1
00:00:00,000 --> 00:00:05,740
Hello everybody. I'm here to talk to you today about 3D printer security. I think it's an

2
00:00:05,740 --> 00:00:09,060
interesting topic. I used to work with 3D printers for a long time and was fascinated

3
00:00:09,060 --> 00:00:16,120
by the way they work. It's been a very big pop culture kind of topic and it still seems

4
00:00:16,120 --> 00:00:24,580
like the general functionality of 3D printers has not, most people who even use them don't

5
00:00:24,580 --> 00:00:28,860
fully understand how they work and the implications of that. So I think it's a really fun thing

6
00:00:28,860 --> 00:00:36,740
to talk to people about who haven't delved into the mechanics of what makes them work.

7
00:00:38,800 --> 00:00:43,380
Any of you here own 3D printers? Have you ever 3D printed? Yeah? Yeah? Cool. Cool. What

8
00:00:43,380 --> 00:00:49,620
kind of 3D printer do you have? I have a LulzBot. LulzBot, yeah. Cool. You like assembled that

9
00:00:49,620 --> 00:00:53,160
yourself, right? Or did you buy it pre-assembled? No, it was pre-assembled. Oh, that's awesome.

10
00:00:53,320 --> 00:00:58,840
Yeah, those are really solid printers. What about you? I built a RimRamp. I built a RimRamp.

11
00:00:58,840 --> 00:01:04,740
Oh, yeah? And then I purchased an Ultimate 2. Okay, like a Prusa Mendel, something like

12
00:01:04,740 --> 00:01:14,880
that? Prusa, yeah, Prusa. Oh, that's awesome. That was about four or five years ago. Totally.

13
00:01:15,100 --> 00:01:22,580
Yeah, and the Ultimate 2 is two years ago still in my garage. Nice. Nice. Anyone else

14
00:01:22,580 --> 00:01:26,960
have a 3D printer? Pretty familiar with the concept? All right, we'll go.

15
00:01:28,840 --> 00:01:36,340
So what is 3D printing security? It's kind of like this, right? This is like, if you've ever done a 3D

16
00:01:36,340 --> 00:01:40,800
print, this is what happens when things go very badly. We used to call this like printer spaghetti,

17
00:01:41,460 --> 00:01:46,660
right? Hence the name of the talk. We'll get into some of the reasons why this happens, but once

18
00:01:46,660 --> 00:01:51,240
you understand why you get 3D printer spaghetti, you can start to think about like some of the

19
00:01:51,240 --> 00:01:58,340
horrible, horrible ways things can go wrong with 3D printers. Actually, if you put in a 3D printer

20
00:01:58,840 --> 00:02:03,440
into Google, you'll get hundreds and hundreds and hundreds of these. For a long time, the industry

21
00:02:03,440 --> 00:02:08,480
around 3D printers struggled with how to get people to use these things and not run into

22
00:02:08,480 --> 00:02:14,060
troubles. And there are reasons why the printers just aren't as reliable as you'd like them to be

23
00:02:14,060 --> 00:02:21,460
or wish them to be. I think a conservative estimate that was put together for how many prints

24
00:02:21,460 --> 00:02:27,600
failed, something like 40% of all attempted prints fail. And when I tell that to people who've owned

25
00:02:28,840 --> 00:02:33,700
3D printers, they're like, yeah, that seems about right. That has implications, right? It's a

26
00:02:33,700 --> 00:02:39,540
reliability thing, and it gets down to the core of like what's up with 3D printers. All right, so

27
00:02:39,540 --> 00:02:48,840
this is me. I'm John Dunlap. I work for Gotham Digital Sciences, pen tester. I do exploit dev,

28
00:02:49,000 --> 00:02:54,460
reverse engineering, embedded stuff, code review. I really like to get into the nooks and

29
00:02:54,460 --> 00:02:58,820
crannies of technologies people haven't thought about with security. So I'm going to talk a little

30
00:02:58,840 --> 00:03:03,620
bit about security. Like, you know, like what is COBOL security? What is Haskell security? I

31
00:03:03,620 --> 00:03:09,280
think that's really cool. And I'm surprised that this is like such an under-researched topic. I

32
00:03:09,280 --> 00:03:13,240
also used to work in 3D printing. I'm not going to call out my old employer for reasons that will

33
00:03:13,240 --> 00:03:22,100
be obvious in a moment. But I did. My other love in life besides exploits and security are praying

34
00:03:22,100 --> 00:03:28,820
mantises. This is my praying mantis, Duke. They're really hard to photograph. They're really hard to

35
00:03:28,840 --> 00:03:35,840
photograph. But he essentially looks like that. All right? So my life is finding bugs and raising

36
00:03:35,840 --> 00:03:40,920
bugs if you want to think about it like that. If you want to see some really cringey picture of me,

37
00:03:40,940 --> 00:03:46,540
though, I was a meme in this community at one point. If you know what, like, forum this is

38
00:03:46,540 --> 00:03:54,600
from and what printer this was from, like, I'm sorry. But yeah, I was a dude in 3D printing at one

39
00:03:54,600 --> 00:03:58,820
point. So in this talk, we're going to like look at the general structure of 3D printing. I'm going to

40
00:03:58,840 --> 00:04:04,360
general threat model for 3D printers? Like, at what stages in the process can things go horribly

41
00:04:04,360 --> 00:04:10,720
wrong, right? What are the common security failures in the, like, sort of standard model for 3D

42
00:04:10,720 --> 00:04:15,740
printing, right? Because all 3D printers are sort of descended from the same basic idea, or what we

43
00:04:15,740 --> 00:04:22,560
call 3D printers today. So how does that model work? Does it work at all for security? And where

44
00:04:22,560 --> 00:04:28,300
can we find some places to inject bad code or bad operations? What we're not going to look into

45
00:04:28,300 --> 00:04:35,380
deeply are the sort of more expensive, more industrial kinds of 3D printers, or even the

46
00:04:35,380 --> 00:04:39,760
higher end of the consumer market we're not going to really touch. Just, like, the basic model of

47
00:04:39,760 --> 00:04:47,420
3D printers. So what we won't do in this stock, again, commercial printers, unfortunately I

48
00:04:47,420 --> 00:04:51,680
couldn't get a hold of a printer for a laser for the research involved in this. That would have

49
00:04:51,680 --> 00:04:56,900
been cool. I would have liked to burn some stuff up with lasers. If anyone around wants to, like,

50
00:04:56,900 --> 00:04:58,160
give me a free laser printer,

51
00:04:58,300 --> 00:05:02,060
that would be pretty freaking cool. That's a lot to ask, but, you know, I should, like, say it out

52
00:05:02,060 --> 00:05:06,080
loud so when this gets published on YouTube or whatever, someone's going to tweet me, like, yeah, I

53
00:05:06,080 --> 00:05:11,080
got a laser printer for you. That would be freaking great. But they work on more or less the

54
00:05:11,080 --> 00:05:16,460
same principles, approach from a different way. And we're not going to talk about printer Wi-Fi

55
00:05:16,460 --> 00:05:20,800
connections, because that's a whole different, like, bag of worms, separate issue entirely. We're

56
00:05:20,800 --> 00:05:25,220
just going to talk about the core mechanics of 3D printing and how that applies to security. All

57
00:05:25,220 --> 00:05:28,280
right. I mean, what's the worst that could happen to a 3D printer? I mean, I don't know. I don't know.

58
00:05:28,300 --> 00:05:32,320
It could happen, right? I think that's the first question people ask me when we're talking about 3D

59
00:05:32,320 --> 00:05:38,700
printers. I think one of the reasons that the threat model for these things hasn't been fully

60
00:05:38,700 --> 00:05:44,940
explored is that people say to themselves, like, it's a printer. What could go wrong? Right? What

61
00:05:44,940 --> 00:05:49,100
bad things could happen? I mean, were they going to, like, make prints I don't like? Are they going

62
00:05:49,100 --> 00:05:52,980
to waste my filament or, like, make something embarrassing pop out of my printer? Well, it

63
00:05:52,980 --> 00:05:58,200
actually could be much worse, right? So if your 3D printer gets owned, you could definitely get

64
00:05:58,300 --> 00:06:06,560
this, right? Maybe a little bit of this, right? And a real possibility of this. And by that, I

65
00:06:06,560 --> 00:06:10,600
mean your 3D printer exploding into horrible flames and burning your house down. This is a real

66
00:06:10,600 --> 00:06:14,680
thing. I don't feel uncomfortable saying that this is an issue with 3D printers because if you

67
00:06:14,680 --> 00:06:20,140
type the words 3D printer fire into Google, what you will get is, like, 20 pages of results and

68
00:06:20,140 --> 00:06:25,640
people being nervous and, you know, magazine articles and apologies from manufacturers and

69
00:06:25,640 --> 00:06:27,520
horror stories and pictures.

70
00:06:28,300 --> 00:06:41,120
Pictures like this or this or this or this suffice it to say this is not a new problem and it's a

71
00:06:41,120 --> 00:06:48,340
problem we should worry about. But what, in all these cases, okay, none of these were caused by

72
00:06:48,340 --> 00:06:57,220
hackers. These are all down to, more or less every case, they can be described as user error. The

73
00:06:57,220 --> 00:07:00,220
The most common reason this happens to the printers is that people modify them.

74
00:07:00,480 --> 00:07:07,720
As they want to do, you know, it's very common if you own a RepRap or some other kind of consumer-grade 3D printer

75
00:07:07,720 --> 00:07:10,940
to modify the printer and try to trick it out and make it work better, right?

76
00:07:11,060 --> 00:07:17,020
Since the printers are so buggy in the first place, it's very common for people to replace nozzles,

77
00:07:17,040 --> 00:07:20,500
replace heaters, replace temperature gauges, that kind of thing.

78
00:07:20,820 --> 00:07:26,520
And in the end, it creates a situation where if you don't rewire your printer correctly, bad things can happen.

79
00:07:27,220 --> 00:07:30,220
And that is the source of most of those pictures.

80
00:07:30,540 --> 00:07:34,760
In every case I sort of investigated, it traced back to things like that.

81
00:07:35,320 --> 00:07:40,100
But what we're going to sort of reveal in a second is that if you don't secure the 3D printer properly,

82
00:07:40,220 --> 00:07:45,360
if you don't keep hackers from executing code on your 3D printer, that could very much happen, right?

83
00:07:45,500 --> 00:07:51,460
And you're relying on a very thin set of security protections to keep that from happening.

84
00:07:53,000 --> 00:07:54,220
Let's talk about how that works.

85
00:07:55,420 --> 00:07:56,060
Right, yeah.

86
00:07:58,300 --> 00:07:59,360
I've got to give you a disclaimer.

87
00:07:59,560 --> 00:08:03,420
Anything I suggest here, I'm going to speak very vaguely about 3D printer exploits,

88
00:08:03,440 --> 00:08:07,860
because although I have found problems in 3D printer firmware,

89
00:08:08,140 --> 00:08:13,800
I don't want to publish how to exploit those problems until I'm absolutely sure that it's responsibly disclosed,

90
00:08:13,880 --> 00:08:17,240
because you could do horrible damage with the kind of exploits I'm about to talk about.

91
00:08:17,520 --> 00:08:20,360
So this is the obligatory, don't try this at home.

92
00:08:20,580 --> 00:08:23,220
Whatever I suggest here, however vague it is, do not try it.

93
00:08:23,940 --> 00:08:25,820
I warned you, like ever.

94
00:08:26,300 --> 00:08:27,200
I am freaking out.

95
00:08:27,220 --> 00:08:27,340
I'm freaking serious.

