1 00:00:00,000 --> 00:00:04,900 Good morning. How you doing? Sorry about that. We're having some dildo issues. It's a common 2 00:00:04,900 --> 00:00:09,560 problem doing talks like this. Thanks for coming on. I think the first thing I want to say is this 3 00:00:09,560 --> 00:00:14,700 talk is definitely not suitable for children. So if there are any juniors in the room, now would 4 00:00:14,700 --> 00:00:19,120 be a really good time to go. Otherwise, frankly, all bets are off because it gets really rude 5 00:00:19,120 --> 00:00:25,080 really quickly. Now, there's definitely also a health warning on this talk. So please, if you'd 6 00:00:25,080 --> 00:00:31,800 like to be offended, cover your eyes, cover your ears, leave. So with that in mind, let's go and 7 00:00:31,800 --> 00:00:35,980 learn some stuff. This talk comes in two parts. There's a part that starts which is most 8 00:00:35,980 --> 00:00:42,600 definitely suitable for work. And then there's part two which really isn't. So anyway, let's move 9 00:00:42,600 --> 00:00:48,880 on. I want to start with looking at the security of digital video recorders for your CCTV. The 10 00:00:48,880 --> 00:00:52,540 reason for this will become clear as we progress. We're going to be showing you some live 11 00:00:52,540 --> 00:00:55,060 hardware hacking, some reverse engineering. We're going to be showing you some live hardware 12 00:00:55,080 --> 00:00:58,920 hacking. And all of these techniques will become really useful as we progress into slightly 13 00:00:58,920 --> 00:01:05,740 less savoury devices is probably the way to go. Now, we started off looking at digital video 14 00:01:05,740 --> 00:01:13,200 recorders some 18 months ago. We started looking initially at an MV Power DVR, which records the 15 00:01:13,200 --> 00:01:19,180 footage from your CCTV system you put up at home. This is an amazing device. It port forwards 16 00:01:19,180 --> 00:01:25,060 using UPnP by default. So it opens up port 80 inbound from the public internet. And it's a 17 00:01:25,080 --> 00:01:29,280 really good device. No telnet, though. But bear in mind, this is before we started hearing of Mirai. 18 00:01:29,520 --> 00:01:33,120 This is pretty creepy, actually. You can start looking for them quite easily, find them on 19 00:01:33,120 --> 00:01:38,640 Shodan. At the time, we found 44,000 of them. Pretty straightforward. And it was pretty bad. 20 00:01:38,860 --> 00:01:40,500 Andrew, tell me a little bit more about that web interface. 21 00:01:40,880 --> 00:01:45,600 So the web interface had authentication on it. But it was really broken. All it did is it set 22 00:01:45,600 --> 00:01:50,660 two cookies, password and username. But it didn't care what the values were in there, any value. 23 00:01:50,940 --> 00:01:54,840 So the username could be not my username and not my password, and you're into it. So at that point, 24 00:01:54,840 --> 00:01:58,760 you can view the footage through the web without the username and password. So this is already 25 00:01:58,760 --> 00:02:03,860 quite bad. But it got even worse. Once we got access to the firmware on it, we found there was 26 00:02:03,860 --> 00:02:09,520 this particular command, shell. And then you just put command after it. And you're running commands 27 00:02:09,520 --> 00:02:16,680 as root on the DVR through the web, 44,000 of them. Yeah, that's really quite bad. We got no 28 00:02:16,680 --> 00:02:21,600 idea why that would be in there. But then it kind of got worse, not from a kind of owning the box 29 00:02:21,600 --> 00:02:23,180 kind of way, but a privacy aspect. 