the
second to the last bar is gonna
be there and that’s a good time

00:12:16.625-->00:12:21.625
for us to, to, to sync up and
find it. For each separate
segment element we go and check

00:12:21.625-->00:12:27.500
if that LCD is on and if it’s
on, you know, we, we record
that. And then we delay 59

00:12:27.500-->00:12:31.458
seconds. The reason we delay 59
seconds is because we don’t
wanna, like, delay more than a

00:12:31.458-->00:12:36.792
second. More than a minute can
start missing codes. So we read
that. Um and we, we delay when

00:12:36.792-->00:12:40.792
we delay if we’re doing a
microcontroller we wanna be
asleep because that’ll save a

00:12:40.792-->00:12:45.625
lot of power. So, I’ve been
playing with this little guy.
Who who was at the 503 party?

00:12:45.625-->00:12:50.625
Who has a 503, uh, Oregon Trail
badge? Who’s got a Bender badge?
Um, so a lot of these use this

00:12:53.375-->00:12:58.375
little module, uh, it’s a BMD300
or a BMD320. It’s a tiny, tiny,
tiny, tiny uh, bluetooth module.

00:13:00.458-->00:13:06.250
It’s got a cortex m4 core on it,
it does BLE, it’s really low
power. They’re really great. Um,

00:13:06.250-->00:13:12.000
and they’re lots of fun. So, and
they have lots of GPIO. So it’s
got plenty of, uh, horsepower to

00:13:12.000-->00:13:16.250
read those LCD pins, plenty of
connectivity to connect all
those pins. Um, and what’s great

00:13:16.250-->00:13:21.125
is we can just leach it off of
the battery that’s already in
there. Um, who’s ever, like,

00:13:21.125-->00:13:26.167
modified a game console before?
To play backup copies of your
games? Okay. I actually don’t

00:13:26.167-->00:13:29.958
ever own any games. I, I buy
game consoles and, like, do the
mods and then I'm like, ah

00:13:29.958-->00:13:33.458
games. They’re kinda silly, I
don’t actually play the games.
I’ve already, I’ve already

00:13:33.458-->00:13:38.083
played the game. So this is a
picture of a, of a gamecube
drive chip. What's really cool

00:13:38.083-->00:13:41.625
about these is they’re very user
friendly hardware implants
right, you just get this thing

00:13:41.625-->00:13:45.083
and then line it up so those
holes are in the right spots so
it’s really easy to solder. Even

00:13:45.083-->00:13:49.167
if you suck at soldering, you
can do this. Right? So I'm like
okay, I can, I can do something

00:13:49.167-->00:13:54.875
like that. Let me build a little
board that fits right in here.
So this is the RSA token to

00:13:54.875-->00:14:01.583
BMD300 uh, uh, adapter. Um and
it, you know, it's on Github. I
don’t know if I pushed it yet

00:14:01.583-->00:14:06.500
but I’ll push it soon. But, you
know, I basically spaced it all
out so it lines up just right.

00:14:06.500-->00:14:11.417
You can see we've got uh, a
little notch right here and a
notch right here. Those line up

00:14:11.417-->00:14:15.500
very well with the plus and
minus power here. And we've got
a pad here for that little BMD

00:14:15.500-->00:14:20.042
module. You’ll notice it doesn't
have pins it has a bunch of,
like, surface mount pads. It's

00:14:20.042-->00:14:24.917
like a little module on module
so it’s it can be kinda
difficult to solder up. So

00:14:24.917-->00:14:30.875
here’s uh, the boards I got uh,
a whole bunch of them. Um, and
you know I wanted to get really

00:14:30.875-->00:14:33.792
thin PCB’s. You’ll notice uh,
there's one missing ‘cause I’ve
already started to solder it.

00:14:33.792-->00:14:38.125
There's one on the far right
side with a little X in it. They
do some basic test of your PCB

00:14:38.125-->00:14:43.583
when you get it manufactured so
that kinda rules out the, the,
the other failures. Um, most,

00:14:43.583-->00:14:48.917
some of the other failures. The
ones you designed in there will
stay. Um, you’ll also notice

00:14:48.917-->00:14:53.792
that that is a nice granite uh,
surface below. What I'm working
on. You might have recognized

00:14:53.792-->00:14:58.792
that as the granite surface in
your hotel room. Um, so.. Uh,
you know, normally you’d use

00:15:00.917-->00:15:06.000
like, a, a.. What I did for my
first couple prototypes was I,
uh, I used a hot plate. So like,

00:15:06.000-->00:15:10.667
uh, like you know like you know
to cook up your eggs in your
dorm room kinda thing. Um, those

00:15:10.667-->00:15:14.083
get really hot, you put the
board down on there. What I did
was I put a little bit of solder

00:15:14.083-->00:15:18.125
on the pads, put the bit piece
on top and it got warm. Of
course I didn't bring my hot

00:15:18.125-->00:15:22.750
plate with me to Las Vegas. I
did bring my portable hot air
gun though, ‘cause everyone

00:15:22.750-->00:15:26.583
brings those, right? Um, so I
tried to simulate the hot plate
by holding the board over the

00:15:26.583-->00:15:32.625
edge of the table and uh, uh, uh
blowing hot air from the bottom
trying to, to melt it. I did

00:15:32.625-->00:15:36.750
burn one I don't know if you can
really see in this image but the
far right side is all black and

00:15:36.750-->00:15:41.667
messed up and that’s because I
toasted it. Um, so it takes a
couple tries. Eventually you get

00:15:41.667-->00:15:47.292
the module on there. So here
we’ve got an RSA token, um, with
the whole back taken off. And

00:15:47.292-->00:15:52.208
then this little module pops
down in there and soldered in
and then the rigado, the