96
00:08:27,900 --> 00:08:28,340
Don't.

97
00:08:28,920 --> 00:08:30,060
You heard it from me first.

98
00:08:30,100 --> 00:08:30,820
Don't do these things.

99
00:08:31,240 --> 00:08:31,760
All right.

100
00:08:33,220 --> 00:08:37,660
Let's start with a brief history of 3D printers for people who have not experienced them,

101
00:08:37,760 --> 00:08:39,720
which seems like the majority of us.

102
00:08:41,040 --> 00:08:44,140
So 3D printers are really CNC machines.

103
00:08:44,800 --> 00:08:50,500
They're based off computer numerical control protocols, which date back to the 50s.

104
00:08:50,500 --> 00:08:51,500
Who here is familiar with CNC?

105
00:08:52,340 --> 00:08:53,000
You have CNC?

106
00:08:53,340 --> 00:08:54,560
All right, 3D printer guy, no CNC.

107
00:08:54,780 --> 00:08:55,320
You a little bit?

108
00:08:55,640 --> 00:08:57,080
Yeah, like you ever use a CNC?

109
00:08:57,220 --> 00:08:58,240
Router or anything like that?

110
00:08:58,760 --> 00:08:59,420
Have you?

111
00:09:00,140 --> 00:09:00,600
Oh, yeah.

112
00:09:00,740 --> 00:09:01,000
Yeah.

113
00:09:01,140 --> 00:09:02,840
I prefer a CNC control company.

114
00:09:02,980 --> 00:09:03,480
Oh, wow.

115
00:09:03,540 --> 00:09:04,380
That's awesome, dude.

116
00:09:06,260 --> 00:09:10,300
So 3D printers are essentially CNC machines in almost every way.

117
00:09:10,780 --> 00:09:18,480
And that means that the ideas and protocols that run them date back to that older mindset about machines,

118
00:09:18,820 --> 00:09:23,300
which is not really security oriented.

119
00:09:23,940 --> 00:09:25,880
It comes from a more trusted place.

120
00:09:25,960 --> 00:09:26,960
Because the home of these...

121
00:09:27,220 --> 00:09:29,340
Machines is sort of in the workshop.

122
00:09:31,040 --> 00:09:34,320
So at first, 3D printers, I mean, 3D printers seem like a new thing.

123
00:09:34,460 --> 00:09:36,040
They date back to the 1980s, at least.

124
00:09:36,980 --> 00:09:40,060
And they started off as basically industrial tools.

125
00:09:40,240 --> 00:09:45,960
You know, the original sort of buzzword for 3D printers was like rapid prototyping, right?

126
00:09:46,020 --> 00:09:49,920
You can make a prototype for your product very quickly, and that's what they're intended for.

127
00:09:50,020 --> 00:09:54,480
They weren't sold as a general purpose, make whatever you want, replicator type thing.

128
00:09:54,620 --> 00:09:56,180
It was more of like, you're a big company.

129
00:09:56,260 --> 00:09:57,200
And you need to make something that works.

130
00:09:57,200 --> 00:09:59,440
You need to make this widget in plastic quickly.

131
00:09:59,880 --> 00:10:03,840
It's not a shape or a size that works well with the CNC routing method.

132
00:10:04,580 --> 00:10:05,500
We'll do it this way.

133
00:10:07,000 --> 00:10:13,560
Later on, some very brave souls decided to make consumer versions of these machines.

134
00:10:13,700 --> 00:10:15,760
These were born out of hacker spaces, truly.

135
00:10:16,880 --> 00:10:18,960
This is one of the early versions of the MakerBot.

136
00:10:19,140 --> 00:10:20,760
And it's funny, like, this is from Wikipedia.

137
00:10:21,260 --> 00:10:24,340
Brie Pettis himself, if you know who he is, he's like the founder of MakerBot.

138
00:10:24,400 --> 00:10:26,580
And he uploaded his own photograph.

139
00:10:27,200 --> 00:10:29,320
To Wikipedia, which cracks me up every time I see it.

140
00:10:29,720 --> 00:10:32,300
It's like, how much of that article did you edit?

141
00:10:32,540 --> 00:10:38,640
But the idea was to make something affordable that people could use, right?

142
00:10:38,720 --> 00:10:41,220
People were hacking together technology they already understood.

143
00:10:41,540 --> 00:10:45,480
People were well familiar with CNC machines, how stepper motors worked.

144
00:10:45,700 --> 00:10:49,200
The, like, kind of robot control theory that would make them run.

145
00:10:49,420 --> 00:10:52,800
They knew how all those pieces fit together and decided to make something that would be cheaper

146
00:10:52,800 --> 00:10:56,300
they could share with their friends so that when you're making your hacker projects in your hacker space,

147
00:10:56,500 --> 00:10:57,180
you could do it.

148
00:10:57,180 --> 00:10:58,840
You could get that widget that you couldn't have before.

149
00:10:59,100 --> 00:11:04,120
Because there are always small bits and baubles of things that you just couldn't get, right?

150
00:11:04,680 --> 00:11:07,300
And that was the genesis of these things.

151
00:11:07,700 --> 00:11:12,960
And they weren't ever really designed in the first place to be this robust consumer product.

152
00:11:13,080 --> 00:11:18,120
It was more like some hack people found to get it together cheaply enough to sell, right?

153
00:11:18,220 --> 00:11:27,020
Which is noble, but causes some issues later on if you don't ever move and evolve away from that model.

154
00:11:27,020 --> 00:11:32,080
You know, when people are putting this together, they're just trying to get something started.

155
00:11:32,740 --> 00:11:36,260
And making them absolutely bulletproof machines wasn't a concern.

156
00:11:36,960 --> 00:11:42,420
So when the media caught wind of 3D printers, there was, like, buzz.

157
00:11:42,680 --> 00:11:50,260
And if anyone was watching this community in, like, 2012 to 2014 type area, you remember how much 3D printers were everywhere.

158
00:11:50,440 --> 00:11:56,980
3D printers, to this day, there's an article, like, every day it feels like about how 3D printers are going to change the world.

159
00:11:56,980 --> 00:11:57,000
3D printers are going to change the world.

160
00:11:57,020 --> 00:11:59,780
Or revolutionize some new industry.

161
00:12:00,420 --> 00:12:01,160
Which is fine.

162
00:12:01,360 --> 00:12:03,380
It was great to be part of that.

163
00:12:05,220 --> 00:12:07,320
But the buzz caused problems.

164
00:12:08,240 --> 00:12:10,880
Because people thought 3D printers were basically this.

165
00:12:11,000 --> 00:12:13,060
They thought they were, like, the replicator from Star Trek.

166
00:12:13,240 --> 00:12:16,440
You know, you put in a design and it makes it for you, there's no problems.

167
00:12:17,820 --> 00:12:18,860
That's not true, though.

168
00:12:19,160 --> 00:12:19,560
Right?

169
00:12:19,620 --> 00:12:23,560
3D printers were made for a very specific use case for specific shapes and models.

170
00:12:24,060 --> 00:12:27,000
And because of that, general progress.

171
00:12:27,780 --> 00:12:31,880
There's some models they can't make or make well or make inexpensively.

172
00:12:32,180 --> 00:12:37,120
It wasn't just as simple as asking to have something made and have it come out correctly every time.

173
00:12:37,760 --> 00:12:39,180
That's just not the reality of it.

174
00:12:39,700 --> 00:12:41,880
So people thought 3D printers were this.

175
00:12:42,400 --> 00:12:43,880
But they're really closer to this.

176
00:12:43,920 --> 00:12:45,300
This is like a Rube Goldberg machine.

177
00:12:45,800 --> 00:12:47,500
You know, this is sort of what 3D printers are.

178
00:12:47,780 --> 00:12:52,480
You know, it's all these, like, kind of mechanical bits and pieces just, like, strung together with duct tape.

179
00:12:52,600 --> 00:12:53,500
And it's beautiful.

180
00:12:53,720 --> 00:12:54,360
And I love it.

181
00:12:54,740 --> 00:12:56,120
But it's not the replicator.

182
00:12:56,120 --> 00:12:59,340
It's not going to make exactly what you want every time without having to think about it.

183
00:12:59,360 --> 00:13:06,840
The people who are most successful with using 3D printers are the people who understand them well enough to take them apart, alter them, modify them, improve them.

184
00:13:07,180 --> 00:13:08,460
That's how you get the most of it.

185
00:13:08,700 --> 00:13:15,360
But it was sold to people and is sort of still sold today as a general purpose consumer thing that anyone could use without further training.

186
00:13:15,900 --> 00:13:19,620
Unfortunately, the reality is not quite up to date with that.

187
00:13:20,220 --> 00:13:21,300
Maybe it will be someday.

188
00:13:22,500 --> 00:13:26,100
During this time period, there was also what could be classified as the most expensive 3D printer.

189
00:13:26,100 --> 00:13:28,840
This is the most annoying commercial catchphrase around 3D printers ever.

190
00:13:29,320 --> 00:13:35,600
And if you watch interviews with 3D printer CEOs, you kept hearing this over and over again.

191
00:13:35,700 --> 00:13:36,040
Like, tea.

192
00:13:36,500 --> 00:13:37,220
Earl Grey.

193
00:13:37,360 --> 00:13:37,580
Hot.

194
00:13:37,800 --> 00:13:40,320
You know, they embraced the replicator idea.

195
00:13:41,900 --> 00:13:44,400
But this is where 3D printers are supposed to live.

196
00:13:44,540 --> 00:13:44,980
Right?

197
00:13:45,020 --> 00:13:45,660
In a lab.

198
00:13:45,960 --> 00:13:48,960
And this is where marketing departments tell us they should go.

199
00:13:49,040 --> 00:13:49,380
Everywhere.

200
00:13:49,620 --> 00:13:51,440
Which they are everywhere at this point.

201
00:13:52,020 --> 00:13:54,020
And this is where they often live today.

202
00:13:54,020 --> 00:13:55,300
In a school.

203
00:13:55,420 --> 00:13:56,220
In a library.

204
00:13:57,280 --> 00:14:02,980
But keep in mind, 3D printers like this are essentially CNC machines like this.

205
00:14:03,280 --> 00:14:05,980
That were originally invented for guys like this.

206
00:14:06,080 --> 00:14:07,020
Like an engineer.

207
00:14:07,500 --> 00:14:09,080
But they're marketed to everyone.

208
00:14:09,380 --> 00:14:09,820
Right?

209
00:14:10,220 --> 00:14:14,220
With none of the robustness of that industrial technology built in.

210
00:14:14,320 --> 00:14:19,240
So, let's move on and finally start talking about 3D printers in very specific terms.

211
00:14:19,700 --> 00:14:24,000
And, um, in sort of broad terms.

212
00:14:24,000 --> 00:14:27,600
We're going to break down what we're really like talking about and trying to uncover security-wise.

213
00:14:27,720 --> 00:14:27,860
Okay?

214
00:14:30,260 --> 00:14:31,280
So, 3D printers.

215
00:14:31,520 --> 00:14:32,280
How do they work?

216
00:14:33,720 --> 00:14:34,120
Right?

217
00:14:34,320 --> 00:14:35,220
They work like this.

218
00:14:36,380 --> 00:14:38,520
Um, we got some kind of design software.

219
00:14:38,980 --> 00:14:40,120
We got a slicer.

220
00:14:40,180 --> 00:14:41,040
We got a host program.

221
00:14:41,340 --> 00:14:41,940
We got firmware.

222
00:14:42,120 --> 00:14:42,680
And we got hardware.

