00:00:00.250-->00:00:04.667
>> Thank you guys very much, uh,
we're here to talk about uh, an
attack that happened last

00:00:04.667-->00:00:08.875
October. Uhm, we called it the
'Meet Desai' attack after the,
uh, the guy who wrote the code

00:00:08.875-->00:00:13.083
that caused the incident. Uhm,
but before we get into the
details of that. Just a quick

00:00:13.083-->00:00:18.042
little bit about me. Uhm, I'm
Cincvolflt otherwise known as
Trey Forgety, uhm, a hacker,

00:00:18.042-->00:00:23.917
lawyer, navigator and physicist.
Uhm, I work for an association
called NENA - the 9 1 1

00:00:23.917-->00:00:29.708
association, uh, we improve 9 1
1 by doing all of the things in
that lengthy statement. Uhm,

00:00:29.708-->00:00:35.250
advocacy is my part of it - as a
lawyer I mainly, uh, do stuff in
Washington but, uhm, because of

00:00:35.250-->00:00:38.958
that I get to do some cool
things like interact with all of
you here at Def Con for the past

00:00:38.958-->00:00:43.167
few years. [cough] And so I, I'm
pleased to be presenting about
this attack and what we're doing

00:00:43.167-->00:00:49.042
to try and help defend against
these types of attacks, uh,
going forward. So, this past

00:00:49.042-->00:00:54.125
November, a teenager from
Arizona launched a telephone
denial of service attack - the

00:00:54.125-->00:00:59.917
first distributed denial of
service attack against not one,
uh, centers across the entire

00:00:59.917-->00:01:05.417
country using eight lines of
code and a tweet. [laughter]
Now, before I get into the

00:01:05.417-->00:01:11.208
details of all this, this is Def
Con 101 and so we're supposed to
talk about some more basic type

00:01:11.208-->00:01:17.417
things and one thing that I
personally think has become a
little bit missing, uhm, in the

00:01:17.417-->00:01:24.125
world of, uh, information theory
as we've gone from the telephone
network into all IP networks

00:01:24.125-->00:01:28.292
like the internet is some
mathematical rigor. [audience
noise] Uhm, now, according to

00:01:28.292-->00:01:33.333
Stephen Hawking if you put a
formula in something you cut the
number of people interested by

00:01:33.333-->00:01:38.417
half. So, if the back half of
the room will please stay seated
- I don't want everybody leaving

00:01:38.417-->00:01:42.833
at once when I, when I put this
up. But I want to talk to you
about a, a formula that was

00:01:42.833-->00:01:49.000
invented by this guy. This is
Agner Krarup Erlang, and he came
up with something called the

00:01:49.000-->00:01:54.292
'Erlang V formula'. He was a
Swedish telephone engineer back
in the '20s - brilliant guy. He

00:01:54.292-->00:02:00.750
was the one who first put some
rigor around how many things you
need to service some number of

00:02:00.750-->00:02:04.958
requests. And the cool thing
about it was he did it in the
abstract. This can apply to, uh,

00:02:04.958-->00:02:09.833
telephone lines; telephone
trunks; servers; uh, the number
of threads that you need to do

00:02:09.833-->00:02:15.333
something. But for our purposes,
it, it deals with how much
carrying capacity a network

00:02:15.333-->00:02:21.333
needs to absorb some amount of
traffic that's thrown at it. So,
this is his B formula - this is

00:02:21.333-->00:02:25.917
the Erlang B formula - you don't
need to remember this, uhm, if
you wanna go online and take a

00:02:25.917-->00:02:29.875
look at the Def Con materials
once they're posted - I put a
much longer version of this

00:02:29.875-->00:02:34.167
slide deck up, so you can
actually see a walk through of
this equation and learn what all

00:02:34.167-->00:02:40.458
the parts of it, uh, do. But
basically this tells us the
probability of blocking - that's

00:02:40.458-->00:02:45.167
PB, uhm, the probability that
we'll have a resource
unavailable if we have M

00:02:45.167-->00:02:50.167
resources available and we have
E which is the, uh, normalised
ingress load. So, normalised

00:02:52.292-->00:02:56.625
ingress load is fairly simple -
it just means the average call
time or transaction time if

00:02:56.625-->00:03:02.417
you're doing, like, server type
stuff. Uhm, multiplied by the
average holding time. So, uh,

00:03:02.417-->00:03:07.167
how often you get calls times
how long they are tells you
you're normalised ingress load

00:03:07.167-->00:03:12.292
and then if you do this
summation over here. Uh, you can
come up with, uhm, probability

00:03:12.292-->00:03:16.667
of blocking. Now, in the
abstract you say, okay, that's
fine but so what? Well, if you,

00:03:16.667-->00:03:22.292
you reorganize this and you
actually solve for M - you can
start out with a target. You can

00:03:22.292-->00:03:28.792
say 'I want no more than a one
percent probability of blocking
a call or a transaction or, or

00:03:28.792-->00:03:32.375
whatever it is I'm trying to
do'. And that was very important
to Erlang and it's still very

00:03:32.375-->00:03:37.375
important to us in the 9 1 1
field because telephone lines or
telephone trunks that connect

00:03:37.375-->00:03:43.208
switches with 9 1 1 centers are
very finite resource. We have
very few of those. Uhm, 9 1 1

00:03:43.208-->00:03:47.417
and the telephone network in
particular - the last sort of
thing in the information world

00:03:47.417-->00:03:52.667
where it's physical wires that
matter, uhm, all of this stuff -
you wanna go make a change to a

00:03:52.667-->00:03:56.250
9 1 1 network? The only way to
do that is you gotta get out
this, like, crazy ancient little

00:03:56.250-->00:04:00.792
screw gun and like unscrew some
wires from a terminal block and
move them and screw them in

00:04:00.792-->00:04:06.333
again and file lots of paperwork
to tell everybody what you did.
So, last year, uh, we got a

00:04:06.333-->00:04:11.375
call, uh, from the department of
homeland security asking us to
take a look at a research paper,

00:04:11.375-->00:04:16.542
uh, that was put out by
Ben-Gurion University in, uh,
Israel. And they did a lot of

00:04:16.542-->00:04:21.708
really cool math - a lot of
really great research; they
deeply analysed the 9 1 1 system

00:04:21.708-->00:04:26.583
in the state of North Carolina
based mostly on open source, uh,
information that they were able

00:04:26.583-->00:04:32.125
to develop and so they developed
a model of sort of what a
typical 9 1 1 system might look

00:04:32.125-->00:04:37.875
like. And what they came up with
was this notion that a typical 9
1 1 system probably has about

00:04:37.875-->00:04:43.958
one point seven zero five three
trunks for every ten thousand
population in the area that it

00:04:43.958-->00:04:49.083
serves. Now, I, I wanna point
out this is, all of this stuff
was based on the wire line

00:04:49.083-->00:04:53.000
network. 9 1 1 started back in
the six, in the late '60s and
that is all there was. There

00:04:53.000-->00:04:57.500
were no cell phones back then;
there was no VoIP. So, all of
this stuff was built on this

00:04:57.500-->00:05:01.917
kind of physical infrastructure
basis. Once upon a time that was
probably really ripe - like