30 00:02:23,880 --> 00:02:29,740 Within the firmware, we found that the device, every three seconds, was taking a still of channel 31 00:02:29,740 --> 00:02:37,540 one of the camera and emailing it to this email address. So the guy got in contact with us and he 32 00:02:37,540 --> 00:02:43,180 said, oh, this is pre-production. It was never meant to be released. So we sent him frame by 33 00:02:43,180 --> 00:02:49,260 frame, Rick rolled in with a kids' TV series, about 44,000 frames, I think it was. It was, yeah, 34 00:02:49,420 --> 00:02:53,160 good fun. Yeah, he wasn't really into disclosure until we Rick rolled in. But there was a 35 00:02:53,180 --> 00:02:58,200 very good time. But then we got a little bit of a break, but now we're in a good place. Now, that 36 00:02:58,200 --> 00:03:04,500 got us interested in DVRs. And then 12 months ago, we started to see Mirai. And we saw the big 37 00:03:04,500 --> 00:03:09,160 effect. Brian Krebs' website was DDoS'ed. And people started looking at it. The source code was 38 00:03:09,160 --> 00:03:12,100 released. And there was some amazing work done by Brian Krebs and lots of other security 39 00:03:12,100 --> 00:03:17,720 researchers looking at the source code. Found some really, really cool stuff. However, once the 40 00:03:17,720 --> 00:03:23,160 source code was taken apart, there were 63 sets of default root Telnet credentials discovered. And 41 00:03:23,180 --> 00:03:26,980 And an effort was made to try and attribute those and pick up the particular devices in question. 42 00:03:27,460 --> 00:03:34,760 Now, I think what people did is they compared the default credentials they found with lists of known default credential sets and tried to match them up. 43 00:03:34,960 --> 00:03:36,980 And a lot of devices were misattributed. 44 00:03:37,600 --> 00:03:46,740 Now, we went through the list and we went through with our knowledge of DVRs and started looking at all these and discovered actually Mirai, the original Mirai, was just about DVRs and IP cameras. 45 00:03:47,120 --> 00:03:51,180 Now, the IP cameras it affected happened to have DVR functionality. 46 00:03:51,180 --> 00:03:55,100 So, they were running a DVR helper process and that's what was causing the problems. 47 00:03:55,340 --> 00:04:01,940 So, the initial disclosures you saw about Mirai affecting VoIP phones, routers, printers, was wrong. 48 00:04:02,440 --> 00:04:04,860 It was all about DVRs. 49 00:04:05,020 --> 00:04:06,540 And that's where we started getting interested. 50 00:04:06,720 --> 00:04:08,000 So, we wanted to see what more we could do. 51 00:04:08,120 --> 00:04:12,520 So, Mirai, beautifully, beautifully simple, just using root Telnet credentials. 52 00:04:12,680 --> 00:04:13,540 We wanted to know a bit more. 53 00:04:13,620 --> 00:04:15,760 See what Mirai had missed along the way. 54 00:04:15,900 --> 00:04:16,780 It was simple. 55 00:04:16,880 --> 00:04:17,500 It was brilliant. 56 00:04:17,600 --> 00:04:18,780 But what else could we find there? 57 00:04:18,840 --> 00:04:21,160 So, we bought over 30 different. 58 00:04:21,180 --> 00:04:28,860 We bought over 30 different DVRs, lots and lots of them, and started reverse engineering them, pulling the hardware apart, looking at the firmware, seeing what bugs Mirai had missed. 59 00:04:29,100 --> 00:04:31,980 And we found loads and loads of vulnerabilities. 60 00:04:32,620 --> 00:04:36,700 We found lots of DVRs that no one knew could be part of Mirai. 61 00:04:36,800 --> 00:04:41,620 We found additional Telnet credentials that you could add to the list of 63 known credentials. 62 00:04:41,860 --> 00:04:43,720 We discovered one vendor. 63 00:04:43,820 --> 00:04:44,760 They've done a brilliant thing. 64 00:04:44,880 --> 00:04:49,900 They've taken the Telnet port and moved it to port 12323. 65 00:04:50,200 --> 00:04:50,960 Get in. 66 00:04:51,180 --> 00:04:55,220 And then we also found a way to make Mirai persist beyond the power of reboot. 67 00:04:55,420 --> 00:05:07,700 But the problem is, once you could use it to fix Mirai and heal Mirai-infected DVRs remotely, by publishing a route to persistence, we felt that would probably result in worse problems. 68 00:05:07,800 --> 00:05:09,120 So, we're not going to disclose that, I'm afraid. 69 00:05:09,460 --> 00:05:12,380 What we are going to also talk about is how you can use a shell on Telnet. 70 00:05:12,500 --> 00:05:13,820 There's a shell on other ports. 71 00:05:14,120 --> 00:05:15,820 We're going to show you directory traversal. 