223
00:14:43,000 --> 00:14:48,040
And we're going to go through each of these like sort of subsections and figure out what is the security model for this.

224
00:14:48,120 --> 00:14:49,020
Where might there be holes.

225
00:14:49,180 --> 00:14:52,300
What are the bad things that can happen if this part of the software gets owned.

226
00:14:52,600 --> 00:14:53,000
Right?

227
00:14:53,000 --> 00:14:58,440
And we have to be conscientious at every stage that someone doesn't get unauthorized access to the printer.

228
00:14:58,900 --> 00:15:00,900
And tell it to do something that is unsafe.

229
00:15:02,200 --> 00:15:02,640
Alright.

230
00:15:04,480 --> 00:15:08,100
Let's take like a 10,000 foot overview of what the technology is.

231
00:15:08,780 --> 00:15:10,140
So, here's a 3D printer.

232
00:15:10,700 --> 00:15:12,200
Or here's a typical rep wrap.

233
00:15:13,320 --> 00:15:17,580
And, uh, here's a figure of what a 3D printer does.

234
00:15:17,780 --> 00:15:19,160
It's essentially a robotic head.

235
00:15:19,800 --> 00:15:21,500
Uh, that sits above a platform.

236
00:15:21,500 --> 00:15:24,900
That can move up and down over the platform.

237
00:15:25,220 --> 00:15:28,040
Uh, in some models the platform moves and the head doesn't.

238
00:15:28,420 --> 00:15:36,760
Um, but the idea is that it is depositing layers of this melted plastic filament onto the, uh, platform.

239
00:15:37,040 --> 00:15:37,560
Right?

240
00:15:37,620 --> 00:15:42,400
It's almost like a glue gun on a robotic head that is spraying this plastic stuff down.

241
00:15:42,660 --> 00:15:43,180
Right?

242
00:15:43,620 --> 00:15:49,680
Um, this particular technology is known as, um, filament, uh, deposition, disposition printer.

243
00:15:49,680 --> 00:15:55,860
And, uh, uh, this is the main type of printer that's, that's, uh, marketed as a 3D printer.

244
00:15:56,000 --> 00:15:58,660
There are, uh, several alternative technologies to this.

245
00:15:58,780 --> 00:15:58,900
Right?

246
00:15:58,960 --> 00:16:01,020
There's ones with lasers that solidify things.

247
00:16:01,160 --> 00:16:04,200
There's even things with, uh, something akin to a digital projector.

248
00:16:04,400 --> 00:16:09,280
Which shines, uh, images into a sort of like, uh, solidifiable goop.

249
00:16:09,780 --> 00:16:10,180
Right?

250
00:16:10,320 --> 00:16:12,400
Uh, there's a bunch of variations on how these would work.

251
00:16:12,480 --> 00:16:17,160
But this is the one you'll see if you go on Amazon and ask for a 3D printer, this is what you'll get.

252
00:16:17,720 --> 00:16:18,120
Um.

253
00:16:18,620 --> 00:16:25,340
There are some issues with how this entire model is put together, uh, from a reliability standpoint, which may affect its security.

254
00:16:26,080 --> 00:16:26,440
Um.

255
00:16:27,540 --> 00:16:31,100
One, uh, piece of terminology that you'll see a lot with 3D printers is the hot end.

256
00:16:31,240 --> 00:16:39,660
If you hear me talking about the hot end or anyone else, uh, anything else, that is the, the entire, uh, assembly of the printer that is putting the filament out.

257
00:16:39,760 --> 00:16:41,500
And it's called the hot end because it gets really hot.

258
00:16:41,620 --> 00:16:41,920
Right?

259
00:16:41,960 --> 00:16:46,460
Um, a lot of times people, uh, have this thing set up to be heated to about 200 Celsius.

260
00:16:47,300 --> 00:16:47,660
Um.

261
00:16:48,120 --> 00:16:53,200
This is where the, uh, the, the gear that, that feeds the filament, uh, into the printer.

262
00:16:53,580 --> 00:17:05,200
Is, uh, this where there's usually a cooling fan, uh, heat sink, the nozzle itself, uh, and the, uh, temperature, uh, gauging equipment like a thermocouple or, uh, a thermistor will be there as well.

263
00:17:05,800 --> 00:17:06,160
Um.

264
00:17:06,540 --> 00:17:09,400
So that's an important piece of the printer to, uh, watch out for.

265
00:17:09,540 --> 00:17:10,860
Uh, we also have this heating log.

266
00:17:10,980 --> 00:17:12,560
This is just a close-up of what it looks like.

267
00:17:12,900 --> 00:17:16,280
Uh, the red wires there are, uh, the heating element, uh, going.

268
00:17:16,420 --> 00:17:18,100
They're sort of inset into this.

269
00:17:18,100 --> 00:17:19,380
Uh, it looks like aluminum block.

270
00:17:19,500 --> 00:17:23,720
They, like, milled out a hole in this little aluminum block and shoved a heating element into it.

271
00:17:23,960 --> 00:17:26,360
That's also where the, uh, thermistor would go.

272
00:17:26,420 --> 00:17:33,540
There's, there's a lot of different variations on this design in competing projects to make this, uh, better, more reliable.

273
00:17:34,560 --> 00:17:36,380
But that's basically what we're talking about.

274
00:17:36,660 --> 00:17:38,340
Uh, stepper motor.

275
00:17:38,940 --> 00:17:41,720
Uh, I'm, I'm sure everyone here understands what a stepper motor is.

276
00:17:41,800 --> 00:17:42,200
Right?

277
00:17:42,520 --> 00:17:42,960
Yeah.

278
00:17:43,100 --> 00:17:43,380
Okay.

279
00:17:43,460 --> 00:17:43,740
Cool.

280
00:17:44,740 --> 00:17:47,060
Uh, so let's, let's talk about that heating element.

281
00:17:47,060 --> 00:17:51,240
That's basically the same thing as, uh, what, what runs a soldering iron.

282
00:17:51,300 --> 00:17:56,300
If you were to take apart a soldering iron and pull the, like, heater element out of it, that's basically what you get.

283
00:17:56,680 --> 00:18:02,400
And these things, um, with sufficient, uh, electricity will get as hot as you like.

284
00:18:02,760 --> 00:18:03,860
Like, really, really hot.

285
00:18:03,940 --> 00:18:08,620
They will, uh, the printer will fail long, long before, uh, the heating cartridge does.

286
00:18:09,120 --> 00:18:12,960
Uh, they're not purpose-built for 3D printing in, uh, any kind of way.

287
00:18:13,000 --> 00:18:14,120
They're sort of an off-the-shelf part.

288
00:18:14,820 --> 00:18:16,460
Um, there's also a thermistor.

289
00:18:17,060 --> 00:18:19,520
There's a printer couple, which is usually somehow attached to this head.

290
00:18:19,760 --> 00:18:25,100
And it's very important that the, um, the temperature reading equipment never be separated from the head.

291
00:18:25,180 --> 00:18:31,220
And that's kind of a, like, a, a really tweaky point of, of safety and security is that, uh, in the early days of 3D printing,

292
00:18:31,320 --> 00:18:36,200
people were less conscientious of this issue and would do stuff like just tape it to the head.

293
00:18:36,300 --> 00:18:40,140
Like, that's a pretty common technique is just to tape this thermistor or whatever to the head.

294
00:18:40,260 --> 00:18:44,940
And if it ever leaves the head of the printer, you're in some, for some bad times.

295
00:18:45,120 --> 00:18:45,500
Right?

296
00:18:45,500 --> 00:18:47,020
And we'll talk about that.

297
00:18:48,680 --> 00:18:52,880
Um, these days, um, it seems like most people have gotten smarter about the issue

298
00:18:52,880 --> 00:18:57,980
and have actually sunk the, uh, thermistor into the sort of, uh, hot end.

299
00:18:58,060 --> 00:19:00,900
They've, they've milled out a hole for it and placed it in there.

300
00:19:00,960 --> 00:19:05,000
And usually they'll keep it stuck in there with some kind of thermal paste or something like that.

301
00:19:05,080 --> 00:19:10,300
It doesn't totally obviate the problem, uh, if it's not securely stuck in there.

302
00:19:10,340 --> 00:19:11,540
There's a bunch of things that can go wrong.

303
00:19:12,680 --> 00:19:13,280
All right.

304
00:19:14,100 --> 00:19:15,100
Uh, this is, uh,

305
00:19:16,600 --> 00:19:20,620
polydamide, or, uh, often, uh, market is capped on.

306
00:19:20,700 --> 00:19:26,560
If you see this, like, kind of yellow, uh, space-age-looking tape or film on the printer,

307
00:19:26,660 --> 00:19:31,260
that's, uh, basically it's a thermally resistant, uh, material.

308
00:19:31,380 --> 00:19:33,240
They actually put this on satellites.

309
00:19:33,980 --> 00:19:36,660
And, uh, often you'll see on, on some 3D printers,

310
00:19:36,780 --> 00:19:39,480
uh, stuff will be just taped to the printer with the polydamide.

311
00:19:39,900 --> 00:19:45,440
And the, uh, the idea is that it'll keep it there without the tape melting off when the printer gets hot.

312
00:19:45,500 --> 00:19:49,220
But you have parts that might be just held on with essentially tape.

313
00:19:49,680 --> 00:19:52,420
Uh, you can think of how that might go wrong.

314
00:19:53,920 --> 00:19:55,540
Uh, here's what goes in a 3D printer.

315
00:19:55,780 --> 00:19:56,800
It's, uh, ABS plastic.

316
00:19:57,440 --> 00:20:00,660
Uh, or this is one of two flavors of things that usually go in 3D printers.

317
00:20:01,940 --> 00:20:03,560
Um, obviously it is plastic.

318
00:20:03,900 --> 00:20:05,280
It is, uh, flammable.

319
00:20:06,060 --> 00:20:07,400
Here's some information about that.

320
00:20:07,460 --> 00:20:09,500
We're just kind of, kind of scoot along past that.

321
00:20:10,260 --> 00:20:13,000
Uh, the other alternative is, uh, PLA plastic,

322
00:20:13,160 --> 00:20:14,140
which is a bioplastic.

323
00:20:14,140 --> 00:20:17,740
It's a little more, uh, eco-friendly, I would say.

324
00:20:19,120 --> 00:20:23,000
Um, it, it's, people claim that it's, it's a little more fire resistant.

325
00:20:23,740 --> 00:20:27,800
I'm not sure if you, if you look at the, uh, sort of suggested information,

326
00:20:27,900 --> 00:20:30,800
like what the flame point of it is, it's, like, not that much better.

327
00:20:31,540 --> 00:20:33,700
Um, but this is what we put into the 3D printer.

328
00:20:34,840 --> 00:20:40,120
Uh, there's sometimes other stuff, uh, wood, metal, nylon, polycarbonate.

329
00:20:40,200 --> 00:20:43,440
Uh, and yeah, sometimes, like, bones, ajar.

330
00:20:44,500 --> 00:20:45,680
Random scientific stuff.

331
00:20:45,780 --> 00:20:47,140
People are trying to run through these things.

332
00:20:47,280 --> 00:20:50,340
Uh, solder is one thing I've seen a lot of people try to get to run through.

333
00:20:50,440 --> 00:20:51,680
Like, it seems like a natural idea.

334
00:20:51,800 --> 00:20:53,500
It doesn't actually work super well.

335
00:20:54,200 --> 00:20:58,180
Uh, mainly, uh, problem with a lot of these materials is actually that, uh,

336
00:20:58,300 --> 00:21:00,620
3D printers are extremely prone to clogging.