00:05:01.917-->00:05:05.375
that, there was, I'm sure there
was some traffic engineering
table somewhere where you can go

00:05:05.375-->00:05:10.625
look that up and just build
that. Uh, the bell system was
great about that. Uhm, they

00:05:10.625-->00:05:15.917
estimated that 75 percent of
those trunks were shared between
wire lined and wireless and 9.5

00:05:15.917-->00:05:20.250
percent were dedicated to
wireless only. For reasons that
wireless was kind of this built

00:05:20.250-->00:05:24.833
on sort of thing that we did
decades after wireline. There
some cases where like the

00:05:24.833-->00:05:30.792
wireless trunks are separate
from the wireline trunks. The
only problem about this is that

00:05:30.792-->00:05:34.125
when we read this in our
organisation we deal with this
everyday. Our members are the

00:05:34.125-->00:05:38.667
people who have to, you know,
build and operate these things.
Uhm, we thought that was a

00:05:38.667-->00:05:45.250
really aggressive estimate. We
actually believe the number is
more like 12 or less trunks per

00:05:45.250-->00:05:49.250
average 9 1 1 center; average
PSAP. You'll see me use that
term - it stands for 'Public

00:05:49.250-->00:05:53.375
Safety Answering Point'. I use
it as a shorthand for 9 1 1
center. I'll try not to be

00:05:53.375-->00:05:57.833
jargony but if I slip into it
just know that PSAP is a 9 1 1
center. THere about seven

00:05:57.833-->00:06:02.000
thousand of these across the
united states and another couple
of hundred across Canada that we

00:06:02.000-->00:06:08.875
represent. Uhm, so about 12 on
average, uhm, bigger places,
bigger populations, uh, you will

00:06:08.875-->00:06:13.625
see more of that. But we decided
to just call around and ask our
members 'Hey, do you, do you

00:06:13.625-->00:06:18.583
have a sense of whether is, is
accurate or not? Like how many
do you actually have?' That's

00:06:18.583-->00:06:23.292
not something that we know on a
national basis. And by way of
example, uhm, I called up some

00:06:23.292-->00:06:29.542
folks in Denver, uhm, and the
Ben-Gurion paper predicts
between 79 and 95 wireless

00:06:29.542-->00:06:34.375
trunks for a city with 663
thousand population and that's
just the city of Denver. If

00:06:34.375-->00:06:37.042
you're one of the people who
lives out there and knows it's
growing very quickly, you go 'Oh

00:06:37.042-->00:06:40.667
my g*d, there's way more than
that'. This is just the city
proper because that's what's

00:06:40.667-->00:06:46.000
served by their PSAP, their 9 1
1 centre. Uhm, the reality when
we called them up is they have

00:06:46.000-->00:06:52.292
32. [laughter] And that's about
a two and a half to three times
smaller number than what was

00:06:52.292-->00:06:55.750
expected, so, you know, that was
kinda one of those moments that
were, you know, we said back to

00:06:55.750-->00:07:00.292
the DHS, you know 'Hey, these
guys did great; they did all the
math correctly. They just

00:07:00.292-->00:07:04.417
fundamentally over estimated the
carrying capacity of these
systems. It's actually much

00:07:04.417-->00:07:09.917
smaller. We have very few
trunks, uh, compared to what you
might expect.' And this was

00:07:09.917-->00:07:15.250
actually a problem that we were
aware of. This was not something
that was new. Back in 2012, uhm,

00:07:15.250-->00:07:18.542
I and a few other people in the
public safety field actually
work with the department of

00:07:18.542-->00:07:24.083
homeland security to stand up a
working group on, uh, telephone
denial of service and cyber

00:07:24.083-->00:07:29.833
security issues in 9 1 1. And
in, through that process, we, we
focused on a few things, We had

00:07:29.833-->00:07:34.708
gotten requests from California
and a few other states who
wanted to know what do if x

00:07:34.708-->00:07:40.083
happens? And the xs that they
were worried about tended to be
things like Android malware -

00:07:40.083-->00:07:44.917
what if somebody infects a whole
lot of these vulnerable Android
devices and they go out and

00:07:44.917-->00:07:51.250
start making 9 1 1 calls. What
do we do? Who do we call? What
if they geo-target it? So, you

00:07:51.250-->00:07:56.500
know, 9 1 1 centres have defined
geographic service areas - you
only get to that 9 1 1 center if

00:07:56.500-->00:08:00.750
you're within the service area
or maybe even a little bit of a
radio margin around it. So, the,

00:08:00.750-->00:08:05.667
the question was, well, okay,
what if they start targeting a 9
1 1 centre as a prelude to a

00:08:05.667-->00:08:08.792
kinetic attack? If you wanna
bomb something and you wanna
make sure you have the most

00:08:08.792-->00:08:14.375
possible casualties one way to
do that is shut down the 9 1 1
service; stop the response. And

00:08:14.375-->00:08:17.708
they also were really worried
about single PSAP incidents
happens. You know, when

00:08:17.708-->00:08:22.125
something happens and one 9 1 1
center is affected - what do
they do? Who Do they call?

00:08:22.125-->00:08:25.542
Remember, these are not folks
who deal with the feds on a
daily basis; they don't have US

00:08:25.542-->00:08:31.042
cert on speed dial. Uhm, the FBI
is somebody that comes in and
takes over - not somebody that,

00:08:31.042-->00:08:36.083
you know, like, you routinely
reach out to call. SO, through
this process we came up with a

00:08:36.083-->00:08:41.000
few things. We helped our
members to understand how to
recognize an attack; uh, how to

00:08:41.000-->00:08:47.167
report an attack; who to call at
the FCC, at homeland, at the FBI
etcetera to, to let folks know.

00:08:47.167-->00:08:52.042
Hey, something's going on; and
also how to recover service -
how to get things back running

00:08:52.042-->00:08:57.042
the way they should be. But we
never thought it would happen
the way that it ultimately did.

00:08:59.500-->00:09:04.667
Again, we were focused on things
like mal, you know, android
malware, geo-fencing and so on.

00:09:04.667-->00:09:10.917
What we really expected was that
the first 9 1 1 distributed TDOS
attack would happen as a result

00:09:10.917-->00:09:16.167
of native malicious code that
was executable on a device or;
and this is the other big one

00:09:16.167-->00:09:20.875
that kind of kept me awake, was
we expected an, an enterprise
callmanager to get popped. Uhm,

00:09:20.875-->00:09:27.417
I did a quick Shoden search and
found 635 unprotected call, uh,
enterprise call managers sitting

00:09:27.417-->00:09:32.042
out on the internet just in
North America. Any one of these
boxes has far more traffic

00:09:32.042-->00:09:36.750
origination capability than even
the biggest 9 1 1 centers in the
country are capable of

00:09:36.750-->00:09:40.125
absorbing. There's just no way
if one, if one of these things
get, gets popped we can defend

00:09:40.125-->00:09:45.708
against it. We also knew that
there's almost a billion , uh,
known vulnerable Android devices

00:09:45.708-->00:09:50.000
that are out there with, you
know, legacy operating systems
that are no longer patched on