72 00:05:15,880 --> 00:05:18,620 And we're going to finish up with remote command injection as well. 73 00:05:18,740 --> 00:05:21,100 So, there's all sorts of really crazy vulnerabilities. 74 00:05:21,180 --> 00:05:22,100 And these DVRs. 75 00:05:22,720 --> 00:05:26,600 The first one we found, this made me laugh, is XM. 76 00:05:26,680 --> 00:05:27,380 That's Zhongmai. 77 00:05:27,660 --> 00:05:33,620 The XM remote control applications called XMI. 78 00:05:33,980 --> 00:05:40,980 And you can log into it using a daily changing SU password that's supposed to be kept private. 79 00:05:41,120 --> 00:05:44,360 But a Nigerian CCTV installer put it on his LinkedIn profile. 80 00:05:44,720 --> 00:05:46,100 That was kind of a bad day. 81 00:05:46,340 --> 00:05:48,500 So, you just need to know that and you've got root on the DVR. 82 00:05:49,020 --> 00:05:50,140 Other crazy things. 83 00:05:50,300 --> 00:05:51,160 So, a bunch of DVRs. 84 00:05:51,180 --> 00:05:54,160 DVRs that no one had tagged as being attributed to Mirai. 85 00:05:54,220 --> 00:05:58,700 So, we had Flareons, Lilins, Lorex, FLIR, Big Brand, Nightwatcher, QVIS, HomeGuard, 86 00:05:58,720 --> 00:06:00,040 and a bunch of others I'm not going to talk about. 87 00:06:00,260 --> 00:06:01,820 We found a load of other vulnerabilities too. 88 00:06:01,940 --> 00:06:03,720 And also, a rather interesting shell. 89 00:06:04,860 --> 00:06:06,300 Andrea, I think it's time for you to have a go now. 90 00:06:06,560 --> 00:06:09,200 Yeah. So, I'll show you how we actually reverse these DVRs. 91 00:06:09,280 --> 00:06:12,820 What I'm going to do is I'm going to switch you to this camera that's looking at one of the DVRs we've got here. 92 00:06:15,800 --> 00:06:19,300 So, there's a common factor in nearly all of these Mirai vulnerable DVRs. 93 00:06:19,320 --> 00:06:21,160 And that's they run a chip made by a company. 94 00:06:21,180 --> 00:06:22,140 Called HiSilicon. 95 00:06:22,300 --> 00:06:23,900 So, that's the main processor sat here. 96 00:06:25,460 --> 00:06:29,520 The board, if you flip it over, it's got an SPI flash chip on the other side. 97 00:06:29,600 --> 00:06:30,660 So, you can see this chip here. 98 00:06:30,880 --> 00:06:32,140 That's where it stores the firmware. 99 00:06:33,100 --> 00:06:34,720 It's also got a serial console on it. 100 00:06:34,800 --> 00:06:36,820 Which you can see these three wires connected to there. 101 00:06:37,020 --> 00:06:39,260 It's kind of a very typical piece of embedded hardware. 102 00:06:39,520 --> 00:06:41,900 Now, to get the firmware off it, there was a number of different ways. 103 00:06:41,980 --> 00:06:44,220 And it depends on how well protected the devices were. 104 00:06:44,520 --> 00:06:46,940 Some of them, it was as simple as connecting to the serial port. 105 00:06:47,040 --> 00:06:48,180 Unfortunately, this one isn't. 106 00:06:48,580 --> 00:06:50,580 So, what we had to do is we had to use... 107 00:06:50,580 --> 00:06:51,120 Um... 108 00:06:51,180 --> 00:06:54,480 A technique to break out of U-boot and dump the memory that way. 109 00:06:54,540 --> 00:06:55,580 I'll just show you how it works. 110 00:06:56,060 --> 00:06:57,260 It's pretty easy to do. 111 00:06:57,760 --> 00:07:00,300 So, if we jump through to a console. 112 00:07:03,440 --> 00:07:06,180 What you can see on the screen here is I've booted the device. 113 00:07:06,540 --> 00:07:09,440 And this serial console is showing me what it's spitting out. 114 00:07:09,580 --> 00:07:11,640 And you can see at the bottom there, it says uncompressing Linux. 115 00:07:11,940 --> 00:07:13,860 And you don't get a console into Linux. 116 00:07:14,020 --> 00:07:15,380 So, we can't do anything at that point. 117 00:07:15,700 --> 00:07:17,660 There's no way of me interacting with the device. 118 00:07:18,100 --> 00:07:20,300 But we can actually break out of this. 119 00:07:20,300 --> 00:07:22,420 Get into U-boot, which is the bootloader. 120 00:07:22,440 --> 00:07:24,720 And then dump the memory really, really quickly and easily. 121 00:07:25,000 --> 00:07:26,620 And the technique we're going to use to do that... 122 00:07:27,240 --> 00:07:28,460 Thanks for moving the dildo. 