337
00:21:00,940 --> 00:21:04,860
And if the, uh, material going into the front of the 3D printer isn't, like, in pristine condition

338
00:21:04,860 --> 00:21:09,600
and very, uh, clean, uh, then you can have some major problems with the printer itself.

339
00:21:10,480 --> 00:21:10,980
All right.

340
00:21:10,980 --> 00:21:15,840
So, just in case you thought the 3D printing community was unaware of the, uh,

341
00:21:16,000 --> 00:21:18,000
the, like, fire danger type thing,

342
00:21:18,140 --> 00:21:23,220
uh, here's a, uh, forum post from someone going on, uh, about, uh, you know,

343
00:21:23,940 --> 00:21:28,440
he, he's actually at home testing in his lab which stuff is most flammable.

344
00:21:28,620 --> 00:21:29,020
Right?

345
00:21:29,100 --> 00:21:34,640
And, like, how it, like, lives up to, uh, the suggestions from manufacturers.

346
00:21:34,820 --> 00:21:38,480
Because you can buy ABS and PLA and it'll say on the front, uh, flame resistant.

347
00:21:38,960 --> 00:21:39,360
Right?

348
00:21:39,360 --> 00:21:43,120
And so this guy took home some ABS and PLA and nylon and a couple other things

349
00:21:43,120 --> 00:21:46,780
and just tried to burn them and see what, um, what it'd be like.

350
00:21:46,900 --> 00:21:50,500
Uh, and then he gets this great idea that he wants to make a candle out of it.

351
00:21:50,540 --> 00:21:52,840
Like, he's gonna make an, uh, like, a PLA candle.

352
00:21:53,540 --> 00:21:53,900
Right?

353
00:21:54,560 --> 00:21:57,000
And the reply from everyone is, like, yeah, that's a great idea.

354
00:21:57,100 --> 00:21:58,200
Like, make a candle out of it.

355
00:21:58,440 --> 00:21:58,800
Right?

356
00:22:00,600 --> 00:22:01,320
Um, whoa.

357
00:22:02,000 --> 00:22:02,620
That's crazy.

358
00:22:02,940 --> 00:22:08,260
Um, there was even, uh, apparently this was a popular idea because, uh, MakerBot actually put out a PSA

359
00:22:08,260 --> 00:22:09,340
that was, like, don't make PSAs.

360
00:22:09,340 --> 00:22:10,880
Don't make candles out of 3D printed materials.

361
00:22:11,120 --> 00:22:13,300
That's a, that's a very scary, unsafe idea.

362
00:22:13,400 --> 00:22:14,060
Do not do that.

363
00:22:14,260 --> 00:22:18,240
Uh, because there's hundreds of candle designs popping up on Thingiverse.

364
00:22:18,380 --> 00:22:22,380
Thingiverse is, by the way, is a, uh, website where you, it's sort of like a file sharing website

365
00:22:22,380 --> 00:22:25,040
where you can upload, uh, your 3D printable stuff.

366
00:22:25,360 --> 00:22:25,760
Right?

367
00:22:25,880 --> 00:22:30,600
And people can download it, you know, and, uh, hypothetically it should just work in your printer.

368
00:22:30,980 --> 00:22:33,680
Um, they had to put out this PSA, like, that's a bad idea.

369
00:22:33,860 --> 00:22:36,280
Don't put flames next to our flammable plastic stuff, please.

370
00:22:37,760 --> 00:22:39,320
Um, so, like, let's look at this.

371
00:22:39,340 --> 00:22:41,140
Let's look at that pipeline I just uncovered in depth.

372
00:22:41,320 --> 00:22:44,820
Now, we're going to skip design software because that's not really part of 3D printing.

373
00:22:45,000 --> 00:22:46,000
It's not unique to that.

374
00:22:46,160 --> 00:22:50,260
It, it has some, some kind of play in here, but it's not 100% involved.

375
00:22:50,540 --> 00:22:52,700
So, the first thing we're going to talk about is slicers.

376
00:22:53,700 --> 00:22:54,200
All right?

377
00:22:54,400 --> 00:22:56,640
Not this kind of slicer, but a 3D printer slicer.

378
00:22:56,840 --> 00:23:00,740
Um, what a slicer is, is very akin to, like, a compiler.

379
00:23:00,980 --> 00:23:08,460
And what it does is it takes a 3D model and essentially analyzes it and turns it into routing information for the printer.

380
00:23:08,600 --> 00:23:09,320
And what I mean by that?

381
00:23:09,340 --> 00:23:12,660
What I mean by routing information is it says, move the head X inches this way.

382
00:23:12,760 --> 00:23:13,160
Right?

383
00:23:13,220 --> 00:23:14,240
X inches this way.

384
00:23:14,380 --> 00:23:15,420
Spray this much filament.

385
00:23:15,620 --> 00:23:16,540
Move the head this way.

386
00:23:16,960 --> 00:23:17,360
Right?

387
00:23:17,400 --> 00:23:23,420
So, it turns, uh, you know, like, uh, vertexes and, and volumetric 3D data into these routes.

388
00:23:24,620 --> 00:23:26,940
Um, it's kind of like a competitive space.

389
00:23:27,020 --> 00:23:29,040
There's a lot of people making slicers right now.

390
00:23:29,700 --> 00:23:38,160
Uh, the important thing to keep in mind, uh, with slicers is that you could do some real mischief to someone's 3D printer if you took control of their slicer.

391
00:23:38,160 --> 00:23:39,260
If the slicer isn't safe.

392
00:23:39,400 --> 00:23:41,060
And slicers do have to be safe.

393
00:23:41,100 --> 00:23:48,200
They have to have a, a security model involved with them because they're expected to process random files from the internet.

394
00:23:48,540 --> 00:23:50,500
From, you know, untrusted sources.

395
00:23:51,080 --> 00:23:55,500
So, it's important that, uh, 3D printer companies take security of slicers very seriously.

396
00:23:55,580 --> 00:24:01,800
Because if you own someone's slicer, I mean, not only could you own their computer, but you could also send them all kinds of corrupt key code and that kind of thing.

397
00:24:02,120 --> 00:24:04,240
It's something worth sort of worrying about.

398
00:24:04,980 --> 00:24:08,040
So, the, uh, we got kind of, um, two file formats.

399
00:24:08,040 --> 00:24:09,360
To worry about for slicers.

400
00:24:09,540 --> 00:24:10,640
Uh, we have SDL files.

401
00:24:10,880 --> 00:24:14,340
Which, uh, are sort of, um, stereolithography files.

402
00:24:14,620 --> 00:24:16,560
It was invented by 3D systems in the 80s.

403
00:24:16,640 --> 00:24:21,520
But the idea is it's sort of a 3D model with all the stuff that the printer wouldn't care about stripped out.

404
00:24:21,640 --> 00:24:26,060
Because, uh, 3D models might have, uh, metadata, information about color, that kind of thing.

405
00:24:26,320 --> 00:24:28,040
Uh, that, or textures.

406
00:24:28,320 --> 00:24:29,200
That sort of stuff.

407
00:24:29,440 --> 00:24:31,820
That aren't really relevant to the 3D printing process.

408
00:24:32,280 --> 00:24:38,020
And so, uh, the idea is to take one of these SDL files and convert it into the 3D printer.

409
00:24:38,020 --> 00:24:40,200
The next file format, uh, which is G-code.

410
00:24:40,340 --> 00:24:44,320
And G-code is, uh, actually considered by some to be like a full programming language.

411
00:24:44,500 --> 00:24:45,780
It existed from the 50s.

412
00:24:45,820 --> 00:24:48,220
But it's basically a quick way to specify the movement of the printer.

413
00:24:48,420 --> 00:24:53,080
So, any, uh, kind of, uh, CNC router you've ever used is probably run on G-code.

414
00:24:53,140 --> 00:24:55,840
And almost every 3D printer that I've ever seen has run on G-code.

415
00:24:56,140 --> 00:25:00,680
So, the basic idea here is we're going to convert this SDL file format into G-code.

416
00:25:01,960 --> 00:25:02,760
Um, safely.

417
00:25:04,220 --> 00:25:08,000
Um, uh, every slicer has to have a 3D printer.

418
00:25:08,020 --> 00:25:09,640
A set of device definition files.

419
00:25:09,760 --> 00:25:12,220
Or ways to specify what kind of printer you're talking about.

420
00:25:12,320 --> 00:25:13,980
Because each printer has different capabilities.

421
00:25:14,440 --> 00:25:14,880
Hardware.

422
00:25:14,900 --> 00:25:16,580
The size of the, uh, print bed is different.

423
00:25:16,680 --> 00:25:18,080
The optimal temperatures are different.

424
00:25:18,460 --> 00:25:22,460
And the, uh, slicer has to take all that into account to make it work.

425
00:25:23,000 --> 00:25:26,840
So, um, obviously these are big, gnarly, complex programs.

426
00:25:27,260 --> 00:25:29,100
Um, that very few people understand.

427
00:25:31,940 --> 00:25:37,660
Uh, so SDL files are basically straight up just lists of vertexes.

428
00:25:37,660 --> 00:25:37,800
Like.

429
00:25:38,020 --> 00:25:39,540
Uh, lists of triangles, essentially.

430
00:25:40,580 --> 00:25:42,340
Um, it's an old file format.

431
00:25:42,520 --> 00:25:46,100
Uh, and there isn't really a spec for it.

432
00:25:46,160 --> 00:25:48,980
Sort of like 3D systems came up with this, uh, in the 80s.

433
00:25:48,980 --> 00:25:50,080
And there was never a formal spec.

434
00:25:50,260 --> 00:25:55,320
Someone, someone described what a SDL file is supposed to be in, like, their doctoral thesis.

435
00:25:55,460 --> 00:25:57,300
But there's never been an RFC for it.

436
00:25:57,340 --> 00:26:03,180
And for that reason, every CAD package actually sort of, uh, exports them in subtly different ways.

437
00:26:03,460 --> 00:26:06,800
Uh, which means that if you're making 3D printing software that handles SDL files.

438
00:26:06,800 --> 00:26:09,700
You have to be very careful about how you do the parsing of them.

439
00:26:09,800 --> 00:26:13,820
Because every CAD software package might put out a slightly different variation.

440
00:26:14,140 --> 00:26:17,700
And people expect the software to work universally for all files.

441
00:26:18,560 --> 00:26:19,960
Um, but top level view.

442
00:26:20,080 --> 00:26:22,060
There's basically two flavors of SDL files.

443
00:26:22,260 --> 00:26:23,400
There's a binary representation.

444
00:26:23,840 --> 00:26:30,400
And then there's a strings, uh, sort of UTF-8 style, uh, or ASCII, uh, style representation.

445
00:26:31,760 --> 00:26:34,800
So, here's what the, uh, binary file format looks like.

446
00:26:35,120 --> 00:26:36,320
Uh, you know.

447
00:26:36,320 --> 00:26:42,460
We got Uint, uh, 80 header, uh, 32 bytes of number of triangles.

448
00:26:43,160 --> 00:26:46,720
And, uh, these are just our, our, uh, vertexes in a normal.

449
00:26:46,980 --> 00:26:47,460
Right?

450
00:26:47,540 --> 00:26:48,960
So that's what it would look like in binary.

451
00:26:49,420 --> 00:26:52,340
And this is the ASCII file format.

452
00:26:52,900 --> 00:26:58,820
Um, that's about as close that you, as you'll find from anywhere of, uh, specification for these things.

453
00:27:00,580 --> 00:27:02,080
Um, these look like this.

454
00:27:03,920 --> 00:27:04,400
Alright.