00:09:50.000-->00:09:55.083
devices that the manufacturers
are no longer supporting. So,
like, that was the thing that we

00:09:55.083-->00:10:00.958
expected. Nobody expected what
actually happened. We also
expected that attacks would be

00:10:00.958-->00:10:05.958
limited by user location, We
thought at worst and attack
could hit a region. Because, uh,

00:10:08.125-->00:10:12.250
as the Ben-Gurion folks found,
you know, some places they have
regional interconnections of 9 1

00:10:12.250-->00:10:16.917
1 systems; they have one
selective router or a few of
them that serve, you know, large

00:10:16.917-->00:10:21.750
populations. Like I think North
Carolina has either four or
seven. And, and you could get

00:10:21.750-->00:10:25.250
some fail over between those if
they're wired up just perfectly.
So we thought, you know, the

00:10:25.250-->00:10:29.708
worst this could go is a few
PSAPs - this is not gonna be
lots of 9 1 1 centres because

00:10:29.708-->00:10:35.500
it's really difficult to scale.
[cough] And last thing; we never
thought that there could be a

00:10:35.500-->00:10:40.667
distributed attack on
distributed targets. Like that's
not the normal model - you, you

00:10:40.667-->00:10:45.917
normally think of like Mirai
going after Brian Krebs - not
Mirai going after all of the

00:10:45.917-->00:10:50.708
internet. Like that's just, uh,
it's not within your norm. But
when you're dealing with scales

00:10:50.708-->00:10:54.417
that are so much different like
in the telephone network - well,
all of a sudden that becomes

00:10:54.417-->00:11:00.458
true and I'm gonna argue later
on that starts to become true
very quickly for even the rest

00:11:00.458-->00:11:07.042
of the internet at large as the
number of compromisable devices
grows. So, let's talk about a

00:11:07.042-->00:11:11.542
practical attack - you guys came
to hear what actually happened.
[cough] Uhm, what actually hit

00:11:11.542-->00:11:18.542
these 9 1 1 centers. In the end
it was one YouTube comment; an
obfuscated URL and eight lines

00:11:18.542-->00:11:23.542
of really simple code. So, the,
the guy behind the incident, uh,
ultimately, and I wanna be very

00:11:26.083-->00:11:31.083
clear here. [laughter] Uhm, when
I was this guy's age, I did dumb
stuff with scripts that could

00:11:33.083-->00:11:37.208
have landed me in a lot of
trouble too and I, I imagine
that's a shared experience in

00:11:37.208-->00:11:43.917
this room? Uhm, I, I find it
very hard to, to be really harsh
about this because like, people

00:11:43.917-->00:11:48.833
do dumb stuff. In this case, it,
it, worst possible target. 9 1 1
is not the thing you wanna mess

00:11:48.833-->00:11:54.375
around with because people are
gonna freak about it, right?
Uhm, but, in fairness to him,

00:11:54.375-->00:12:00.833
uhm, it was a teenager who did
a, a very very dumb thing. Uhm,
fortunately he didn't have all

00:12:00.833-->00:12:05.583
that many followers. If this had
gone out from Kim Kardashian -
we would have been in a world of

00:12:05.583-->00:12:11.792
hurt. Uhm, ultimately, he wasn't
even the guy who had originally
found, uh, the vulnerability in

00:12:11.792-->00:12:16.958
iOS that lead to this. He was
actually helping somebody out
saying 'Hey, you guys took down

00:12:16.958-->00:12:23.042
this guy's site clicking on his
links. Uh, here, let me put that
back up for you.' And well,

00:12:23.042-->00:12:28.958
unfortunately, then it got out
because the following day, oh,
it's still going strong; people

00:12:28.958-->00:12:34.208
are still clicking; large number
of hits on the, uh, link. And
then the really amazing thing

00:12:34.208-->00:12:41.167
for us about all of this is the
attack really wouldn't have been
that bad if this had just stayed

00:12:41.167-->00:12:46.750
within the hacker community. In
fact, I doubt most 9 1 1 centres
would have noticed if this was

00:12:46.750-->00:12:51.000
just 'Hey, I found this cool iOS
vuln, everybody go check this
out', right? Or 'I'm just gonna

00:12:51.000-->00:12:56.417
go blow up somebody's phone just
for fun'. Unfortunately there's
this thing out there called the

00:12:56.417-->00:13:01.500
music community. And the music
community has like libs on
social media - people who are

00:13:01.500-->00:13:05.708
into music; people who make
music etcetera. They live their
lives on social media and they

00:13:05.708-->00:13:10.958
click links from people they
don't know absolutely all the
time. [laughter] It, the music

00:13:10.958-->00:13:15.917
community is like this enormous,
weaponizable net that you can
exploit... [laughter] It's, it's

00:13:15.917-->00:13:21.667
amazing. So, the social media
personalities just happen to be
in the wrong time zone so that

00:13:21.667-->00:13:25.500
literally everybody in the US is
awake when they're, when they're
doing these things. Everybody's

00:13:25.500-->00:13:29.625
retweeting with nothing more
than a 'LOL' because 'Hey, you
made me have to go reset my

00:13:29.625-->00:13:33.833
phone, big whoop, right'? They
weren't thinking about are the
other possible, you know, other

00:13:33.833-->00:13:39.125
possible consequences. But, you
know, like folks, like this guy
- Sunday Gavin whose headline

00:13:39.125-->00:13:42.958
says 'Hey, he's gonna be famous
one day!' remember that. We're
gonna come back to it.

00:13:45.333-->00:13:48.375
[laughter] And this, then this
guy, this was, this was the
thing that really like made this

00:13:48.375-->00:13:53.708
go pear-shaped. This is Mark
Thomas, he is as far as I can
tell, this guy doesn't actually

00:13:53.708-->00:13:59.667
do anything other than show up
at places and look good.
[laughter] That's, uh, and

00:13:59.667-->00:14:04.042
somehow gets paid for it, I, I
think, I don't understand that
but it's a thing on social

00:14:04.042-->00:14:08.750
media. He has
500-and-32-thousand twitter
followers who love to click

00:14:08.750-->00:14:15.333
things. [laughter] And they did
- because what they saw when
they went to twitter was a, a

00:14:15.333-->00:14:19.042
helpfully shortened URL,
something like this, you know
the average user doesn't

00:14:19.042-->00:14:24.500
understand that that blob of
nothing down below really points
to a really shady URL dot com

00:14:24.500-->00:14:30.667
and is going to get them poned.
And so they don't expect what is
coming next. Because what this

00:14:30.667-->00:14:34.750
linked to was a very simple web
page. Now, and I'm gonna show
you the code here in just a

00:14:34.750-->00:14:39.042
second but, the, the basis of
the vulnerability that these
guys were exploiting is once

00:14:39.042-->00:14:45.417
upon a time on iOS - very
helpfully - if you clicked on a
phone number or a tell URI, in

00:14:45.417-->00:14:50.458
our speak, uhm, you would get an
automatic call generation. I can
click a phone number for one of

00:14:50.458-->00:14:53.917
my friends and it would
automatically call them and that
was helpful and useful and quick

00:14:53.917-->00:14:59.542
and low friction. Good thing,
right? The problem is user
interaction is not the only way

00:14:59.542-->00:15:04.542
to call a tell URI. You can also
write a script that calls a tell
URl and says 'Oh, click that!'.