123 00:07:28,960 --> 00:07:30,960 The technique we're going to use for that is called glitching. 124 00:07:32,180 --> 00:07:37,240 And all we do when we're glitching is we just short one of the data pins from the memory to ground. 125 00:07:37,480 --> 00:07:42,040 And the reason that we do that is it stops the memory chip being read. 126 00:07:42,560 --> 00:07:45,620 And if you stop the memory chip being read at exactly the right moment in time, 127 00:07:45,780 --> 00:07:49,340 U-boot will stop because it can't load the kernel and you get access to the console. 128 00:07:49,340 --> 00:07:51,900 Now, the timing of this is a touch sensitive. 129 00:07:52,640 --> 00:07:54,800 So, it may not work, but let's see what happens. 130 00:07:55,280 --> 00:07:57,660 So, I've power cycled it and you're starting to get output. 131 00:07:57,900 --> 00:07:59,420 And I'm going to short the pin now. 132 00:08:02,680 --> 00:08:05,100 And you can see instead of getting that uncompressing Linux, 133 00:08:05,280 --> 00:08:06,780 it now says hi silicon and hash. 134 00:08:07,300 --> 00:08:11,260 We can type question mark to get the help come up and we get this big long list of commands. 135 00:08:11,700 --> 00:08:14,060 Now, if we want to dump the memory off the device through U-boot, 136 00:08:14,140 --> 00:08:16,400 this is painfully slow, but it nearly always works. 137 00:08:17,380 --> 00:08:18,780 MD is memory display. 138 00:08:19,340 --> 00:08:21,340 So, we do MD zero, that's the base address in 100. 139 00:08:21,760 --> 00:08:25,360 I hit go and we're dumping the memory as ASCII to the screen. 140 00:08:25,660 --> 00:08:28,820 So, all we need to do now is capture that into a file. 141 00:08:28,920 --> 00:08:31,120 And there's a little Python script that takes that file 142 00:08:31,120 --> 00:08:32,700 because you've got all that fluff that we don't need 143 00:08:32,700 --> 00:08:34,680 and then it puts it into a binary file. 144 00:08:34,940 --> 00:08:37,380 It takes about nine hours for a 16 meg chip 145 00:08:37,380 --> 00:08:39,040 because you've got a slow connection and all this. 146 00:08:39,140 --> 00:08:40,940 But it gives us access to the firmware. 147 00:08:41,520 --> 00:08:43,780 Once we've got access to the firmware, we can unpack it. 148 00:08:43,880 --> 00:08:47,600 We can see what the hash password is and we can crack that and get access to the device. 149 00:08:49,340 --> 00:08:50,560 So, we start looking at this in more detail. 150 00:08:51,160 --> 00:08:52,960 So, what I'm going to do is I'm just going to reboot it again. 151 00:08:53,740 --> 00:08:54,980 This does take a second. 152 00:08:55,580 --> 00:08:57,340 So, we're just going to get it back up and running. 153 00:08:58,000 --> 00:09:00,700 And we found quite quickly it was running Telnet. 154 00:09:00,880 --> 00:09:03,320 It was running a web interface. 155 00:09:03,900 --> 00:09:08,440 It was running RTSP for the video and a few other bits and bobs. 156 00:09:09,480 --> 00:09:10,680 We've got the Telnet password. 157 00:09:10,960 --> 00:09:14,140 It was literally sat there in the Mirai creds. 158 00:09:14,160 --> 00:09:16,060 So, it's root XC3511. 159 00:09:16,700 --> 00:09:18,520 Just give this a minute to boot when it beeps. 160 00:09:18,520 --> 00:09:19,500 It will be done. 161 00:09:23,420 --> 00:09:25,780 I should make polite conversation now, shouldn't I? 162 00:09:26,820 --> 00:09:28,780 So, it does take a second to come back up again. 163 00:09:32,680 --> 00:09:33,560 Once it beeps. 164 00:09:38,720 --> 00:09:39,340 There we go. 165 00:09:39,580 --> 00:09:43,020 So, now I can log in as root XC3511. 166 00:09:43,920 --> 00:09:46,240 And we've got a root shell on this device. 167 00:09:46,760 --> 00:09:48,320 So, it's just Telnet straight into it. 168 00:09:48,520 --> 00:09:49,520 They don't document it. 169 00:09:49,660 --> 00:09:52,240 I mean, people don't Telnet into their DVRs. 170 00:09:52,360 --> 00:09:53,800 You can't modify the file system. 171 00:09:53,920 --> 00:09:55,020 There's nothing useful you can do. 172 00:09:55,080 --> 00:09:56,640 But it lets us examine how it works. 