455
00:27:05,500 --> 00:27:05,980
Uh.

456
00:27:06,320 --> 00:27:09,880
This is a little more to, like, validating what, uh, a good SDL file is.

457
00:27:10,000 --> 00:27:11,940
But it's not super relevant to security.

458
00:27:12,220 --> 00:27:19,280
Uh, suffice it to say, um, there's, there's some restrictions on how the triangles are actually oriented.

459
00:27:19,460 --> 00:27:23,720
That might or might not prevent the, uh, slicer from being able to do its job at all.

460
00:27:25,280 --> 00:27:25,740
Um.

461
00:27:30,040 --> 00:27:35,000
The key thing is making sure that there's no way to leverage, uh, remote code execution

462
00:27:35,000 --> 00:27:37,580
from the input SDL files.

463
00:27:38,340 --> 00:27:38,860
Um.

464
00:27:39,160 --> 00:27:42,700
And the, the lack of a spec here really doesn't help that.

465
00:27:43,000 --> 00:27:43,500
Uh.

466
00:27:43,600 --> 00:27:48,020
We're gonna sort of explore that more deeply in a second.

467
00:27:48,120 --> 00:27:51,780
But first, uh, let's check out what G-code is like.

468
00:27:52,500 --> 00:27:54,500
So G-code is, uh, pretty ancient.

469
00:27:54,600 --> 00:27:59,620
It's existed for a whole variety of machines, uh, over the course of basically 50 years.

470
00:28:00,200 --> 00:28:00,720
Um.

471
00:28:00,880 --> 00:28:04,460
There is no canonical list of G-code instructions.

472
00:28:04,460 --> 00:28:08,640
Uh, every machine is sort of free to define them and redefine them as it chooses.

473
00:28:08,900 --> 00:28:11,560
And that includes, uh, 3D printer to 3D printer.

474
00:28:11,740 --> 00:28:15,440
Uh, uh, individual G-code might mean different things or have different side effects.

475
00:28:15,940 --> 00:28:21,620
Uh, there isn't any accepted standard for what the individual G-code should mean on a particular printer.

476
00:28:22,080 --> 00:28:29,040
Which is kind of problematic if you're writing a slicer because now you have all these, like, uh, device-dependent things that you have to code in.

477
00:28:29,160 --> 00:28:32,400
And things that might be safe on one printer are not safe on others.

478
00:28:32,820 --> 00:28:34,440
Or there might be features that are not safe on others.

479
00:28:34,440 --> 00:28:36,180
Or there might be features that are missing from some printers that exist in others.

480
00:28:36,800 --> 00:28:37,240
Um.

481
00:28:37,480 --> 00:28:38,820
It becomes a big complicated thing.

482
00:28:39,200 --> 00:28:39,400
Uh.

483
00:28:40,460 --> 00:28:46,040
So G-code instructions are basically, uh, some letter, usually V, then some number, and then an operand.

484
00:28:46,560 --> 00:28:47,000
Um.

485
00:28:47,140 --> 00:28:52,080
I told you that G-code is considered, uh, like, a full programming language by some.

486
00:28:52,580 --> 00:28:56,620
And you can kind of think of it as the assembly language of the printer.

487
00:28:56,780 --> 00:28:57,080
Um.

488
00:28:57,340 --> 00:29:03,740
So what is output by the slicing software is actual instructions for the firmware of the printer to execute.

489
00:29:04,440 --> 00:29:16,980
And that's a little scary because that means there's an intermediary file that you can mess with and tell the printer to do nonsensical things after the slicing process has ended.

490
00:29:17,500 --> 00:29:22,960
And that also means that you can, you know, share G-code files with other people that might be potentially malicious.

491
00:29:23,600 --> 00:29:27,700
And the G-code is, essentially, has full access to the printer.

492
00:29:27,840 --> 00:29:32,980
You can only do the things that the, uh, the G-code is capable of doing that's defined in the firmware.

493
00:29:32,980 --> 00:29:33,360
Uh.

494
00:29:33,700 --> 00:29:38,920
But if those things are unsafe, uh, there isn't any real protections in place to keep people from abusing it.

495
00:29:38,980 --> 00:29:42,100
You know, if you write it in the G-code file and you send it to the printer, it will be executed.

496
00:29:42,240 --> 00:29:44,080
As long as it's kosher with what the firmware has.

497
00:29:45,300 --> 00:29:45,660
Um.

498
00:29:45,780 --> 00:29:50,700
So it's, it's really the responsibility of the firmware developer to make the reading of the G-code safe.

499
00:29:50,820 --> 00:29:53,260
The, the printer will execute whatever G-code you give it.

500
00:29:55,460 --> 00:29:55,820
Uh.

501
00:29:55,980 --> 00:30:01,640
3D printers typically use a very small subset of G-codes, uh, compared to what CNC routers use.

502
00:30:02,160 --> 00:30:02,520
Uh.

503
00:30:02,980 --> 00:30:06,820
Usually, it's stuff like, uh, CNC routers have, uh, ways of doing, like, arcs.

504
00:30:06,920 --> 00:30:10,740
Like automate, uh, some kind of arcing algorithm instead of giving it straight lines.

505
00:30:10,840 --> 00:30:12,260
That's a really common example.

506
00:30:12,460 --> 00:30:16,460
Or the, the heating element of the 3D printer needs its own G-code kind of ideas.

507
00:30:16,800 --> 00:30:17,120
Um.

508
00:30:19,360 --> 00:30:21,100
Here's, uh, here's what G-code looks like.

509
00:30:21,400 --> 00:30:27,680
And you can see here, this is a series of, uh, sort of coordinates and, and moves for the 3D printer to execute.

510
00:30:27,800 --> 00:30:28,980
This is moving the head around.

511
00:30:29,280 --> 00:30:31,200
Uh, this is the start of the print, basically.

512
00:30:31,200 --> 00:30:31,640
Uh.

513
00:30:32,400 --> 00:30:40,980
An important thing to consider here in, in our threat model of 3D printers is that the G-code has the ability to specify the temperature of the printer.

514
00:30:41,120 --> 00:30:41,420
Right?

515
00:30:41,500 --> 00:30:44,640
That is built into this file format that the 3D printer is eating.

516
00:30:45,120 --> 00:30:52,200
That, that means that, uh, in between the 3D printer deciding what temperature it wants to be, there's a file that can be messed with.

517
00:30:52,380 --> 00:30:52,740
Right?

518
00:30:53,100 --> 00:30:59,700
So, again, if that slicer is owned somehow, or if you have someone messing with your G-code files, they could set it to funky temperatures.

519
00:30:59,700 --> 00:31:02,680
Now, the firmware typically has some kind of protections against that.

520
00:31:02,840 --> 00:31:11,220
But, if you have, uh, misconfigured firmware somehow, or your, your printer just isn't up to snuff somehow, uh, bad things could happen.

521
00:31:17,440 --> 00:31:25,440
So, uh, you know, just as an example attack, you find someone who has the maximum temperature of their printer, uh, set too high.

522
00:31:25,760 --> 00:31:29,680
And you just give them an altered G-code file, uh, with a too high temperature.

523
00:31:29,680 --> 00:31:32,420
Something that would cause the ABS filament to catch fire.

524
00:31:32,720 --> 00:31:34,420
Uh, it's not that far-fetched.

525
00:31:34,480 --> 00:31:37,880
You know, people set up their printers for, uh, printing, uh, polycarbonate all the time.

526
00:31:37,940 --> 00:31:40,980
And they'll jack up the, uh, the maximum temperature in the firmware.

527
00:31:41,400 --> 00:31:48,640
And all it takes is someone malicious giving them a G-code file, uh, with a temperature that is too high for their filament to take.

528
00:31:48,720 --> 00:31:49,680
And you're in trouble.

529
00:31:50,300 --> 00:31:55,440
Again, the 3D printer trusts, for the most part, the G-code instructions you give it.

530
00:31:56,480 --> 00:31:58,520
Uh, here's some of the available slicer software.

531
00:31:58,520 --> 00:32:00,620
Slicer, Cura, KISS slicer.

532
00:32:00,760 --> 00:32:02,180
Uh, MakerBot's got one.

533
00:32:04,040 --> 00:32:06,460
Um, I ran AFL against these.

534
00:32:06,820 --> 00:32:09,840
And, uh, does everyone know what AFL is?

535
00:32:10,080 --> 00:32:11,660
Slic- uh, fuzzing software, yeah?

536
00:32:11,980 --> 00:32:12,420
Cool.

537
00:32:12,760 --> 00:32:15,120
Um, I saw someone- not everyone raised their hand.

538
00:32:15,200 --> 00:32:15,300
Okay.

539
00:32:15,400 --> 00:32:15,740
I'll explain.

540
00:32:15,880 --> 00:32:23,940
It's- it's- it's basically, uh, machine learning powered, uh, automated, uh, file fuzzer.

541
00:32:24,060 --> 00:32:28,500
It- it'll corrupt a file you give it until it causes, uh, a crash to happen, right?

542
00:32:28,520 --> 00:32:29,000
But it's smart.

543
00:32:29,080 --> 00:32:33,480
It actually parses over the call tree of the, uh, of the program and finds nooks and crannies.

544
00:32:33,720 --> 00:32:43,240
And the- the problem I ran into is that the- the problem that slicers have to solve is so large and inefficient it made it hard for them to fuzz.

545
00:32:43,320 --> 00:32:47,760
And I had to break apart the, uh, the program and fuzz individual sub-components of it.

546
00:32:47,880 --> 00:32:52,940
Because an individual slicing job could take anything from, like, two seconds to possibly hours.

547
00:32:54,640 --> 00:32:58,320
Um, it made it very difficult, uh, to work with fuzzers.

548
00:33:03,980 --> 00:33:14,160
So, if- if we look at, uh, Cura Engine, which is, uh, popular slicing software, it- it actually chips with no ASLR, uh, no DEP, uh, no control flow guard.

549
00:33:14,580 --> 00:33:25,380
Uh, basically, it's- it's pretty ripe for- if anyone found a buffer overflow of any description, it'd be trivial to put together an exploit of this thing and cause some havoc to happen.

550
00:33:27,020 --> 00:33:27,460
Okay.

551
00:33:28,420 --> 00:33:34,140
So, uh, yeah, we have some, you know, low-level code, parsing, untrusted code.

552
00:33:34,640 --> 00:33:35,580
This is a bad idea.

553
00:33:39,740 --> 00:33:41,580
Um, let's move on to host programs.

554
00:33:46,380 --> 00:33:54,140
So, uh, the job of the host software is to send over the model to be printed, uh, from your computer to the 3D printer.

555
00:33:54,840 --> 00:33:57,440
Uh, usually this is done, uh, over serial code.

556
00:33:57,460 --> 00:33:59,480
So, uh, we're gonna look at that in a second.

557
00:33:59,800 --> 00:34:06,020
But the idea is to give some kind of interface for people to, like, check in on the print, to monitor the temperature of the printer, see how far along they are.

558
00:34:06,820 --> 00:34:14,240
And again, what we have to watch out for is, like, any kind of way an attacker could send untrusted commands to the printer by exploiting the host software.

559
00:34:15,780 --> 00:34:20,420
Um, here's a comparison of the, uh, host softwares that are out there.

560
00:34:20,960 --> 00:34:24,820
Uh, we have, um, no one can agree how to pronounce this one.

561
00:34:24,940 --> 00:34:27,200
It's, uh, I think it's repeater hosts.

562
00:34:28,500 --> 00:34:29,460
Repetier hosts.

563
00:34:29,720 --> 00:34:31,880
I've never heard two people pronounce it the same way.