00:15:52.208-->00:15:57.083
bluetooth module, soldered onto
that. Okay so now we've got the
whole setup. This guy is gonna

00:15:57.083-->00:16:01.083
get power from the battery
that’s in there. The battery’s
supposed to last for three years

00:16:01.083-->00:16:05.375
on just these tokens alone. But
these bluetooth modules are
pretty awesome. You know, if you

00:16:05.375-->00:16:09.208
ever uh, they have like these
little becon things so you uh,
like, you put’em in the beer

00:16:09.208-->00:16:12.917
aisle and you have an app on
your phone and you walk by the
beer aisle and it says “Hey! Buy

00:16:12.917-->00:16:17.000
beer!” You know, here’s a
coupon. Um, it’s this whole,
like, business model. I don't

00:16:17.000-->00:16:22.667
know if it actually works or
exists but I’ve seen, uh,
concepts of this. Um, but the

00:16:22.667-->00:16:26.208
idea is this little device will
last two plus, two or three
years and some of them use this

00:16:26.208-->00:16:31.208
little bluetooth module that we
have. Um, and so you have a
device it just broadcasts a

00:16:31.208-->00:16:35.792
little message once every second
once every, you know, few
milliseconds. Um, we’re only

00:16:35.792-->00:16:41.208
broadcasting once every minute.
So we should have a negligible
power draw on this whole system.

00:16:41.208-->00:16:45.750
Um, and again they, they, they
last for three years normally.
Um and there's plenty of battery

00:16:45.750-->00:16:51.167
to last beyond that so we’re not
gonna, we’re not gonna do any
damage to this thing uh, until

00:16:51.167-->00:16:56.167
probably passed it’s expiration.
So so here we are. Um, and if
you look at this, this is the

00:16:58.375-->00:17:04.958
back of one of those modules
before I uh, defiled it. Um, or
filed it off. Um, and you can

00:17:04.958-->00:17:09.375
see, like, there’s this, like,
sticky stuff and these little
pins and there's little um,

00:17:09.375-->00:17:13.958
black pale that sticks over
there. So I'm pretty sure I have
not yet done it because my

00:17:13.958-->00:17:19.542
equipment at uh, in the hotel
room is not that great. Um, I
believe that I can get just that

00:17:19.542-->00:17:24.958
piece out and get my module in
there and then we can put that,
that black panel back on top

00:17:24.958-->00:17:29.417
and, like, not actually see that
this has been dramatically
changed. Um, as you see it fits

00:17:29.417-->00:17:33.625
right in there. Um, we do have a
whole bunch of PCB’s so if you
wanna try this, you know, we’re

00:17:33.625-->00:17:38.417
gonna toss them out at some
point in time. Um, 200 PCB’s uh,
for your own, uh, roll, roll

00:17:38.417-->00:17:43.958
your own uh, RSA toker, tokin’.
Whatever you wanna call it. Um,
we can listen to that

00:17:43.958-->00:17:48.958
verification code that gets sent
uh, from the uh, microcontroller
on this token to the display. We

00:17:51.750-->00:17:56.625
read those pins on the display
and then we broadcast it over
bluetooth. Right? Um, we still

00:17:56.625-->00:17:59.833
have to do the work of sealing
up the case whether we get it in
there without, like, completely

00:17:59.833-->00:18:03.750
destroying it or not. But always
think of it this way, if someone
manufactured these in the first

00:18:03.750-->00:18:09.417
place, right, you gotta be able
to make them again. So, um, and
actually the other idea that I

00:18:09.417-->00:18:12.792
had on this is I was kinda
working through how many of you
really, like, get frustrated

00:18:12.792-->00:18:16.583
when you have to go and, like,
dig out your token and then like
find it and then you have to

00:18:16.583-->00:18:22.208
type in the six digits and
sometimes you mistype them. It’s
really annoying. So if we wanted

00:18:22.208-->00:18:26.083
to, if anybody’s interested,
like, you can do a, uh, an
alternate firmware for this.

00:18:26.083-->00:18:30.042
Where instead of showing up as
just a broadcast device you have
to show up as a hid device.

00:18:30.042-->00:18:33.500
Right? And you just pair it with
your computer and then every
sixty seconds it’ll type your

00:18:33.500-->00:18:38.500
code for you. Wouldn’t that be
awesome? [audience applause] So
with that, I don't have a demo

00:18:41.625-->00:18:46.708
for you. I apologize. But I’ve
got PCB’s and I'm sure you like
PCB’s better than demos ‘cause

00:18:46.708-->00:18:51.208
you get to take PCB’s home the
demo you just sit here and
watch. Um, so, onward, uh

00:18:51.208-->00:18:57.000
Mike’s gonna tell us a little
bit about Doobiekeys. Do you
wanna hold this or do you want

00:18:57.000-->00:19:02.000
me to put it back? >>No. Put
that back. [mic noise] Hello,
hello? Alright, so, um. You know

00:19:11.417-->00:19:17.250
the great thing about, about
Yubikeys is that hardware
security tokens used to be

00:19:17.250-->00:19:22.750
expensive and Yubikeys are
cheap. In fact, they’re so cheap
that people will just give them

00:19:22.750-->00:19:27.750
away at conferences. Um, and you
know, I I really like the idea
that, like, there are lots of

00:19:31.083-->00:19:35.583
people out there going to hacker
cons getting, getting free
pieces of hardware that they

00:19:35.583-->00:19:42.292
then give you all their trust
in. Uh, I think that’s
fantastic. [audience laughs] So,

00:19:42.292-->00:19:47.458
you know, what, what we really
wanna know is, like, how do I
know this is actually legitimate