00:15:06.792-->00:15:11.792
And if you put that in a for
loop you can click that a lot of
times very quickly. [laughter]

00:15:11.792-->00:15:16.500
Uhm, and that's what this guy
did. So, on this page - here's
the actual, uhm, code that

00:15:16.500-->00:15:23.458
caused the incident. [laughter]
It, it, it's not the most
sophisticated thing in the world

00:15:23.458-->00:15:27.375
but there, there is sort of this
internal elegant simplicity to
it. [laughter] Like you know,

00:15:27.375-->00:15:30.708
you do it for the 'lolz', first
of all. I mean, why do we do
anything/. We do it for the

00:15:30.708-->00:15:35.875
'lolz' right? So uh, that's what
the users saw in their browser.
They just saw a string of lolz

00:15:35.875-->00:15:41.542
and then within about a second
the, uh, the script down at the
bottom there. And I'm gonna walk

00:15:41.542-->00:15:45.917
through this in pseudo code for
those of you who, who don't read
script - in just a minute. But

00:15:45.917-->00:15:51.667
basically you've got at the top,
you've got a definition of a
couple of links, one of which

00:15:51.667-->00:15:56.208
for a phone number and one of
which for an email thing. And
this was the other kind of

00:15:56.208-->00:15:59.667
elegant, clever thing about this
is like if you want to crash
somebody's device make it do

00:15:59.667-->00:16:04.292
lots of stuff, uh, and cover up
the fact that it's doing lots of
stuff, right? So, uh, in

00:16:04.292-->00:16:10.250
addition to to continually call
9 1 1 something like ten to the
sixteenth times. I, I,

00:16:10.250-->00:16:15.250
apparently an earlier version of
the code, uh, used it 13 to 37
times but, that, that was deemed

00:16:17.875-->00:16:24.125
to be insufficient. Uhm....
[laughter] So, inside the for
loop, it basically says look,

00:16:24.125-->00:16:29.000
call 9 1 1 and look, put up an
email thing, you know? Put up
this email thing that tells

00:16:29.000-->00:16:34.083
people they have a virus on
their phone which would worry
most people. And, and, you know,

00:16:34.083-->00:16:38.333
the worrisome thing about this
is Safari's a great browser; I
love it, I use it all the time.

00:16:38.333-->00:16:43.708
It does very helpful things that
are also very exploitable. So,
in this particular case if you

00:16:43.708-->00:16:49.417
just power cycled your device -
when you reopened it and came
back into Safari, Safari

00:16:49.417-->00:16:52.667
hopefully said you were just
looking at this page on Meet
Desai dot com, why don't I

00:16:52.667-->00:16:58.292
reopen that for you? [laughter]
So rinse and repeat, right? THe
only way to actually kill this

00:16:58.292-->00:17:03.875
off was to then open, uh, boot
your device, open settings, go
clear the safari cache so that

00:17:03.875-->00:17:09.667
it didn't reopen this code. Uhm,
I, I promised some pseudo code -
here's basically what I just

00:17:09.667-->00:17:12.917
walked you guys through. If, if
you're not super into code this
is a nice kind of little

00:17:12.917-->00:17:17.083
explanation of, of what you can
see in the rocket script of the
previous page. [laughter] So,

00:17:17.083-->00:17:23.417
this was basically, uh, this was
basically the whole thing. This
is how you attack 9 1 1, at

00:17:23.417-->00:17:28.250
least on earlier versions of
iOS. So, let's talk a bit about,
like the prompt effects. WHat

00:17:28.250-->00:17:30.333
happened when this, when this
started? Well, we know from
looking at the google, uhm, uh,

00:17:30.333-->00:17:32.333
link shortener that there were
about a 117 thousand 500 clicks
that we know of. Now I also know

00:17:32.333-->00:17:37.333
that this URL and other like it
got repackaged and reused
roughly in the same timeframe.

00:17:44.417-->00:17:50.500
So, not all of these may have
been, uhm, actually a result of
this one, uh, youtube comment or

00:17:50.500-->00:17:55.500
these tweets. Uhm, and I would
also add, uhm, this, this could
wildly overestimate the number

00:17:58.250-->00:18:03.583
of times anything actually went
wrong. Because this was an iOS
unique vulnerability -this

00:18:03.583-->00:18:08.000
wasn't everywhere, uhm, and so
other devices on different
operating systems and

00:18:08.000-->00:18:12.458
potentially on different
versions may not have reacted in
the same way. So, if it had

00:18:12.458-->00:18:17.625
really been 117 thousand devices
calling 9 1 1 constantly I would
have heard about it in 30

00:18:17.625-->00:18:22.125
minutes instead of like six
hours, right? I, it, my phone
would have rung, rung a lot

00:18:22.125-->00:18:27.125
faster. But it did have effects
in the real world - it caused
overloads at 9 1 1 in 12 states

00:18:29.250-->00:18:34.125
that we know about. And, uhm,
and in some places there was
peak traffic of about six times

00:18:34.125-->00:18:39.000
their average load. Now, that
sounds really big and scary but
before everybody starts to freak

00:18:39.000-->00:18:44.250
out again I want to emphasize -
the average 9 1 1 centre in the
country has maybe three

00:18:44.250-->00:18:49.500
positions and maybe six to 12
trunks - so, like, it's very
small. So, six times three is

00:18:49.500-->00:18:53.542
just like, 'Oh, you got 18 calls
in an hour instead of three.'
Like it, you know, some of them

00:18:53.542-->00:18:58.500
were admittedly bigger than that
but the numbers can be made to
seem a lot larger than they

00:18:58.500-->00:19:03.167
really are when you start using
multipliers like this, Uhm, and
I just kinda wanna be clear

00:19:03.167-->00:19:08.625
that, it, it wasn't that
gigantic in most cases. The
other thing, and this was really

00:19:08.625-->00:19:15.208
fascinating to, to find out,
uhm, you can really exploit
demographic difference in groups

00:19:15.208-->00:19:19.875
to create a lot of confusion
around attacks. The first
report, the first three or four

00:19:19.875-->00:19:25.333
reports that I got from 9 1 1
centres and then ultimately from
folks in the government was, you

00:19:25.333-->00:19:31.667
know, we think is a, a
vulnerability in one carrier's
network that is causing this.

00:19:31.667-->00:19:36.167
Everybody was saying 'Oh, all
the calls are coming from this
particular carrier'. And that

00:19:36.167-->00:19:40.958
seemed really strange. Like why
should iOS on one carrier behave
differently than it does on

00:19:40.958-->00:19:44.917
another? We didn't even know it
was just iOS at that point. Why
should any, uh, you know,

00:19:44.917-->00:19:50.583
software respond differently to
the carrier network? It turns
out it doesn't! There was, the

00:19:50.583-->00:19:55.083
carrier had absolutely nothing
to do with it. It's just that
all of the people - remember I

00:19:55.083-->00:19:59.042
was talking about weaponizing
the mus, the music community?
Everybody in the music community

00:19:59.042-->00:20:03.667
uses one particular wireless
carrier. I don't understand
why... [laughter] But like music

00:20:03.667-->00:20:08.833
fans have this particular bias.
They like this particular
carrier and so even when this

00:20:08.833-->00:20:13.292
happened, everybody thought 'Oh
my g*d, it's this one carrier,
somebody shut them down!'.