564
00:34:32,480 --> 00:34:35,140
Uh, and then you got Cura, Octoprint, Pronterface.

565
00:34:37,120 --> 00:34:45,720
Um, the problem here is less with the host software itself than the model of serial communication that's going on between the printer and the host software.

566
00:34:46,940 --> 00:34:50,900
Um, here, here's, here's what, uh, each of these looks like.

567
00:34:53,000 --> 00:34:56,560
And the problem is that they just basically speak over serial.

568
00:34:57,380 --> 00:35:08,860
And if the 3D printer is plugged in to the computer and the host software isn't talking to it currently, there isn't much to stop an attacker, uh, from just sending commands to the printer.

569
00:35:08,960 --> 00:35:12,880
If they have remote code execution on your computer, they can send commands to the printer.

570
00:35:12,980 --> 00:35:14,760
And there isn't anything to stop it.

571
00:35:14,760 --> 00:35:20,600
There isn't any kind of authentication or authorization or trusted G codes versus untrusted ones.

572
00:35:20,900 --> 00:35:26,660
If the host software is not connected, uh, there's really nothing to stop you from just sending over your own print.

573
00:35:27,200 --> 00:35:36,760
Um, the, uh, the only thing that might be problematic is if maybe the host software stopped in the middle of a print and released the port.

574
00:35:37,320 --> 00:35:39,720
And then you'd have a checksum to figure out.

575
00:35:39,860 --> 00:35:47,920
Um, 3D printing, uh, software usually has a very basic binary protocol where after each command, a number is incremented.

576
00:35:47,980 --> 00:35:51,780
Like, you know, this is line one, this is line two, and line three.

577
00:35:51,820 --> 00:35:54,540
And the firmware checks to make sure you're on the right line number.

578
00:35:55,500 --> 00:35:56,640
This is what that looks like.

579
00:35:57,200 --> 00:35:57,600
This is the checksum.

580
00:35:57,760 --> 00:36:02,860
Uh, obviously checksums like this aren't intended for security, but if you ever wanted to do this, this is what would get in your way.

581
00:36:02,940 --> 00:36:05,500
Like, knowing what the checksum is at any given time.

582
00:36:05,620 --> 00:36:12,560
So, how are we gonna figure out, like, what line number we're on so the 3D printer doesn't just, like, ignore our command and tell us that we've sent them corrupt stuff?

583
00:36:12,740 --> 00:36:18,860
Well, as it turns out, uh, many 3D printers and firmwares have a command to just reset the line number.

584
00:36:18,980 --> 00:36:20,720
So, not a problem.

585
00:36:21,360 --> 00:36:25,840
And, uh, even better, uh, the line number reset command has no checksum.

586
00:36:25,840 --> 00:36:27,780
So, good to go.

587
00:36:27,960 --> 00:36:28,700
No problem.

588
00:36:29,040 --> 00:36:33,460
Uh, if it starts rejecting your commands, just give it M110 and it's gonna reset.

589
00:36:33,560 --> 00:36:34,160
You're gonna be good.

590
00:36:35,420 --> 00:36:39,980
Uh, so, this is how you'd steal a, uh, uh, com port.

591
00:36:40,380 --> 00:36:45,980
Um, you send the printer a M110 command, reset the line number, and you're golden.

592
00:36:46,300 --> 00:36:48,000
There's really not anything in the way.

593
00:36:51,240 --> 00:36:53,220
Um, alright, so now let's look at the firmware.

594
00:36:56,080 --> 00:36:58,940
So, there's many variations on 3D printer firmwares.

595
00:36:58,980 --> 00:37:02,540
They're all sort of descended from the same family.

596
00:37:03,180 --> 00:37:05,780
Uh, they all work in more or less the same way.

597
00:37:05,840 --> 00:37:09,960
Again, there is no rigorous spec for how 3D printers should work, which is kind of a problem on its own.

598
00:37:10,100 --> 00:37:18,060
But, uh, people early on in the process sort of developed a, a common procedure that people, uh, adhere to more or less the same way.

599
00:37:21,280 --> 00:37:25,720
Um, what does happen all the time, though, is that people like to fork these projects.

600
00:37:25,720 --> 00:37:27,660
And make their own subtle remixes of it.

601
00:37:27,920 --> 00:37:33,240
Which means that even if the, like, main repository, the original author of the firmware, is in good shape.

602
00:37:33,280 --> 00:37:35,200
Is very conscientious about their binary security.

603
00:37:35,440 --> 00:37:38,020
Like looking for buffer overflows and that kind of thing.

604
00:37:38,220 --> 00:37:39,680
Uh, maybe the forks aren't.

605
00:37:40,200 --> 00:37:40,600
Right?

606
00:37:41,800 --> 00:37:43,260
Um, and that's a problem.

607
00:37:43,300 --> 00:37:48,180
Because the most common reason to fork something is if you're, if you're a 3D printer manufacturer.

608
00:37:48,600 --> 00:37:49,920
And you want your own firmware.

609
00:37:50,100 --> 00:37:53,820
And you want it to work slightly different than, you know, the mainline open source firmware.

610
00:37:54,020 --> 00:37:55,420
You're going to fork that, change it.

611
00:37:55,720 --> 00:38:01,040
And not everyone is conscientious about implementing those upstream changes to the firmware.

612
00:38:01,440 --> 00:38:07,820
So it's very possible, uh, that someone will find a buffer overflow in the, like, upstream repository.

613
00:38:07,880 --> 00:38:10,240
And the downstream repositories will never fix it.

614
00:38:12,560 --> 00:38:15,520
Um, there's also no idea of chain of trust.

615
00:38:15,700 --> 00:38:21,160
So, for a lot of devices like your cell phone, uh, things are cryptographically signed when the firmware is flashed on.

616
00:38:21,260 --> 00:38:25,700
So you can't just put any random firmware on the thing without it causing problems.

617
00:38:25,720 --> 00:38:30,080
Uh, if you have access to someone's 3D printer, or perhaps not, we'll talk about it in a second.

618
00:38:30,340 --> 00:38:33,040
Um, you can flash new firmware on there.

619
00:38:33,120 --> 00:38:34,200
Pretty much no problems.

620
00:38:34,320 --> 00:38:38,360
There's, there's very little boundary to just putting new firmware on a 3D printer.

621
00:38:38,540 --> 00:38:39,540
Uh, for the most part.

622
00:38:39,700 --> 00:38:48,820
Now, in a lot of hardware, what they'll do to prevent this from being an issue is require sort of, uh, a, uh, a circuit to be shorted.

623
00:38:48,860 --> 00:38:51,900
They have like a little, little, uh, two pins that you short together.

624
00:38:52,220 --> 00:38:54,980
And that's what allows the, uh, firmware upload to happen.

625
00:38:54,980 --> 00:38:59,660
And earlier on, when 3D printers were more commonly based off things that were essentially Arduinos,

626
00:38:59,860 --> 00:39:01,640
uh, you would have a little push button, right?

627
00:39:01,740 --> 00:39:06,060
You'd push a button, and you had like a five second window, uh, to flash the firmware.

628
00:39:06,420 --> 00:39:20,820
Now, in more recent editions, as these have hit the mainstream, I've increasingly found people marketing host software that has the ability to directly upload firmware with no further checks on the hardware side.

629
00:39:20,980 --> 00:39:21,920
That's kind of dangerous.

630
00:39:22,100 --> 00:39:23,900
Uh, to be frank with you.

631
00:39:23,900 --> 00:39:28,380
Because your firmware is your last, uh, bastion of defense.

632
00:39:28,580 --> 00:39:35,960
If you tell the, the 3D printer to do something horrible and dangerous and harmful, uh, it's the firmware's job to save you.

633
00:39:36,080 --> 00:39:42,140
And if you have control of the host software, and the host software has the ability to upload firmware, well, game over.

634
00:39:42,380 --> 00:39:45,880
You can reflash the firmware, remove every possible protection, and you're good to go.

635
00:39:46,980 --> 00:39:47,380
Alright.

636
00:39:47,780 --> 00:39:52,360
So, here are the, uh, most common, uh, flavors of free and open source, uh, firmwares.

637
00:39:52,500 --> 00:39:53,320
Uh, we got Marlin.

638
00:39:53,900 --> 00:39:56,000
It's probably, like, the king of 3D printing, uh, firmwares.

639
00:39:56,060 --> 00:39:57,060
It's been along for a long time.

640
00:39:57,300 --> 00:39:59,140
It's up, updated all the time.

641
00:39:59,700 --> 00:40:10,280
Uh, it's smaller than the other, uh, common firmwares because, uh, uh, honestly, it's been picked over and optimized and, and made clean, made small, uh, for many years.

642
00:40:10,740 --> 00:40:17,380
As, they're very conscientious about, uh, removing security, security problems from, uh, from their firmware.

643
00:40:17,740 --> 00:40:20,580
Uh, but other people don't update as often.

644
00:40:20,640 --> 00:40:23,880
If you look here at, um, at, uh, Repetier.com.

645
00:40:23,900 --> 00:40:32,760
Uh, that's not updated quite as often, and a lot of the, um, downstream forks and things like that are left alone for a long time.

646
00:40:33,300 --> 00:40:49,920
Uh, another problem you'll run into with these, uh, firmware packages is that it's kind of an open source type problem where, uh, people, people make modifications to the firmware for their proprietary printer and then drag their feet about releasing the GNU type source code, right?

647
00:40:50,100 --> 00:40:51,200
Which shouldn't be a problem.

648
00:40:51,280 --> 00:40:53,700
People should be, like, conscientious and open and honest about that.

649
00:40:53,900 --> 00:40:54,620
But it is a thing that'll happen.

650
00:40:54,660 --> 00:41:01,080
There might be a six or eight month gap between, you know, when they make a big change to the firmware and when it's actually published and released.

651
00:41:02,560 --> 00:41:02,880
So.

652
00:41:03,580 --> 00:41:04,600
Something to keep in mind.

653
00:41:06,220 --> 00:41:07,360
We got, uh, Marlin.

654
00:41:07,500 --> 00:41:12,900
Uh, these things, by the way, are meant to run on, uh, typically AVR, uh, 8-bit micros.

655
00:41:13,840 --> 00:41:18,220
Uh, ARM is starting to make a little bit of headway, bit by bit, which is a good thing.

656
00:41:18,280 --> 00:41:19,080
You can do a lot more.

657
00:41:20,100 --> 00:41:23,880
Um, but sort of the standard for 3D printers still is, uh, 8-bit.

658
00:41:23,900 --> 00:41:24,900
8-bit AVR.

659
00:41:27,680 --> 00:41:31,200
Um, here's what, uh, like, if you're configuring Marlin, this is what it would look like.

660
00:41:31,280 --> 00:41:34,460
This is the part where you, uh, specify the maximum temperature of the printer.

661
00:41:35,280 --> 00:41:41,500
And unfortunately, again, the culture of this is that, uh, people pass around configuration files between each other all the time.

662
00:41:41,880 --> 00:41:42,280
Right?

663
00:41:42,360 --> 00:41:51,220
And it is not unthinkable for someone who's not your best friend to send you a configuration file for your firmware where the maximum temperature is sent really high.

664
00:41:51,220 --> 00:41:56,460
And if you're dumb enough to put, compile that into your firmware, there's nothing to save you.

665
00:41:56,540 --> 00:42:00,600
There's no hardware protection that will stop the printer from blowing itself up, typically.

666
00:42:00,840 --> 00:42:06,100
Uh, to save you if the firmware is not designed to help you in the way it should.