00:19:47.458-->00:19:52.958
hardware? Like, you know, how
trustable is this hardware? And
this is, you know, a question

00:19:52.958-->00:19:58.958
that was posted in the Yubikey
forum and this is actually a,
the, the, the initial response

00:19:58.958-->00:20:03.958
and, and so Tom 2 is a Yubikey
employee. Or a Yubico employee.
So, you know, does it um, does

00:20:07.917-->00:20:14.292
it say Yubico on it? Does it uh,
does it have a number? Okay.
Good. We’re, we’re good. This

00:20:14.292-->00:20:19.292
is, this is fine. [laughter]
but, you know, they, they do
provide you some means to, like,

00:20:23.625-->00:20:28.792
actually say if this is a
legitimate Yubikey or not. They
provide you with a, with a one

00:20:28.792-->00:20:34.375
time password um, um,
authenticator, right? This is,
this is actually a demonstration

00:20:34.375-->00:20:41.167
of the authenticator that you
can then you, you can use the
same API into your website so

00:20:41.167-->00:20:44.833
you can see whether, you know,
you can authenticate or keep
your passwords from, from

00:20:44.833-->00:20:48.875
Yubikey users. Then they provide
a little demonstration and you
can say, like, okay stick it

00:20:48.875-->00:20:52.583
in, push the button, it fills
out the little thing. And then
it can tell you, like, you know,

00:20:52.583-->00:20:58.375
if Yubikey is legitimate. Well
that’s kind of interesting. Um,
but you know, one of the things

00:20:58.375-->00:21:04.333
that I noticed about the Yubikey
is it comes with, it comes with
a, an identity and a key. And

00:21:04.333-->00:21:10.417
like, a lot of people want to
customize their Yubikey to
provide, like, an identity that

00:21:10.417-->00:21:15.708
they control. And so, like, you
can imagine in each case for
this, like, if you had a

00:21:15.708-->00:21:19.708
corporation, right? And you
wanted to validate that that
these keys were all from your

00:21:19.708-->00:21:24.500
organization then you would
provision all the keys into
there and, and define a prefix

00:21:24.500-->00:21:28.583
and then you would know, like,
okay this one’s part of our
corporation. This is just some

00:21:28.583-->00:21:34.792
yo-yo with another Yubikey. And
so they provided this customized
utility, which is great, and

00:21:34.792-->00:21:40.250
allows you to, like, give them
generate a key, implant it into
the key and then upload the key

00:21:40.250-->00:21:47.083
to Yubico so that when you use
it, it still appears as valid.
So you actually, uh, sign the

00:21:47.083-->00:21:52.208
new, um, sign the new key with
your existing key and uploaded
it and then it’s tracked and

00:21:52.208-->00:21:56.625
they know that you’re you. Or
they know that you’re
legitimate. Not necessarily you.

00:21:56.625-->00:22:01.625
Um, but they also, uh, provided
a, a uh, arduino reference
implementation. Or sort of

00:22:05.375-->00:22:09.958
example implementation of a soft
Yubikey. And I wanted to make my
own Yubikey because I thought

00:22:09.958-->00:22:14.417
that it was neat but I wanted it
to have kind of different
security properties than they

00:22:14.417-->00:22:20.667
do, right? The Yubikey their
property is that, uh, you have,
uh, a secure storage in there

00:22:20.667-->00:22:26.208
that you, you can’t get out.
Well, maybe I will just wanna
make one that, like, has storage

00:22:26.208-->00:22:31.292
in there and tells everyone. Um,
so but they gave me a great
starting point. You can actually

00:22:31.292-->00:22:36.292
go to Github and you can clone
their simulator. And I noticed
that, um, the 18 mega, or the

00:22:39.333-->00:22:46.250
arduino pro micro is, like,
pretty small and so, like, it’s
like almost the size of a

00:22:46.250-->00:22:50.958
Yubikey. Like, how hard could
this be? I’ll just make one and
it’ll be neat. But how do they

00:22:50.958-->00:22:57.708
how, how does this really work?
You know? How, how does this
flow actually work? So you, you

00:22:57.708-->00:23:02.500
know, you have um, you go to a
website and you enter in, you
know, like, okay your password

00:23:02.500-->00:23:07.125
and etcetera. And then it sends
you back this challenge, like,
okay now you use your OTP that,

00:23:07.125-->00:23:13.417
that, that we registered before,
right? And so you put in your,
your yubikey, it blinks and you

00:23:13.417-->00:23:19.208
touch it and it gives the key
and then they go to talk to the
yubico authenticator and they

00:23:19.208-->00:23:23.708
give the signature to the yubico
authenticator and then it says,
like “yes, this is good.” Um,

00:23:23.708-->00:23:28.250
and that’s like, basically the,
the use case file. And then on
the other side, you know, what

00:23:28.250-->00:23:33.583
are all the different components
that are in, you know, what are
all the components that are in

00:23:33.583-->00:23:39.708
there? Well, there’s a public
identity and a private identity
and the AES key and a Counter.

00:23:39.708-->00:23:46.083
So, basically, um, and they have
their it looks like jibber.
jibber jabber strings up there

00:23:46.083-->00:23:50.958
but they have their own it’s a
hex string. They just have an
alternate encoding for, for

00:23:50.958-->00:23:56.250
hexadecimal. And basically uh,
if you make a signature again
and again you'll see that the

00:23:56.250-->00:24:01.125
prefix comes through and you
can, and it’s the same every
time. And then the other part

00:24:01.125-->00:24:06.792
rotates because it’s being mixed
in with the Counter encrypted,
uh, with the AES key and then it

00:24:06.792-->00:24:11.167
goes to yubico and they can,
they know your AES key. They
decrypt it and they can check

00:24:11.167-->00:24:17.792
them, it’s called a monotonic
counter. So they can protect
against replays by making sure

00:24:17.792-->00:24:24.333
the monotonic counter is greater
than the one they last saw. And
the reason they don’t, like, say

00:24:24.333-->00:24:28.958
that, you know, it’s plus one
because you can make an, you can
make an accidental signature,

00:24:28.958-->00:24:33.583
right? That just, like, went
into your, you know, into your
document or whatever. Into your,

00:24:33.583-->00:24:39.750
into your editor >>Into your
Slapchat. >>Into your slapchat.
[laughter] No one’s done that.