00:20:13.292-->00:20:16.292
[cough] You know, not a good a
position to be in if you're that
carrier, right? That's not a

00:20:16.292-->00:20:20.208
good thing. But it was just
this, this weird A-symmetry in
this one particular

00:20:20.208-->00:20:25.500
sub-population that just
happened to confuse the heck out
everybody. So, and the big

00:20:25.500-->00:20:30.750
takeaway from all of this is
that above some threshold
nothing is really safe. Like

00:20:30.750-->00:20:35.042
there is some traffic threshold
when it really just doesn't
matter anymore what you're

00:20:35.042-->00:20:39.500
doing. There's, there's, you're
just not going to be able to
defend against it - I'm sorry,

00:20:39.500-->00:20:45.708
that's, that's it. Uhm, we, we
happen to find that in the
telephone network in the 9 1 1

00:20:45.708-->00:20:50.708
system, in this, uh, in this
instance because we're a softer
target. We have this

00:20:53.292-->00:20:57.917
vulnerability that we knew
about, uh, we know when we've,
when we've got this limited

00:20:57.917-->00:21:02.917
carrying capacity, you know,
maybe 23, uhm, trunks in some
places. Uhm, we, we, knew about

00:21:05.000-->00:21:08.542
that and, and it's even actually
worse than that because behind
those 23 thinks there might only

00:21:08.542-->00:21:12.792
be like three or four people
actually answering calls. So,
funny story, you know, we talked

00:21:12.792-->00:21:17.708
about the Erlang formula, that
doesn't just apply to technical
things like gets and server

00:21:17.708-->00:21:22.042
transactions and trunks - it
also applies to people. You can
use the Erlang formula to model

00:21:22.042-->00:21:27.375
how many people; how many agents
do I have to have to deal with a
particular call load when the,

00:21:27.375-->00:21:32.000
you know, average arrival rate
is, uh, lambda and the average
holding time is H. You can, you

00:21:32.000-->00:21:37.583
can work that out and figure out
okay, how many people do I have
to hire. Uhm, the same holds

00:21:37.583-->00:21:43.333
true for things on the internet.
I, I think, you know, I
mentioned the Mirai attack

00:21:43.333-->00:21:47.750
against Brian Krebs earlier,
uhm, one of the articles that,
that I read in the mop up from

00:21:47.750-->00:21:53.000
that was, when Google was trying
to decide 'Hey, should we take
this guy on and defend him?'.

00:21:53.000-->00:21:57.750
They had to have a very adult
conversation about 'Well, wait a
minute, this thing is so big

00:21:57.750-->00:22:04.250
now, even if we are the 600
pound gorilla on the internet,
we could be vulnerable too.' And

00:22:04.250-->00:22:07.875
that's, and if you think about
the scale of somebody like
Google having to have that very

00:22:07.875-->00:22:13.333
sober conversation, uhm, it
really does demonstrate that,
you know, especially in the IOT

00:22:13.333-->00:22:18.250
era that we live in where, you
know, every little mote of dust
is potentially an IP traffic

00:22:18.250-->00:22:24.042
source, uhm, we really have to
start thinking about defense in,
in very different ways. Because

00:22:24.042-->00:22:28.875
there is a scale at which
there's just nothing else you
can do and, and, and, and it

00:22:28.875-->00:22:33.958
becomes, uh, essentially
indefensible. So, what did we
do? Knowing that we have these

00:22:33.958-->00:22:37.875
vulnerabilities, let's get into
remediation. The, the first
thing obviously was to stop

00:22:37.875-->00:22:41.875
propagation. We had to stop this
thing getting bigger and we had
to do that very quickly. Uh, and

00:22:41.875-->00:22:45.792
we also had to do everything we
could to remove, uh,
de-obfuscate the links if we

00:22:45.792-->00:22:50.083
could. So that people would know
it was potentially shady and
also to just take away that

00:22:50.083-->00:22:54.583
level of abstraction so that it
was, you know, not, uh,
something easy and, and

00:22:54.583-->00:22:59.333
convenient for users to click on
and then ultimately just get the
site offline. Like, I, you know,

00:22:59.333-->00:23:05.417
somehow get that code to a point
where nobody can get to it. So
very quick sort of things -

00:23:05.417-->00:23:09.458
twitter was actually very
helpful working with the
government to, uh, basically

00:23:09.458-->00:23:14.542
pause the source accounts;
filter out the malicious link;
uh, stop this from circulating.

00:23:14.542-->00:23:19.750
Uh, Google equally very helpful
disabling the shortened URL so
that, you know, if, if you go

00:23:19.750-->00:23:24.875
try to click on the shortened
URL now, nothing's gonna happen.
Uhm, and, uh, also take down,

00:23:24.875-->00:23:30.750
take down the website. I, I, and
I don't have this confirmed, I
am 99 percent certain this was

00:23:30.750-->00:23:35.125
a, a hosting site behind
Cloudflare. I know Cloudflare
was in front of it. Uhm, and

00:23:35.125-->00:23:40.417
they were actually very helpful
in ultimately, uh, blackholing
the domain. Uhm, the guy like

00:23:40.417-->00:23:44.375
knew that something wonky was
going on but was like 'No, no, I
took this on to like help

00:23:44.375-->00:23:48.625
everybody out. Don't worry,
it'll come right back!'. Well,
no, that's, that's not coming

00:23:48.625-->00:23:53.625
back. Not ever. [laughter] And,
remember this guy? [laughter] He
is now Def Con famous!

00:23:57.500-->00:24:01.875
[laughter] So, you know, and I,
I, and I love the, just like to
be that candid about, you know,

00:24:01.875-->00:24:05.625
lawyers we have a duty of
perfect candor. Well, if you
tell people, 'Well, I'm about to

00:24:05.625-->00:24:10.875
get arrested', that's, you know,
hey... Uh, this guy, he's got
some serious candor. There's,

00:24:10.875-->00:24:16.542
there's his mug shot. [laughter]
He, he, didn't, didn't have a
good time. And here's out, uh,

00:24:16.542-->00:24:21.917
agust original vulnerability
researcher. And, and again, like
I said, I, I absolutely feel for

00:24:21.917-->00:24:27.292
this guy because I have been the
17-year-old kid doing stuff with
things that sometimes goes

00:24:27.292-->00:24:32.417
pear-shaped. Uhm, and I know a
lot of the folks in this room
have too. I, I don't think this

00:24:32.417-->00:24:37.833
should be like a life-ending or
a life-altering sort of thing.
Like, and I say that as somebody

00:24:37.833-->00:24:43.500
coming from the 9 1 1 community
where I know exactly what's at
stake with every call. My

00:24:43.500-->00:24:47.208
members have to deal with
people, you know, getting
murdered in real-time while they

00:24:47.208-->00:24:54.042
listen. And eventually while
they watch. And it, it's very
meaningful to us so a lot of