667
00:42:07,600 --> 00:42:13,720
Um, but Marlin is very, uh, conscientious about the temperature problem and has all kinds of safety aborts.

668
00:42:13,960 --> 00:42:21,200
Where if it thinks that things are going wrong, it will, uh, not just stop the print job, but just reset the firmware and stop all, uh,

669
00:42:21,220 --> 00:42:22,120
computation whatsoever.

670
00:42:22,460 --> 00:42:24,000
You know, we're basically dead in the water.

671
00:42:24,080 --> 00:42:24,300
Right?

672
00:42:24,640 --> 00:42:30,660
Uh, the security check I'm showing right here, or safety check you could say, uh, is the max temps error.

673
00:42:30,760 --> 00:42:36,000
This is what happens when you've achieved a temperature higher than what the firmware was compiled to accept.

674
00:42:36,240 --> 00:42:41,400
And if you get through two or three cycles of the, uh, temperature being higher than it should be, it just shuts off.

675
00:42:41,580 --> 00:42:41,940
Right?

676
00:42:42,900 --> 00:42:45,540
Uh, there are other ones we'll talk about in a second, but this is the main one.

677
00:42:45,640 --> 00:42:49,040
So if you were a bad guy trying to find a way to blow up a 3D printer,

678
00:42:49,200 --> 00:42:51,160
uh, this is what would be in your way of

679
00:42:51,220 --> 00:42:53,180
of doing it very easily.

680
00:42:53,460 --> 00:42:55,060
Uh, and it's a good thing, and it works,

681
00:42:55,420 --> 00:42:58,200
but things can go horribly wrong still.

682
00:42:58,920 --> 00:43:01,720
You know, I guess it won't be that easy to blow stuff up,

683
00:43:01,820 --> 00:43:03,660
but maybe it will be.

684
00:43:03,860 --> 00:43:04,920
Uh, so the first thing

685
00:43:04,920 --> 00:43:07,060
I want to talk about, and this is, again, a fundamental

686
00:43:07,060 --> 00:43:08,960
problem with 3D printers, uh, as they are

687
00:43:08,960 --> 00:43:10,900
as they are set up today, is

688
00:43:10,900 --> 00:43:13,080
uh, the calibration

689
00:43:14,160 --> 00:43:14,880
and manipulation

690
00:43:14,880 --> 00:43:16,920
of what are called PID algorithms.

691
00:43:17,420 --> 00:43:18,840
Um, anyone familiar with this?

692
00:43:19,020 --> 00:43:20,520
Anyone played with PID algorithms?

693
00:43:21,220 --> 00:43:22,700
If you've been printing, CNC people sort of know this.

694
00:43:24,080 --> 00:43:24,780
PID means

695
00:43:24,780 --> 00:43:27,120
Proportional Integral Derivative Control Algorithm.

696
00:43:27,200 --> 00:43:27,960
It's from control theory.

697
00:43:28,160 --> 00:43:29,680
The idea is that sort of, uh,

698
00:43:30,160 --> 00:43:32,920
if you naively adjust the temperature

699
00:43:32,920 --> 00:43:34,840
to the 3D printer, it's going to sine wave forever

700
00:43:34,840 --> 00:43:36,480
because you'll always be overcompensating.

701
00:43:36,600 --> 00:43:38,880
The PID algorithm is a way to keep

702
00:43:38,880 --> 00:43:40,480
the 3D printer at a stable temperature.

703
00:43:40,680 --> 00:43:43,060
But, the PID algorithm has to be

704
00:43:43,060 --> 00:43:44,600
tuned for the individual hardware

705
00:43:44,600 --> 00:43:46,960
on the printer. It has to be matched to the

706
00:43:46,960 --> 00:43:48,700
coefficients that are

707
00:43:49,040 --> 00:43:50,820
uh, compatible with

708
00:43:51,220 --> 00:43:53,240
that individual heating element, heating block,

709
00:43:53,340 --> 00:43:54,800
nozzle combo, right?

710
00:43:54,920 --> 00:43:57,060
And this can change over the time as the 3D printer ages

711
00:43:57,060 --> 00:43:58,920
so every 3D printer firmware

712
00:43:58,920 --> 00:44:00,800
I've ever seen has a

713
00:44:00,800 --> 00:44:02,900
PID setting tuning

714
00:44:02,900 --> 00:44:04,740
G-code. So that means

715
00:44:05,700 --> 00:44:07,080
that the 3D printable file

716
00:44:07,080 --> 00:44:08,660
that you send to the 3D printer

717
00:44:09,040 --> 00:44:11,100
has the ability to tune this PID

718
00:44:11,100 --> 00:44:13,060
algorithm itself. It can initiate the

719
00:44:13,060 --> 00:44:14,960
process and set the coefficients of

720
00:44:14,960 --> 00:44:16,660
PID tuning stuff.

721
00:44:17,180 --> 00:44:19,060
Right? That means your input file can

722
00:44:19,060 --> 00:44:20,260
calibrate your printer for you.

723
00:44:21,220 --> 00:44:22,020
Which is not a good thing.

724
00:44:22,160 --> 00:44:23,960
Uh, the reason this is set up, by the way,

725
00:44:24,020 --> 00:44:25,640
is because the only way that the host program

726
00:44:26,200 --> 00:44:27,780
uh, can communicate with the 3D printer

727
00:44:27,780 --> 00:44:30,160
is by sending G-code. So there has to be a

728
00:44:30,160 --> 00:44:31,820
G-code for the PID thing. Right?

729
00:44:32,160 --> 00:44:33,980
Uh, that means it's the same as any other print

730
00:44:33,980 --> 00:44:36,200
and you can stow it away in someone's 3D printable file.

731
00:44:37,160 --> 00:44:37,520
Um,

732
00:44:39,240 --> 00:44:41,120
documentation for most, uh, firmwares

733
00:44:41,120 --> 00:44:42,800
calls this out as a potential issue.

734
00:44:42,880 --> 00:44:43,540
The reason is

735
00:44:45,920 --> 00:44:47,100
um, that if you

736
00:44:47,100 --> 00:44:48,340
tune the PID values

737
00:44:49,860 --> 00:44:51,040
maliciously, or incorrectly

738
00:44:51,220 --> 00:44:53,020
as can even happen by

739
00:44:53,020 --> 00:44:55,000
accident, uh, the 3D printer can just

740
00:44:55,000 --> 00:44:57,080
overshoot its intended temperature.

741
00:44:57,220 --> 00:44:59,020
You can ask for, uh, 200

742
00:44:59,020 --> 00:45:01,000
Celsius and end up with 250

743
00:45:01,000 --> 00:45:02,080
Celsius or higher.

744
00:45:02,980 --> 00:45:05,020
And at that point, uh, you're

745
00:45:05,020 --> 00:45:06,960
basically relying

746
00:45:06,960 --> 00:45:09,040
on the, on the

747
00:45:09,040 --> 00:45:10,720
firmware to save your butt.

748
00:45:10,840 --> 00:45:13,220
Right? To detect that

749
00:45:13,220 --> 00:45:14,560
the temperature is not what it should be.

750
00:45:14,900 --> 00:45:17,140
Um, however, historically it's been a problem

751
00:45:17,140 --> 00:45:18,900
that it can linger up there for a while

752
00:45:18,900 --> 00:45:20,780
before the firmware catches on.

753
00:45:21,520 --> 00:45:22,380
Now, it,

754
00:45:23,100 --> 00:45:25,400
in truth, this shouldn't be, like, catastrophic

755
00:45:26,340 --> 00:45:26,780
because

756
00:45:28,480 --> 00:45:29,400
one of two things

757
00:45:29,400 --> 00:45:31,080
should happen. The 3D printer should just shut off

758
00:45:31,080 --> 00:45:33,160
or it will sine wave back down

759
00:45:33,160 --> 00:45:35,140
to an even lower temperature and maybe make

760
00:45:35,140 --> 00:45:36,800
another attempt to get higher up there.

761
00:45:37,360 --> 00:45:39,080
Um, but in practice

762
00:45:39,080 --> 00:45:41,000
people have found that bad things will happen

763
00:45:41,000 --> 00:45:42,560
if you maliciously tune these.

764
00:45:43,680 --> 00:45:44,960
Um, there's even some,

765
00:45:44,980 --> 00:45:47,220
some indication over what that would look

766
00:45:47,220 --> 00:45:48,460
like. Um,

767
00:45:48,460 --> 00:45:48,700
...

768
00:45:51,840 --> 00:45:53,220
I'm not going to show you

769
00:45:53,220 --> 00:45:53,860
how to do it, though.

770
00:45:54,780 --> 00:45:56,000
Because I think it would be irresponsible.

771
00:45:56,620 --> 00:45:58,560
Um, the, the

772
00:45:59,520 --> 00:46:01,160
primary thing to learn here is that

773
00:46:01,160 --> 00:46:02,980
yeah, it's an issue, it's a knowledge

774
00:46:02,980 --> 00:46:04,720
issue, and it's something that the user

775
00:46:05,100 --> 00:46:06,220
inherently has control over.

776
00:46:08,280 --> 00:46:09,200
Um, I say

777
00:46:09,200 --> 00:46:11,240
if we're gonna fix this, just authenticate

778
00:46:11,240 --> 00:46:12,560
PID calibration.

779
00:46:13,020 --> 00:46:15,060
It's not a big deal to have a username, password, something

780
00:46:15,060 --> 00:46:17,200
in your firmware, uh, to keep

781
00:46:17,200 --> 00:46:19,080
this from happening. Uh, don't put it in the G code.

782
00:46:19,240 --> 00:46:21,160
Find some other protocol to keep

783
00:46:21,220 --> 00:46:21,860
this from going on.

784
00:46:23,180 --> 00:46:25,220
Um, but let's look at

785
00:46:25,220 --> 00:46:27,000
like, uh, much scarier firmware

786
00:46:27,000 --> 00:46:27,980
exploitation vectors.

787
00:46:29,240 --> 00:46:31,020
Um, number one, we have interfaces.

788
00:46:31,220 --> 00:46:33,020
Uh, I touched on this before, which allow the

789
00:46:33,020 --> 00:46:34,640
unauthenticated flashing of firmware.

790
00:46:34,940 --> 00:46:37,260
Uh, and then, uh, exploiting

791
00:46:37,260 --> 00:46:39,180
programming errors in the firmware itself, right?

792
00:46:39,720 --> 00:46:41,140
So, like, what is the sum

793
00:46:41,140 --> 00:46:42,880
of all fears, okay? It's, uh,

794
00:46:43,080 --> 00:46:44,460
it's return-oriented programming

795
00:46:45,100 --> 00:46:46,240
in the firmware itself.

796
00:46:46,640 --> 00:46:48,920
And we'll talk about

797
00:46:49,620 --> 00:46:50,920
what that would look like.

798
00:46:51,220 --> 00:46:53,360
Um, so buffer overflows

799
00:46:53,360 --> 00:46:55,180
are very possible on 3D printer

800
00:46:55,180 --> 00:46:57,120
firmware. They're written in C. Um, it's

801
00:46:57,120 --> 00:46:59,380
up to the, uh, author

802
00:46:59,380 --> 00:47:01,060
of the firmware to put the bounds

803
00:47:01,060 --> 00:47:03,100
checks in to keep you from doing buffer overflows.

804
00:47:04,520 --> 00:47:05,440
Uh, devs

805
00:47:05,440 --> 00:47:07,160
of this firmware are typically relatively

806
00:47:08,140 --> 00:47:09,180
conscientious about it. You can

807
00:47:09,180 --> 00:47:10,920
find lots of fixes for pre-existing

808
00:47:10,920 --> 00:47:12,640
buffer overflows in the past.