00:24:39.750-->00:24:44.750
Um, and so it just needs to make
sure that it, that it’s big. So,
okay. How hard could this be,

00:24:47.417-->00:24:53.042
right? Like you see the
apologize for the, for the, for
the dark photograph, but you see

00:24:53.042-->00:24:59.333
on the on the left you see,
like, a legitimate yubikey. I
mean, probably. And then just to

00:24:59.333-->00:25:05.375
it’s right you see a arduino pro
micro and you can see, like,
okay that’s, like, kind of

00:25:05.375-->00:25:09.958
about the same size, you know?
And arduinos are open hardware,
like, how hard could this be to

00:25:09.958-->00:25:14.958
make your own? So, um, it’s not
that hard I think I'm just not
that good at it. [laughter] So I

00:25:18.833-->00:25:24.333
went through, um, two
generations. Like the first one
on the left, which looks pretty

00:25:24.333-->00:25:29.333
good but it has a few, like,
flaws, you can see, like the Y
is upside down. And uh, and the

00:25:32.417-->00:25:37.417
USB leads are just slightly too
long but what you can’t see is
that, you know, left and right

00:25:39.792-->00:25:44.000
are hard and so the USB
connectors are actually
reversed. And you plug that in

00:25:44.000-->00:25:50.125
and it just, uh, shorts out.
[laughter] So uh, yea it’s, it’s
funny. If you, if you look at

00:25:50.125-->00:25:55.750
the USB connector and you look
at the pin out it shows you,
like, okay this is ground and

00:25:55.750-->00:26:00.333
this is power and etcetera but
if you actually look inside the
PCB is upside down facing the

00:26:00.333-->00:26:05.375
other way. So in my defense,
like, that was a little bit
tricky. [laughter] And then, um,

00:26:05.375-->00:26:10.375
you know, um I, I, I, I like to
work on deadlines so, like, I
had to have boards emergency

00:26:15.250-->00:26:21.250
made so they could get here in
time for Vegas. And uh, I had
them made by two different PCB

00:26:21.250-->00:26:25.958
houses. And it was like a race,
like, okay so who can get me
these PCB’s before I fly on a

00:26:25.958-->00:26:30.958
plane to Vegas? And um, so we
actually have the same design in
the far right and the next to

00:26:33.458-->00:26:39.375
far right. [clears throat] It’s
just that each PCB house f****d
it up a little bit differently.

00:26:39.375-->00:26:44.375
[laughter] So the, um, the one,
just, the one next to the far
right to the almost far right,

00:26:48.292-->00:26:53.708
um, with all the speckles on it,
those are vias. They connect,
um, the top layer to the bottom

00:26:53.708-->00:26:58.167
layer. And the reason it’s all
speckled is because they’re not
tented. So tented would be that

00:26:58.167-->00:27:03.417
that solder mass, that black
layer, would be over them. Um,
and then they wouldn't be all

00:27:03.417-->00:27:07.042
speckled and they would look
prettier but the side affect of
them look pretty, looking pretty

00:27:07.042-->00:27:14.000
is that the chip actually has a
ground pin underneath it. And
there’s not a whole lot of extra

00:27:14.000-->00:27:19.000
space on that board so I that,
that ground pin is not used for
electrical purposes. Mostly it’s

00:27:21.333-->00:27:26.292
for, um, you know, mechanical
purposes. Make sure you have a
really good bond to the, to the

00:27:26.292-->00:27:31.917
PCB so, like, if you drop the
board the chip doesn't pop off.
That’s only happened to me a few

00:27:31.917-->00:27:38.375
times. And uh, so what happened
was you solder these up and
that, that, that, uh ground pin

00:27:38.375-->00:27:43.458
under, under there just shorts
out with all of, all of those,
uh, vias. And uh, it doesn't

00:27:43.458-->00:27:49.458
work at all. You plug it in, it
gets hot and nobody’s happy. Um,
so I, I got, like, one working

00:27:49.458-->00:27:54.667
by, by, by, like, you know,
frantically, like, taping the
you know, putting tape on the

00:27:54.667-->00:27:59.417
bottom of the microcontroller
and soldering it and, like,
reflowing it and, and, and

00:27:59.417-->00:28:04.792
trying to make sure it would
work. And then, so. But the
other ones arrived. And the

00:28:04.792-->00:28:11.208
other ones I'm like “oh this is
perfect. Look at them, they the
text is the right way, the vias

00:28:11.208-->00:28:14.542
are tented this is gonna be
great.” And I, and I soldered it
up and I programmed it. On the

00:28:14.542-->00:28:20.292
bottom is a programming header
that you break off and goes into
the plastic. And um, it

00:28:20.292-->00:28:23.583
programmed great and I plugged
it in and nothing happened.
Nothing happened. Nothing

00:28:23.583-->00:28:27.958
happened and I'm like “oooh
what’s going on??” And actually,
the, the, the one that looks

00:28:27.958-->00:28:32.958
like it’s been destroyed up in
the corner there, I think you
can see that. Um, so yea, uh, I,