00:24:54.042-->00:24:59.833
folks will be very reaction,
reactive, reaction, reactionary,
sorry. Uhm, and will just say,

00:24:59.833-->00:25:03.833
you know, burn him at the stake
or something like that and it's
like, yea, you know. This, this

00:25:03.833-->00:25:08.542
is something that got way out of
hand thanks to a bunch of
celebrities, like, let's not

00:25:08.542-->00:25:13.542
completely destroy this guy
because of that. Uhm, uh, CV,
interestingly enough this

00:25:17.125-->00:25:22.625
vulnerability - although it does
have a 2017 CV, that we'll talk
about in a second was not

00:25:22.625-->00:25:29.000
completely new. Uhm, this guy
Colin RM on twitter, uhm, I
threw a lot of very deep

00:25:29.000-->00:25:34.250
Googling - I managed to discover
he had actually notified Apple,
uhm, about this very issue back

00:25:34.250-->00:25:39.167
in 2008 or at least issues that
could effect similar results.
And those were eventually

00:25:39.167-->00:25:44.708
patched. Uhm, they did
eventually patch, uh iOS as well
against the particular flaw that

00:25:44.708-->00:25:49.000
was exploited in, in this
incident. Uhm, it, but that
patch actually didn't come out

00:25:49.000-->00:25:55.917
for another five months. That
was May 30th if memory serves
that was iOS ten-three-two. Uhm,

00:25:55.917-->00:26:00.417
so five months later it is
actually patched and you can see
it, these were the write-ups if

00:26:00.417-->00:26:05.417
you wanna go look at CVE 2017,
24 84; and CVE 2017, 24 04. Uhm,
and these were the ones that

00:26:11.167-->00:26:16.208
ultimately were exploited to
cause, uh, both 9 1 1 denial of
service attack and basically the

00:26:16.208-->00:26:22.417
shutdowns on, uh, users' devices
or, or basically rendering the
devices unusable. So, one of the

00:26:22.417-->00:26:25.250
things that I put in the
abstract, because we thought
that this was very important was

00:26:25.250-->00:26:29.875
to track, uhm, the extent to
which these vulnerabilities are,
you know, potentially hanging

00:26:29.875-->00:26:35.583
around. And, uh, part of the way
that we did that, uhm, we, we
went out there and looked at,

00:26:35.583-->00:26:41.500
uh, Telligent data to see okay,
what's the rollover rate? How
quickly are people patching? And

00:26:41.500-->00:26:46.500
I, uh, just refreshed this today
and 76 percent of active, uh,
iOS versions that are being seen

00:26:48.750-->00:26:53.500
on the web now are ten-three.
And I don't know how many of
those are, doesn't get broken

00:26:53.500-->00:26:59.708
down by subpoint. Uhm, but we're
fairly confident that this
problem is going away quickly,

00:26:59.708-->00:27:04.083
uhm, but the trouble - and I
think this goes to show, you
know, a lot of folks, uh, kind

00:27:04.083-->00:27:08.583
of poopoo the notion that like,
well, you know iOS is always,
like, so much better. Well,

00:27:08.583-->00:27:13.833
there's a, you know, 11 percent
that are still on ten-two.
That's a lot of devices across

00:27:13.833-->00:27:18.375
the world! It may, it may not be
the billion that you have, like,
with Android but nothing - none

00:27:18.375-->00:27:22.417
of these types of
vulnerabilities are unique to
any particular, you know,

00:27:22.417-->00:27:26.292
smartphone ecosystem. Uhm,
they're just a consequence of
having little computers in our

00:27:26.292-->00:27:30.833
hands that can run code. And
that nonetheless connect to a
telephone network that doesn't

00:27:30.833-->00:27:35.833
know what code is. So, we know
we're vulnerable, the next
obvious question is - okay Trey,

00:27:38.625-->00:27:42.208
well, what do we do about it?
Like you can't just bring us
your problems - you gotta

00:27:42.208-->00:27:45.125
propose some solutions
otherwise, you know, you're
really not doing anything for

00:27:45.125-->00:27:50.500
us. So, a few things to talk
through, uhm, and I, and I wanna
take a step back for a second

00:27:50.500-->00:27:55.625
because the 9 1 1 world right
now is very fragmented. We have
three feet in three different

00:27:55.625-->00:28:01.125
time frames. There's 'Legacy',
'Transitional' and 'Next
Generation'. Legacy is the part

00:28:01.125-->00:28:06.333
the is like strictly analog
telephone network, uh, I, this
ought to be good for a chuckle -

00:28:06.333-->00:28:12.125
most of the nation's 9 1 1
systems still run on CAMA and MF
signalling. [audience noise]

00:28:12.125-->00:28:16.708
That's not a joke. We still use
all the stuff that Captain
Crunch and crew were messing

00:28:16.708-->00:28:21.833
around with with blue boxes and
gold boxes and stuff back in the
day - that's still how most 9 1

00:28:21.833-->00:28:28.250
1 calls are signaled and set up
in the telephone network today.
Uhm, CAMA is handle, you know,

00:28:28.250-->00:28:34.042
handles a lot of the data, uh,
when we get your location in 9 1
1 - that comes from something

00:28:34.042-->00:28:40.875
called 'Automatic Location
Identification'. And it has an
upper bound of 512 non-extended

00:28:40.875-->00:28:47.583
ASCII character set characters.
That's it, that's the entire
data block; that plus maybe 20

00:28:47.583-->00:28:52.958
digits that we use for some
routing and call back purposes -
not caller ID but, uh, uh,

00:28:52.958-->00:28:57.708
automatic number identification.
That, that's really it - that's
the legacy world. And that's all

00:28:57.708-->00:29:02.000
that analog stuff. In the
middle, in the transitional case
we've got networks that have

00:29:02.000-->00:29:08.292
started to move to IP. So, maybe
you have IP trunking, you're no
longer using, uh, those, uh,

00:29:08.292-->00:29:14.458
analog or TDM trunks, uh, to
connect the local end office
class five switch with the 9 1 1

00:29:14.458-->00:29:20.458
center. Uhm, but you're doing
some VoIP stuff, maybe you have
a sort of Quasi cloud-hosted

00:29:20.458-->00:29:26.167
service provider somewhere in
like Colorado or California or
Washington. And you connect up

00:29:26.167-->00:29:31.042
to them over multiple links and,
and that's how you're doing it.
Maybe even in some cases you're

00:29:31.042-->00:29:36.083
doing some cool stuff, uh, with,
uh location technology - you're
adding some data in; bolting

00:29:36.083-->00:29:40.417
some stuff on. So that, uh, you
know, you're doing some things
out of band so that you can get

00:29:40.417-->00:29:44.250
more data in a 9 1 1 call -
that's the transitional case.
Where we're headed is next

00:29:44.250-->00:29:49.292
generation 9 1 1. Uhm, that's
something that's defined by a
thing called the i3 standard

00:29:49.292-->00:29:55.708
that my organisation publishes.
It's basically a model for all
IP 9 1 1 service where we get

00:29:55.708-->00:30:00.000
deep, good location data, uh,
that can be reference to
something that's like

00:30:00.000-->00:30:04.750
human-readable, like you know,
the Octavius ballroom at Caesars
palace, for example. Uhm, it