809
00:47:13,060 --> 00:47:14,640
Uh, for instance, uh,

810
00:47:14,900 --> 00:47:17,000
many firmwares had a set-size command

811
00:47:17,000 --> 00:47:19,260
queue that could be overflown, right? It would be

812
00:47:19,260 --> 00:47:21,020
like, you know, they would

813
00:47:21,220 --> 00:47:22,860
set as, uh,

814
00:47:23,560 --> 00:47:25,060
on the stack, like, the command

815
00:47:25,060 --> 00:47:27,280
queue for the printer will be 25 commands long,

816
00:47:27,420 --> 00:47:29,100
and if you send it 26 commands,

817
00:47:29,300 --> 00:47:30,820
it would overflow and bad things would happen.

818
00:47:31,160 --> 00:47:33,080
Uh, a lot of the

819
00:47:33,080 --> 00:47:35,180
better, safer 3D printer firmwares, uh,

820
00:47:35,200 --> 00:47:37,100
use, like, ring buffers, so if you send

821
00:47:37,100 --> 00:47:39,320
too many, it'll just overwrite the, uh,

822
00:47:39,320 --> 00:47:40,660
previous command, uh,

823
00:47:40,780 --> 00:47:42,720
but it's still something that happens.

824
00:47:43,500 --> 00:47:43,940
Um,

825
00:47:45,480 --> 00:47:46,360
the, the

826
00:47:47,580 --> 00:47:49,020
firmware has to have a very

827
00:47:49,020 --> 00:47:51,200
safe parser in it to make sure

828
00:47:51,220 --> 00:47:53,000
that what's, what's going into the printer

829
00:47:53,000 --> 00:47:54,800
are, is not

830
00:47:54,800 --> 00:47:56,720
malicious, right? And

831
00:47:57,300 --> 00:47:59,140
this is doubly so because 3D printers

832
00:47:59,140 --> 00:48:01,180
on AVR have no form

833
00:48:01,180 --> 00:48:02,580
of ASLR,

834
00:48:02,920 --> 00:48:05,120
they have no depth. If you control

835
00:48:05,120 --> 00:48:07,300
the printer, you fully control the printer, right?

836
00:48:07,360 --> 00:48:09,080
There's nothing, there's no randomization or

837
00:48:09,080 --> 00:48:10,980
anti-exploitation mitigation factors

838
00:48:10,980 --> 00:48:13,220
to make it even hard to do once you have

839
00:48:13,220 --> 00:48:15,100
control. Uh, the only thing staying

840
00:48:15,100 --> 00:48:17,160
your way is AVR being a, uh,

841
00:48:17,160 --> 00:48:19,000
Harvard architecture, which, uh,

842
00:48:19,140 --> 00:48:21,180
you guys familiar with Harvard architecture? It's the

843
00:48:21,220 --> 00:48:23,200
AVR, right? Uh, which means that

844
00:48:23,200 --> 00:48:23,920
uh,

845
00:48:24,880 --> 00:48:27,200
you will have to use return-oriented programming. You'll have to

846
00:48:27,200 --> 00:48:29,160
return to the code,

847
00:48:29,220 --> 00:48:31,100
uh, repeatedly. You can't just

848
00:48:31,100 --> 00:48:32,400
inject your own shellcode.

849
00:48:32,740 --> 00:48:35,020
Uh, what you have to do is re, uh, find

850
00:48:35,020 --> 00:48:37,140
pre-existing, uh, bits.

851
00:48:37,400 --> 00:48:39,180
Which is a little more challenging on a tiny piece

852
00:48:39,180 --> 00:48:40,820
of 3D printer heart, like,

853
00:48:40,880 --> 00:48:41,280
firmware.

854
00:48:43,100 --> 00:48:45,200
So, here's how that shellcode would look.

855
00:48:45,640 --> 00:48:46,040
Um,

856
00:48:47,180 --> 00:48:48,940
again, I'm not gonna show, uh, share any

857
00:48:48,940 --> 00:48:51,160
with you, uh, right now, just for

858
00:48:51,220 --> 00:48:53,000
safety sake, but, um,

859
00:48:53,260 --> 00:48:55,180
first thing you would do is, uh, overflow

860
00:48:55,180 --> 00:48:56,980
the program counter, uh,

861
00:48:57,180 --> 00:48:59,220
return to a gadget, and then we would

862
00:48:59,220 --> 00:49:00,940
overwrite some critical setting, and

863
00:49:00,940 --> 00:49:03,320
return, uh, control flow right back to the printer.

864
00:49:03,680 --> 00:49:05,120
So you could see, you

865
00:49:05,120 --> 00:49:07,040
could, uh, very easily

866
00:49:07,040 --> 00:49:09,120
use an exploit like this to just

867
00:49:09,120 --> 00:49:11,120
reset the maximum temperature of the printer and

868
00:49:11,120 --> 00:49:12,700
send it off heating, right?

869
00:49:12,860 --> 00:49:15,060
So it's critical that, uh,

870
00:49:15,080 --> 00:49:16,860
3D printers, uh,

871
00:49:17,060 --> 00:49:18,000
have safe

872
00:49:19,540 --> 00:49:20,700
firmware, right?

873
00:49:21,220 --> 00:49:22,780
Uh, with no buffer overflows whatsoever.

874
00:49:23,240 --> 00:49:25,100
Um, and I bring that up

875
00:49:25,100 --> 00:49:26,160
especially because they're not,

876
00:49:26,840 --> 00:49:29,280
it's not like, uh, aerospace code or, or

877
00:49:29,280 --> 00:49:31,220
the code you would find on a plane where it was made

878
00:49:31,220 --> 00:49:32,620
for safety from the ground up.

879
00:49:35,660 --> 00:49:36,840
So, uh, just some,

880
00:49:38,260 --> 00:49:39,060
uh, ideas

881
00:49:39,060 --> 00:49:41,080
about finding these exploits.

882
00:49:41,240 --> 00:49:43,080
Uh, are these rare? Well,

883
00:49:44,200 --> 00:49:44,600
no.

884
00:49:45,600 --> 00:49:46,920
If you search around on GitHub,

885
00:49:47,020 --> 00:49:49,120
you can probably find some existing acknowledged

886
00:49:49,120 --> 00:49:50,780
ones that haven't even been fixed.

887
00:49:51,220 --> 00:49:52,020
To be honest, um,

888
00:49:52,620 --> 00:49:54,940
and then there's a lot of ones sitting around in the code that

889
00:49:54,940 --> 00:49:57,160
people acknowledge, and they're marked no fix

890
00:49:57,160 --> 00:49:58,520
because they don't think they can be exploited.

891
00:49:58,880 --> 00:50:00,820
But this is sort of readily

892
00:50:00,820 --> 00:50:02,460
findable, unfortunately.

893
00:50:03,720 --> 00:50:05,060
And when you consider that

894
00:50:05,060 --> 00:50:07,020
people have forks of the software that

895
00:50:07,020 --> 00:50:09,180
aren't updated, it really is kind of a,

896
00:50:09,200 --> 00:50:10,260
like, danger.

897
00:50:11,220 --> 00:50:12,820
Uh, if you ever want to do some,

898
00:50:13,620 --> 00:50:14,900
uh, reverse engineering

899
00:50:14,900 --> 00:50:16,420
of 3D printer firmware,

900
00:50:16,600 --> 00:50:18,400
uh, that's maybe closed source,

901
00:50:18,920 --> 00:50:21,120
uh, you could do it like this with AVR,

902
00:50:21,220 --> 00:50:22,840
object copy, and AVR

903
00:50:22,840 --> 00:50:25,100
object dump. Uh, another good

904
00:50:25,100 --> 00:50:27,020
reason to do this if you're developing an exploit is

905
00:50:27,020 --> 00:50:29,360
that, uh, while 3D printer manufacturers

906
00:50:29,360 --> 00:50:31,020
are typically releasing the source

907
00:50:31,020 --> 00:50:33,060
code to their firmware, uh,

908
00:50:33,680 --> 00:50:35,580
that might not match up 100%

909
00:50:35,580 --> 00:50:37,040
with the compiled binary

910
00:50:37,040 --> 00:50:39,300
they give you to, uh, install

911
00:50:39,300 --> 00:50:41,080
on the printer. And if you're developing

912
00:50:41,080 --> 00:50:43,120
an exploit against the, like, standard binary

913
00:50:43,120 --> 00:50:45,100
that's put out there, uh, you're gonna want to

914
00:50:45,100 --> 00:50:46,820
look and find the offsets yourself.

915
00:50:47,240 --> 00:50:48,500
Here's what that would look like.

916
00:50:49,120 --> 00:50:50,540
Here's some strings from firmware.

917
00:50:51,380 --> 00:50:51,820
Uh,

918
00:50:53,560 --> 00:50:54,660
it's all pretty easy,

919
00:50:54,740 --> 00:50:56,560
to be honest. Um,

920
00:50:57,040 --> 00:50:58,720
some people ask me in, uh,

921
00:50:58,740 --> 00:51:00,820
when I've given dry runs of this talk,

922
00:51:00,980 --> 00:51:03,140
uh, can you persist on the

923
00:51:03,140 --> 00:51:05,160
3D printer? Uh, one thing I looked into

924
00:51:05,160 --> 00:51:07,040
when doing the research for this is whether you could

925
00:51:07,040 --> 00:51:08,320
store, uh,

926
00:51:09,420 --> 00:51:11,120
shell code on

927
00:51:11,120 --> 00:51:13,120
an EEPROM, uh, to

928
00:51:13,120 --> 00:51:14,760
get persistence on the printer.

929
00:51:16,380 --> 00:51:17,260
The answer

930
00:51:17,260 --> 00:51:18,120
is generally no.

931
00:51:18,740 --> 00:51:21,080
Uh, because, uh, every 3D printer firmware

932
00:51:21,220 --> 00:51:23,420
I analyzed had very conscientious

933
00:51:23,420 --> 00:51:25,040
controls about the length of the data

934
00:51:25,040 --> 00:51:26,240
you could put on the EEPROM, so.

935
00:51:35,080 --> 00:51:35,720
Oh, yeah.

936
00:51:37,140 --> 00:51:39,080
Sure, yeah.

937
00:51:39,740 --> 00:51:41,160
Oh, yeah, you're saying once you got

938
00:51:41,160 --> 00:51:42,980
RCE, you could just, like, write to the flash.

939
00:51:44,220 --> 00:51:44,540
Yeah.

940
00:51:46,600 --> 00:51:46,920
Nice.

941
00:51:54,660 --> 00:51:55,210
...

942
00:51:55,760 --> 00:51:56,860
...

943
00:52:04,560 --> 00:52:05,660
...

944
00:52:05,660 --> 00:52:07,460
...

945
00:52:10,260 --> 00:52:11,360
...

946
00:52:11,360 --> 00:52:11,540
...

947
00:52:11,540 --> 00:52:13,540
...

948
00:52:13,540 --> 00:52:13,920
...

949
00:52:13,920 --> 00:52:13,940
...

950
00:52:15,840 --> 00:52:16,940
Nice.

951
00:52:17,360 --> 00:52:18,840
Everything is through USB

952
00:52:18,840 --> 00:52:20,520
within one minute.

953
00:52:20,900 --> 00:52:44,060
Right. Awesome. Okay. It looks like we're out of time here, guys. Yeah. What? Oh, yeah, yeah. Cool. So I guess we're done. If you guys want to hear anything more about this or ask me some questions, feel free to ask me afterwards. But thanks for listening, guys.