00:28:36.125-->00:28:41.208
I sanded it off to be like “what
the hell is going on?” And it
turns out that uh, the board

00:28:41.208-->00:28:48.042
houses had different tolerances
for, uh, for the feature size. I
mean, I was within the feature

00:28:48.042-->00:28:53.542
size that the board house said
but, whatever. The ground plane
for the USB connector actually

00:28:53.542-->00:28:58.167
doesn't connect. So if you power
it with the programming
connector and plug it in, it

00:28:58.167-->00:29:01.500
actually works fine. Or, or if
you ground it with the
programming connector and plug

00:29:01.500-->00:29:06.417
it in it works just fine, but if
you cut that off and put it in
plastic it’s a brick. So you

00:29:06.417-->00:29:11.417
know, um, I think that there’s
a, a lot of emphasis on showing,
you know, showing the audience

00:29:14.042-->00:29:18.042
like, “I did this! I did this!”
and boom, there's blood all over
the floor and, and in reality

00:29:18.042-->00:29:22.167
there’s, like, a lot of f**k ups
on the way. And like, you know,
these are some of the f**k ups.

00:29:22.167-->00:29:29.042
So, you know, that's a PCB but,
like, I don't, I don’t plug the
PCB in I plug in this, like,

00:29:29.042-->00:29:33.375
plastic and, and, you know, it
says yubico on the bottom and,
you know, you, you can’t make

00:29:33.375-->00:29:38.375
that. So, um, thanks to the
wonderful world of 3D printing,
it turns out that uh, you can.

00:29:41.875-->00:29:47.208
Uh, so, let’s see I, I’d wave
one around at you but like, it’s
gonna be microscopic and you

00:29:47.208-->00:29:53.708
won't see it anyway. But yeah, I
made, like, little 3D printed
um, cases that the PCB fits

00:29:53.708-->00:30:00.250
right into. And um, and it, you
know, looks pretty good. A
little bit more skill on the

00:30:00.250-->00:30:05.750
part of my 3D printing and it
probably would look really good.
But, you know, time was uh, time

00:30:05.750-->00:30:11.792
was running out so they just
look pretty good. And then, you
know, this is, this is, like

00:30:11.792-->00:30:16.667
pretty close. You can see if I
were to cut that debug header
off and, like, smooth out you

00:30:16.667-->00:30:23.333
know smooth out that top layer
it would look pretty good. Um,
the Y’s like inverted but,

00:30:23.333-->00:30:28.333
that's fine. [laughter] >>Why
not? >>Why Yeah, that’s right.
[laughter] Why not? [laughter]

00:30:31.375-->00:30:35.792
Yeah, so, uh and, and, you know,
would you really notice that? I
don’t, I don’t think so!

00:30:35.792-->00:30:41.250
[laughter] The tape you might
notice but, I'm sure I can,
like, in the next rev, like, get

00:30:41.250-->00:30:45.250
the tape out of there. Actually
the, the, the tape is there
because I had to cut off the

00:30:45.250-->00:30:50.875
bottom of the, uh, I had to cut
off the bottom of the connector
to get the debug header out.

00:30:50.875-->00:30:55.417
Because I sure as s**t wasn’t
gonna destroy my only, like,
working one that had a working

00:30:55.417-->00:31:00.417
USB plug [laughter] uh, just
before I got on stage. So, you
know, can we, can we, uh, can we

00:31:05.583-->00:31:09.125
take this, can we like, well,
can we, test that our yubikey
is, uh, legitimate? Sure! Can we

00:31:09.125-->00:31:14.125
test that our doobiekey is
legitimate? Sure! Like, this is,
uh, this is sort of a prototype.

00:31:18.500-->00:31:25.000
Um, this is the signature from
it. Um, and then this is the
actual, like, key, this is like

00:31:25.000-->00:31:30.667
an arduino pro micro with a
paperclip sticking out. Um, you
know, that, that, that will fool

00:31:30.667-->00:31:36.750
the unica servers but it
probably won’t fool the user.
But like you said, you can, you

00:31:36.750-->00:31:42.708
can see that- [inaudible
interruption] [laughter] you can
see that they’re actually, like,

00:31:42.708-->00:31:47.500
pretty close in size. Like,
that’s what got me kinda going
down this road in the first

00:31:47.500-->00:31:52.500
place. Okay. So, this is the
scary part. It’s demo time! Uh,
okay now I'm displaying in two

00:31:58.167-->00:32:03.167
places and I have to figure out
how this all works. Um that’s
not what I want. This one. Okay.

00:32:06.042-->00:32:11.042
How do I get rid of the how do
I get rid of that, like, demo
time thing or whatever? Okay.

00:32:16.833-->00:32:20.250
>>It’s, like, harder when you
can’t see. >>Kinda harder when
you can’t see what you’re doing.

00:32:20.250-->00:32:25.250
Okay, so we got a, uh, brand
new out of the box yubikey. And
we got the yubikey customizer.

00:32:32.917-->00:32:35.000
And I can probably find the USB
port on this. And, okay. If this
works then it should say that I

00:32:35.000-->00:32:40.000
have a yubikey plugged in.
That’s disappointing. [laughter]
It says it? Awesome! [inaudible

00:32:55.583-->00:33:00.583
response] I can’t see anything.
[inaudible response] Yay! Okay
and then the top link should be,

00:33:03.458-->00:33:08.458
like, to customize the OTP. Is
it? Easy mode. And, man this is
hard when you can’t see jack.

00:33:14.458-->00:33:19.458
Hold on. Eeeeerup. [laughter]
Uh well let’s see, let’s uh,
let’s uh click the re-generate

00:33:23.375-->00:33:29.583
button. Uh.. okay. So now that I
know which button is which. Boy
I shoulda got mirroring work and

00:33:29.583-->00:33:34.583
that would have been way better.
You can re-generate and then we
can upload to yubico. Okay.