00:30:04.750-->00:30:09.042
does things like much more
intelligent routing and so on.
And, and, basically that's sort

00:30:09.042-->00:30:14.750
of the all IP case. There's a
very little bit of that in
existence today - maybe four or

00:30:14.750-->00:30:19.250
five percent of the country but
it's still just doing voice.
It's not doing video and text

00:30:19.250-->00:30:24.333
and data the way we really want
it to be in the next, you, three
or four years. So, I'm gonna

00:30:24.333-->00:30:28.083
talk you through defence in all
three of those cases like the
options that we have available

00:30:28.083-->00:30:33.000
to us and the problems that we
have with those options. So, in
the legacy world the, the first

00:30:33.000-->00:30:37.667
defence is you can just over
provision. You can go do the
Erlang formula again; you can

00:30:37.667-->00:30:41.375
come up with a probability of
blocking that's a tenth of one
percent, you know? You spend a

00:30:41.375-->00:30:45.625
ton of money - up your
bandwidth, up your number of
trunks, and it's great, that

00:30:45.625-->00:30:49.375
works but it's expensive -
number one - you've got to buy
and build all that stuff. And

00:30:49.375-->00:30:53.167
number two, it may be
impossible. You just can't get
enough people to handle the

00:30:53.167-->00:30:58.167
ingress load at some point,
there's there's no way to do it.
Uh, you can do contextual

00:30:58.167-->00:31:02.667
white-listing, banks do this.
So, most of the time when you
call your bank, uhm, they're

00:31:02.667-->00:31:08.042
looking to see with automatic
number identification that's the
theoretically not spoofable part

00:31:08.042-->00:31:14.958
of, uh, not caller ID, that uhm,
that they use to say 'Okay, who
is this actually calling? And,

00:31:14.958-->00:31:19.375
and for the most part it's
well-trusted because there are
so many rules around it for 9 1

00:31:19.375-->00:31:23.042
1. The trouble is for us, unlike
a bank we don't have a customer
list. I mean, it's one thing to

00:31:23.042-->00:31:27.250
say, you know, in the wireline
world, you can say 'Okay, here's
the list of all the numbers that

00:31:27.250-->00:31:31.917
we know exist for telephones in
our jurisdiction '. Because
somebody went out there and

00:31:31.917-->00:31:36.667
nailed one to the wall, right?
Like, you know where those lines
go; that's, that would work.

00:31:36.667-->00:31:42.375
Trouble is now they move around,
they're on these things and that
doesn't work anymore. So, uh, we

00:31:42.375-->00:31:46.083
don't have a customer list that
we can use so we can't do
contextual white-listing. And we

00:31:46.083-->00:31:50.167
could do blacklisting, this is
the other thing - like, okay,
you send us a hundred calls and

00:31:50.167-->00:31:53.458
they all turn out to be false.
[laughter] Sorry, hat it for
you, you're over and done, we're

00:31:53.458-->00:31:58.542
just gonna block your call now.
Which, okay fine, you did
something nefarious but do you

00:31:58.542-->00:32:02.708
really deserve to potentially
die from that? Uhm, you know,
when you call 9 1 1 and you're

00:32:02.708-->00:32:06.042
actually having a heart attack,
you know, uh, and our members
feel very strongly about that. I

00:32:06.042-->00:32:10.750
feel very strongly about that,
you know, we, uhm, I talked last
year at Def Con, uh, about high

00:32:10.750-->00:32:14.417
availability systems - when you
have to carry traffic; you
really don't have an option

00:32:14.417-->00:32:18.750
because it's 9 1 1. That
complicates matters greatly -
when you can't just say 'Sorry,

00:32:18.750-->00:32:22.583
I don't like your traffic, uhm,
I'm not gonna handle it'. You,
your life gets a lot more

00:32:22.583-->00:32:27.833
complicated. In the transitional
case, some things that are being
researched heavily right now -

00:32:27.833-->00:32:31.875
homeland's doing a lot of work
on this. We're working with some
of the, uh, technical folks to

00:32:31.875-->00:32:36.542
connect them with our members
and what not. Uhm, you can do
number reputation scoring. Uhm,

00:32:36.542-->00:32:41.792
if you've got apps like, uh, you
know, uh. I've got Hiya on my
phone and it, and it like blocks

00:32:41.792-->00:32:47.417
bad calls for me. Uhm, it's
doing that in part on the basis
of number reputation scoring and

00:32:47.417-->00:32:51.417
that's a great thing. We know
that this particular number is
getting misused often - great,

00:32:51.417-->00:32:56.417
let's block or at least flag
that call. Uhm, that's dangerous
because lawyers... [laughter]

00:32:56.417-->00:33:00.708
And it's also a, a thing that,
you know, may be dangerous
because of human life. So,

00:33:00.708-->00:33:03.833
we've, we've got, we've got to
be careful about that. I think
we'll see some of this done

00:33:03.833-->00:33:08.792
soon, with at least flagging,
We'll, we'll start seeing like a
little asterisk somewhere in

00:33:08.792-->00:33:12.875
that 512 character data block,
that says 'This is a little
squidgy, may be think twice

00:33:12.875-->00:33:16.250
about it before you go, you
know, uhm... [cough] Send the
S.W.A.T. team to Brian Krebs

00:33:16.250-->00:33:23.000
house again. Uhm, we can also do
real-time threat scoring, so
things like should this call be

00:33:23.000-->00:33:27.875
coming from this location? In
other words if somebody was
recently making calls from a

00:33:27.875-->00:33:33.083
cell-sector in Boca Raton, and
now I'm getting a 9 1 1 call
from them, that's hitting a cell

00:33:33.083-->00:33:38.708
sector in Kansas city and there
hasn't been enough time for them
to get between one and the other

00:33:38.708-->00:33:42.708
- like, we need to think about,
okay, is that really problem?
Like that could be a real

00:33:42.708-->00:33:47.958
threat-score. Uhm, the trouble
is for both of these, we haven't
tested diverting calls. One way

00:33:47.958-->00:33:52.583
to handle that I to, like, send
some, send the call someplace
else like an IVR or proof of

00:33:52.583-->00:33:56.208
humanness test - where you gotta
like, you know, dial one two
three to get access to 9 1 1 or,

00:33:56.208-->00:34:00.958
or whatever. Uhm, those
capabilities exist in some
transitional systems but

00:34:00.958-->00:34:05.583
nobody's kind of been brave
enough to turn them on yet. Uhm,
so we've gotta get; we've gotta

00:34:05.583-->00:34:09.792
go through a process of getting
comfortable with is this going
to work in a way that doesn't

00:34:09.792-->00:34:14.667
endanger human life. That we
can, you know, justify turning
it on, uhm, all the time and not

00:34:14.667-->00:34:19.583
just when we know we have an
incident or an attack. [cough]
And then in the next generation

00:34:19.583-->00:34:24.875
9 1 1 world now, and I, I love
to talk about this because in,
in the legacy world, uhm, yes,

00:34:24.875-->00:34:28.625
we have lots of vulnerabilities
that are... But, but they're
like impossible to defend