00:33:40.875-->00:33:45.708
[audience speaks amongst
themselves] Re-gener [audience
continues to speak amongst

00:33:45.708-->00:33:52.667
themselves] Alright. [audience
continues to speak amongst
themselves] >>It’s greyed out,

00:33:52.667-->00:33:57.667
though. >>It’s greyed out? Awww!
>>Oh no, try it. [audience
speaks amongst themselves]

00:34:02.375-->00:34:07.375
[laughter] There we go! >>Oh
yay! [applause] Okay, now why
is it are we why is it greyed

00:34:09.625-->00:34:14.625
out? >>Try figuration on the
left. >> Ahh. Yay! Do I wanna do
this? That’s yes, right? No

00:34:16.875-->00:34:21.875
that’s no. [laughter] Yeah I
wanna do it. Uh da da da da
da. Aw s**t. [laughter] Wait.

00:34:28.458-->00:34:33.458
Eeeerr. Eeeeerrup. Hold on.
[laughter] Uh, okay. [laughter]
Uh, yea but I wanna open the

00:34:40.458-->00:34:45.458
file. Uh, okay. So I need to
upload I need to, like, drag the
window back so you can see it.

00:34:57.667-->00:35:02.667
Which now my mouse just died. I
hate computers. >>Whose idea was
this anyway? >>[deep sigh]

00:35:06.917-->00:35:13.667
Really? I hate computers. Why
did my mouse die? My mouse like,
literally, like, can’t move now.

00:35:13.667-->00:35:18.667
Ah f**k, f**k, f**k [faint
question from audience] No it’s
the built in one. Arrrrg.

00:35:26.792-->00:35:33.125
Alright. This is gonna be really
awkward, I think I have to
reboot. [laughter] >>Shall I,

00:35:33.125-->00:35:38.125
uh, entertain them? >>Yeah,
yeah. You do the entertaining,
I'm gonna do the rebooting.

00:35:41.042-->00:35:46.083
>>How’s it going? So, while Mike
reboots and we figure out what's
going on right there, I'm gonna

00:35:46.083-->00:35:50.083
step over this so I can walk
around in circles. I'm gonna
start talking and what can I

00:35:50.083-->00:35:54.333
talk about? Um I can talk about
some of the other, uh, projects
that we did. So, we had a couple

00:35:54.333-->00:36:01.167
half baked ideas in addition to
the token and um, the doobiekey.
And one of them was, uh, what

00:36:01.167-->00:36:06.792
was the first one? Oh so we were
gonna try and, like, make a, a
fake TPM. Right? And then we

00:36:06.792-->00:36:12.250
started looking into it and the
TPM is like an open standard.
You can, um, basically make your

00:36:12.250-->00:36:16.667
own as long as you read all,
like, ten thou oh, sorry one
thousand plus pages of the spec.

00:36:16.667-->00:36:21.250
And, uh, and do it properly. One
of the other problems with the
TPM, is like because it’s

00:36:21.250-->00:36:25.333
supposed to actually be secure,
the supply chain is kind of sort
of secure. But if you actually

00:36:25.333-->00:36:29.750
want to install, uh, a TPM in a
system that doesn't have one
already you have to, like, go to

00:36:29.750-->00:36:33.792
sketchy dealers to get it. Which
means going to Ebay and buying
one at the lowest cost from

00:36:33.792-->00:36:38.625
anonymous seller somewhere. Um,
and really what it came down to
is we couldn't come up with a,

00:36:38.625-->00:36:44.750
with a, a, a drug reference name
for the TPM so we just skipped
on that one. And it was hard.

00:36:44.750-->00:36:50.042
Another one we worked on, uh,
was messing around with the way,
uh, uh Ubuntu does secure boot.

00:36:50.042-->00:36:53.375
Right? So if you think about it,
when you have secure boot
enabled on your system you’re,

00:36:53.375-->00:36:56.750
you’re checking your signatures
and your kernel and your
operating system based on keys

00:36:56.750-->00:37:01.292
that are stored in your spy
flash chip, your bias. And, uh,
that sounds great. That’s

00:37:01.292-->00:37:06.417
hardware. We can kind of sneak
in there and modify the contents
of that. Um, but there’s other

00:37:06.417-->00:37:11.292
uh, nuances to this. The way
that that secure boot works on
Ubuntu is it actually has a shim

00:37:11.292-->00:37:17.000
that's signed by Microsoft. And
that shim is allowed to boot.
And that shim goes and boots a

00:37:17.000-->00:37:22.583
signed version of grub. And that
grub will go and it’ll boot a
secure, uh, signed kernel. Well

00:37:22.583-->00:37:26.792
the dilemma is if it doesn't
find a secure kernel it just
like, exed the whole secure boot

00:37:26.792-->00:37:33.500
thing and it, um unsecurely
boots. So you boot up with, with
secure boot disabled. Um But the

00:37:33.500-->00:37:37.167
thing is you know, you're, you,
you can, you can do that. You
run the system, you’re in charge

00:37:37.167-->00:37:43.542
now. Um. Wouldn’t it be great if
we could, uh, exit the secure
boot process, um, before we

00:37:43.542-->00:37:48.125
close it out? So we basically
found some sort of bug or
vulnerability or issue with the

00:37:48.125-->00:37:52.750
way grub does that. Which may be
very hard to do ‘cause there’s a
lot of different, uh, config

00:37:52.750-->00:37:57.083
files, codes, modules all sorts
of things that grubs loathes. So
basically if you, you mess with

00:37:57.083-->00:38:03.458
grub, you allow it to escape.
You’re still running arbitrary
code in your whole a um, in your

00:38:03.458-->00:38:08.875
whole secure part of your boot
process. So we call that the
secure boot spliff. Again, um..

00:38:08.875-->00:38:11.875
That’s all dependant on finding
a bug which we didn't find,
mostly because we didn't look

00:38:11.875-->00:38:14.542
for it. And if we looked for it
and found it we would actually
have had to go through

00:38:14.542-->00:38:20.125
disclosure which would have been
difficult. So, um.. Burning some
yubikeys? [faint response from

00:38:20.125-->00:38:25.417
audience] We blew up a yubikey.
Um so next, uh, that was a
secure boot spliff. Then the

00:38:25.417-->00:38:29.583
last one we, uh, were looking
at, like, you know, there’s,
there’s some.. There’s a paper a

00:38:29.583-->00:38:34.417
couple years ago of, uh last
year, sorry. By Invisible Thing
Labs about, uh, how state is

00:38:34.417-->00:38:38.958
considered harmful. Anytime you
store state, you know, you can
store malicious, or potentially

00:38:38.958-->00:38:43.958
malicious configuration or code.
So, what the okay. Um, what the,
uh you havin’ fun? >>You can

00:38:47.083-->00:38:52.333
keep talking. >>I can keep
talking? So what this, uh, what
this idea was like okay let’s,

00:38:52.333-->00:38:55.542
let’s, let’s make it very
simple. We’ll make a, a state
board and a logic board. The

00:38:55.542-->00:39:01.667
state board was a flash chip,
the logic board was an XOR gate.
Like a 1970’s XOR gate. And we

00:39:01.667-->00:39:05.917
figured, okay, we’ll do hardware
military grade crypto, we’ll
XOR, a key from the spy flash

00:39:05.917-->00:39:10.292
with data streaming through. The
problem is, this, this quad
input XOR gate that you can get

00:39:10.292-->00:39:14.292
nearly anywhere for a couple
cents has the same footprint as
an ATtiny84. Um, so we

00:39:14.292-->00:39:19.292
programmed an ATtiny84 to
perform like an XOR gate, um,
except it also logged the last

00:39:21.292-->00:39:26.417
128 bits of the key. So, this
was the altered state demo,
right? We, we have a stateless

00:39:26.417-->00:39:31.417
board that turns out not to be
stateless. >>Okay, so now you
talk [inaudible] >>Uh, you talk,

00:39:31.417-->00:39:36.167
uh, I can, whatever. You talk.
I'm good at talkin’. But I have
to be able to see what you’re

00:39:36.167-->00:39:40.417
doing. So now, we’re, we’re
uploading our key to yubico to
tell it that we’ve changed our,

00:39:40.417-->00:39:46.583
our ma our magic key. And it,
upload usually works perfectly.
But we’re also going to take

00:39:46.583-->00:39:51.583
that same key and we’re gonna
cramp it into an arduino sketch
somewhere. Under, uh, doobie

00:39:58.667-->00:40:03.667
private. And we put in the
public key under doobie public.
Um. Yeah. [inaudible] I th

00:40:17.708-->00:40:22.708
well. No ‘cause the video demo
is gonna take longer. So then we
go we put our public key and

00:40:25.792-->00:40:31.500
our [inaudible] Oh, wow. Video
demo. >>Oh wait, wait , wait,.
>>Wait we got it. Duh do do do

00:40:31.500-->00:40:36.083
duh duh. So we’re plugging these
keys in, we’re gonna compile
this and flash it into a

00:40:36.083-->00:40:41.083
doobiekey, right? And now we
have a yubikey and a doobiekey
that both have the same, uh,

00:40:43.417-->00:40:49.333
master key, MES key and all that
stuff. Um, so we can take the
legitimate doobiekey and

00:40:49.333-->00:40:54.333
authenticate with yubico servers
once. And then, uh, we can take
the doobiekey and perhaps uh, uh

00:40:56.667-->00:41:00.333
authenticate in the future but
we have that monotonic counter
so, you know, we can’t go back

00:41:00.333-->00:41:04.583
and forth and use them both. So
we’ve, we have not truly cloned,
we haven't taken anything off of

00:41:04.583-->00:41:10.625
yubikey we just programmed both
the yubikey and the doobiekey to
have the same key. So it’s sorta

00:41:10.625-->00:41:15.625
cloning but not the same. And
now we’re typing make command
lines. Oh you can see that.

00:41:19.208-->00:41:24.250
>>Yeah you can see >>Okay.
>>Everyone can see the f**k ups
live. >>Live f**k ups. Um, so

00:41:24.250-->00:41:30.542
here we go. We compile and it
maybe works or not. Let’s see.
Doobie, doobie, doobie. >>Doobie

00:41:30.542-->00:41:35.542
do. >>Doobie doobie do. >>Doobie
do. >>And now we’re gonna make
him stall. >>Yeah. Okay so then,

00:41:37.875-->00:41:41.667
and this is, this is the actual,
like, you know, the hardware
token. You can see, like, I'm

00:41:41.667-->00:41:46.917
not actually using a real, a
real yubikey. And it has, like,
a bunch of debug stuff ‘cause,

00:41:46.917-->00:41:53.333
like, nothing works, you know,
just before your demo, right?
Uh, okay so now we, we need a, a

00:41:53.333-->00:41:59.375
web page to, to go to. So that
you can, like, you know. That’s
cool you just type in your

00:41:59.375-->00:42:04.375
password on stage. It’s fine.
Um, so that’s good so we 2 two
tabs here. So, okay so we have,