00:34:28.625-->00:34:34.167
against. In the next gen world -
yes, we have lots of
vulnerabilities, maybe even more

00:34:34.167-->00:34:37.958
but now we can do things to
actually defend against them.
And so, the first thing on the

00:34:37.958-->00:34:43.000
list here is the 'stir and
shaken' framework. If anybody's
a bond fan - yes, this is a bond

00:34:43.000-->00:34:48.958
reference, uhm, stir is an IETF
track standard for
cryptographically signing

00:34:48.958-->00:34:53.958
ownership of number blocks. So,
if I have, you know, 8 6 6, 5 5
5 5, 1 2, 1 2, uhm, the, the

00:34:55.958-->00:35:00.958
North American numbering plan
administrator should issue a, a,
a signed thing that says that

00:35:03.208-->00:35:09.125
belongs to Verizon or AT&T or
Sprint or somebody. They should
sign it saying this particular

00:35:09.125-->00:35:12.583
number belongs to, uh, uh,
Cincvolflt and oh, by the way
the chain is all, you know, it

00:35:12.583-->00:35:15.542
all rolls up to some Root CA and
so we can trust that this is a
legitimately originated call

00:35:15.542-->00:35:20.542
with that number. It's not being
spoofed. Shaken is the same
thing just done in the carrier

00:35:24.208-->00:35:29.333
standards body called ATIS. Uhm,
trouble with that as, uh, I
can't remember if it's Bruce

00:35:29.333-->00:35:34.500
Shaun or Phil Zimmerman said, a
couple of Def Cons ago "PKI is
really, really hard and if the

00:35:34.500-->00:35:38.958
PKI goes wrong, I want to talk
to 9 1 1.' [audience noise] And
that is the sanitized version of

00:35:38.958-->00:35:43.167
that line for everybody's, you
know, if anybody, for anybody
who knows him. Uhm, we can also

00:35:43.167-->00:35:47.833
do bad actor marking - we can
start to say 'Look, we know
you're a bad guy because we've

00:35:47.833-->00:35:52.625
seen your traffic and it's not
good, we're gonna stop that'.
Uh, that takes time to tune -

00:35:52.625-->00:35:57.417
could go wrong. Uhm, we could do
suspicious call diversion, uhm,
we have the ability in the motor

00:35:57.417-->00:36:02.250
control function of next
generation 9 1 1 systems to mark
traffic as suspicious and then

00:36:02.250-->00:36:08.000
say add a subsequent emergency
services routing proxy. If we
see that a 9 1 1 center is in

00:36:08.000-->00:36:13.792
load, we can say okay -
prioritize the non-suspicious
traffic first. Or if it gets in

00:36:13.792-->00:36:18.625
really high load - maybe divert
that to an IBR first; proof of
humanness etcetera. We, or, you

00:36:18.625-->00:36:23.333
know, fail it over to an
investigatory center that's not
handling live 9 1 1 calls but is

00:36:23.333-->00:36:27.208
just dealing with, like, the
suspicious stuff. That's
intelligence that we don't have

00:36:27.208-->00:36:33.625
and can't have in the telephone
network but that we can have in
the next gen 9 1 1. Also, a big

00:36:33.625-->00:36:37.500
work in progress there's a DHS
pilot on threat scores...
[cough] Uhm, using those

00:36:37.500-->00:36:41.458
frameworks that I just talked
about. Uhm, and we're also
working, uh, the i3 standard

00:36:41.458-->00:36:46.167
that I mentioned before and then
the other big standard we
publish, uh, for this is, uhm,

00:36:46.167-->00:36:50.500
called NG Sec- that's the next
generation security standard.
And it tells you, uh, adn, and

00:36:50.500-->00:36:54.542
it's actually applicable in
today's e- 9 1 1 environment too
but it sort of tells you what to

00:36:54.542-->00:37:00.875
do to, uhm, baseline properly
configure and secure a big,
complex, hairy, nextgen 9 1 1

00:37:00.875-->00:37:05.417
system. Uhm, and, and on that
note I want to encourage
everybody because those

00:37:05.417-->00:37:09.208
standards are still under active
development if you know
things... [cough] About these

00:37:09.208-->00:37:13.917
subjects and you want to help we
would love to have you join in
at 'dev dot NENA dot org'.

00:37:13.917-->00:37:17.458
[cough] It's an amazing way to
contribute... [cough] To the
safety and security of not just

00:37:17.458-->00:37:21.750
the community here in the United
States but the i3 framework in
particular. [cough] Uh, the i3

00:37:21.750-->00:37:27.292
standard is actually, uh, being
used in Canada and uh, all of
Europe as well as as the basis

00:37:27.292-->00:37:30.583
for their emergency systems
going forward. So, this is going
to be a global kinda thing and

00:37:30.583-->00:37:34.375
we, we need the global
information security community
focused on it to make sure that

00:37:34.375-->00:37:40.167
as we add things like voice,
video, text, data, etcetera.
Uhm, that we have the capability

00:37:40.167-->00:37:45.458
to, uhm, do that securely.
[cough] So, so we, we'd love to
have you! Uhm, before I close

00:37:45.458-->00:37:49.833
here, a couple of things I, I
will take some questions if we
can do that, uhm, but I, I wanna

00:37:49.833-->00:37:53.792
say a special thanks to
QueerCon, uhm, we have the
coolest badges at all of Def

00:37:53.792-->00:37:57.750
Con! And we do that every year
because of some amazing people.
Uh, these guys are my family,

00:37:57.750-->00:38:03.250
uhm, I love you all, it's the
reason I'm up here. Thank you so
much! Uhm, also I Am The Cavalry

00:38:03.250-->00:38:06.958
for those of you who knows
something about tech and policy
- I absolutely encourage you to

00:38:06.958-->00:38:11.167
get involved with I Am The
Cavalry. We're doing amazing
things in DC. Uh, translating

00:38:11.167-->00:38:15.375
and being ambassadors for those
in the policy community who
don't know a lot about what all

00:38:15.375-->00:38:19.875
of you do from day to day. Uhm,
and we need help, we need more
help. There, we're putting

00:38:19.875-->00:38:24.667
computers in every part of our
lives today and that has huge
policy implications for the

00:38:24.667-->00:38:29.750
safety of human life and, and
literally every part of our
economy. So, please, please, uh,

00:38:29.750-->00:38:34.708
you know, come join us. [cough]
Uhm, also, check out my other
talk in the, uh, Crypt Privacy

00:38:34.708-->00:38:38.708
village, hashtag shameless plug.
[laughter] Uhm, I will be, I'll
be talking there about, uh,

00:38:38.708-->00:38:43.458
location tracking, uh, so
basically in 9 1 1 we don't
wanna track you but sometimes

00:38:43.458-->00:38:47.792
other people do and they always
blame us when that happens. But
I, I wanna assure everybody how

00:38:47.792-->00:38:53.792
that works so please come and
see that in the CPV. And, at
this point, are there questions?

00:38:53.792-->00:38:58.792
Am I allowed to take questions?
>> Yea you're allowed to take
questions...[inaudible] seven

00:39:13.125-->00:39:18.125
minute >> Okay...Anyone? Anyone?
Beuller? [applause] [cheering]
Thank you!