00:42:10.667-->00:42:15.667
like, basically whoops. We
have a, a mid panel that, that
shows, like, hey here’s the

00:42:21.750-->00:42:25.958
doobiekeys we've seen, right?
‘Cause we programmed in the
public identity and we know the

00:42:25.958-->00:42:31.125
counter. Um, we know the private
identity and the AES key so all
we need to know actually is in

00:42:31.125-->00:42:35.833
our malvertising network was
periodically to make signature
is to for you periodically to

00:42:35.833-->00:42:40.167
check in, give us the monotonic
counter value and which
doobiekey you are with the

00:42:40.167-->00:42:46.292
public identity and then, um,
because we advance farther,
like, in the meantime we can

00:42:46.292-->00:42:51.292
make signatures as you, uh, so
we just need so we just need a,
a web page [laughter] that kind

00:42:55.750-->00:43:00.750
of gets the user's attention for
a moment and let’s see if this
works. So what’s happening is,

00:43:04.208-->00:43:10.083
you know, uh, a yubikey is a, is
actually a, a HID keyboard. Um,
but, you know there are all

00:43:10.083-->00:43:17.042
kinds of HID devices. So this is
actually a, a HID mouse as well
and it uses a, uh, very subtle

00:43:17.042-->00:43:24.000
I, I doubt you, kind of, saw it,
a very subtle encoding mechanism
to encode that identity and in,

00:43:24.000-->00:43:28.417
uh, in the mouse wheels that the
webpage, the javascript then
reads out. And indeed yay it

00:43:28.417-->00:43:33.417
worked! We, we actually got the
counter and the, uh, and the uh,
uh identity. So now, uh oh crap.

00:43:41.083-->00:43:46.083
Now we have to, like eeeh. It’s
fine. Everyone yeah. We’ll just
do, we’ll just do it live.

00:43:50.250-->00:43:54.083
>>Well good thing they didn’t
see the nude yubikey pics.
>>[laughter] Uh, do, do, do, do,

00:43:54.083-->00:43:59.083
do, do, do, do, do, do, do, do,
do, do, do, do, do, do, do, do,
do, do, do, do, do, do, do, do,

00:44:02.583-->00:44:09.417
do, do. >>Just to recap your
life flashing before your eyes.
>>Okay, demo time. Uh, I, okay

00:44:09.417-->00:44:15.875
we don't need that one. Okay.
[laughter] So what happened
here? Um, it was like I said we,

00:44:15.875-->00:44:20.875
we periodically post this
[laughter] we periodically post
the identity through our, uh,

00:44:23.208-->00:44:28.292
the mouse movements with the ID
and the.. Jesus. [laughter]
Watch where you stick that

00:44:28.292-->00:44:33.292
thing. Um, the ID and the
counter. And then, like, the,
the best part about, um, the

00:44:35.542-->00:44:40.125
best part about, um, making, you
know, you know, hardware is that
we can share. So, like, uh, as

00:44:40.125-->00:44:44.625
you can see we have a lot of
these boards. We have, like,
about 150. Uh, these are the

00:44:44.625-->00:44:49.208
boards that I mentioned before
with the f**k up where they
don't plug in over USB but, you

00:44:49.208-->00:44:55.583
know a little blue wire between
the ground pin and, you know, a
capacitor somewhere will, like,

00:44:55.583-->00:45:00.583
make them work. Uh, okay you’ll
flip through that. >>So, yeah, I
already talked about the half

00:45:00.583-->00:45:04.708
baked ideas. We got, like, 2
minutes left so, uh, the secure
boot spliff. We got the altered

00:45:04.708-->00:45:09.792
state where we had like a state
board that had your, your state.
And then the logic board, pure

00:45:09.792-->00:45:14.250
logic. Which is also supposed to
be stateless if you subscribed
to later timelines. Um, but of

00:45:14.250-->00:45:19.750
course this ATtiny on the left
and the 74SN86 on the right, one
of those is stateless, one of

00:45:19.750-->00:45:24.750
them is not. And how do you tell
the difference? Uh, yeah, you
decap the chip and figure it

00:45:24.750-->00:45:30.667
out, right? Um, anyone can make
a TPM but no one could come up
with a good drug reference. So

00:45:30.667-->00:45:34.667
we poked around a couple
hardware security devices. These
are all important and great

00:45:34.667-->00:45:39.458
things and easy to use. Nothing
that we’ve presented should make
you stop using any of these

00:45:39.458-->00:45:42.792
things, okay? I just wanted, I
think I said it at the
beginning, I wanna say it again.

00:45:42.792-->00:45:47.083
Keep using your yubikeys, keep
using, uh, your, your tokens.
They’re good things. But we do

00:45:47.083-->00:45:52.125
have to consider that, um, um
hardware attacks are different
and they improve security,

00:45:52.125-->00:45:56.500
sorry, but hardware threat model
is a little more complicated
than we give it credit for. Just

00:45:56.500-->00:46:01.250
letting go and keeping cont,
constant view of your device is
not necessarily enough. Um, we

00:46:01.250-->00:46:05.708
also, uh, think, we have to
remember that software hacking
is looking at layers of

00:46:05.708-->00:46:09.375
abstraction and finding a way
through, but hardware is just
another layer of abstraction

00:46:09.375-->00:46:14.125
that hides layers upon layers of
more abstraction. So, uh, be
aware of that and don't trust

00:46:14.125-->00:46:19.000
your hardware implicitly, which
seems to be what a lot of people
just do. Uh, yeah. All the way

00:46:19.000-->00:46:23.833
down to electrons and atoms. So,
do you still trust your hardware
implicitly? If so, what are you

00:46:23.833-->00:46:28.833
smoking? Thank you. [applause]