173 00:09:56,960 --> 00:10:00,120 So, what we found was a lot of vendors, when they found out about Mirai, 174 00:10:00,240 --> 00:10:01,600 was they shut Telnet off. 175 00:10:01,860 --> 00:10:03,300 That sounds like a good idea, doesn't it? 176 00:10:03,340 --> 00:10:04,300 Telnet should just go. 177 00:10:04,380 --> 00:10:05,540 So, they stopped running Telnet. 178 00:10:06,540 --> 00:10:10,060 But the device has also got another port open on it, which is 9527. 179 00:10:12,620 --> 00:10:13,420 So, 9527. 180 00:10:15,080 --> 00:10:17,380 And we've got this quite curious console here. 181 00:10:17,380 --> 00:10:19,460 Now, it's asking for a username and a password. 182 00:10:19,660 --> 00:10:22,500 And it's not the root XC3511 that we saw before. 183 00:10:22,600 --> 00:10:25,140 It's the username and password that the user sets for the web interface, 184 00:10:25,460 --> 00:10:27,980 which is going to be admin and blank by default. 185 00:10:28,700 --> 00:10:31,640 So, on nearly all of these devices, admin and blank. 186 00:10:31,840 --> 00:10:34,600 And we've now got this kind of test console on the device. 187 00:10:35,380 --> 00:10:36,640 Again, we type shell. 188 00:10:37,660 --> 00:10:43,140 And then we've got access to run commands as we want. 189 00:10:43,240 --> 00:10:44,640 So, we just catted ETC password. 190 00:10:45,000 --> 00:10:47,360 So, again, even if they've shut Telnet, we've got this 191 00:10:47,380 --> 00:10:48,460 other route into the device. 192 00:10:48,660 --> 00:10:51,500 And you can't close this port off on this device. 193 00:10:51,700 --> 00:10:54,060 It doesn't have IP tables, so you can't firewall it. 194 00:10:54,160 --> 00:10:56,440 And this is part of the big binary that runs on it. 195 00:10:56,820 --> 00:10:59,920 So, the question is, how would we get that password if someone had changed it? 196 00:11:00,100 --> 00:11:03,060 Well, it gets even better because this thing has got unauthenticated 197 00:11:03,060 --> 00:11:06,880 directory traversal allowing us to access all of the files on the device. 198 00:11:07,520 --> 00:11:10,200 So, I'm just going to jump through to here. 199 00:11:13,020 --> 00:11:15,880 So, it stores your hashed password for the web interface. 200 00:11:16,200 --> 00:11:17,280 And, of course, just with a simple 201 00:11:17,280 --> 00:11:19,600 get request with a couple of dot dots there. 202 00:11:20,060 --> 00:11:21,160 Give that a second. 203 00:11:21,940 --> 00:11:23,620 It runs a little bit slowly. 204 00:11:23,940 --> 00:11:28,000 And there at the bottom there, you've got the admin password hashed and dumped. 205 00:11:28,640 --> 00:11:31,760 So, this is absolutely and completely broken. 206 00:11:32,040 --> 00:11:33,320 There's just so much wrong with it. 207 00:11:33,480 --> 00:11:36,180 But still, even deeper, it gets worse. 208 00:11:36,540 --> 00:11:39,920 So, via the web interface, how many are exposed to these? 209 00:11:40,160 --> 00:11:41,140 Hundreds of thousands. 210 00:11:41,360 --> 00:11:44,180 Yeah, I think we've clocked about 720,000 on Showdown. 211 00:11:45,180 --> 00:11:47,080 It has unauthenticated 212 00:11:47,080 --> 00:11:48,940 buffer overflow via the web interface. 213 00:11:49,600 --> 00:11:51,580 So, at the moment, we can ping it. 214 00:11:51,600 --> 00:11:52,420 We can do what we want. 215 00:11:52,580 --> 00:11:56,080 But we simply make a request with a long string. 216 00:11:56,280 --> 00:12:03,160 And initially, we thought this was just going to be a denial of service. 217 00:12:03,360 --> 00:12:06,560 But it turns out that you can use it for remote code execution as well. 218 00:12:06,820 --> 00:12:11,320 So, we're just going to telnet into the device just so we can monitor what's going on. 219 00:12:12,200 --> 00:12:13,100 So, I run PS. 220 00:12:13,400 --> 00:12:15,240 And you can see there's two processes there. 221 00:12:15,320 --> 00:12:16,560 DVR helper and Sophia. 222 00:12:17,080 --> 00:12:18,240 This is a huge binary. 223 00:12:18,360 --> 00:12:19,780 It does that port 9527. 224 00:12:20,040 --> 00:12:20,900 It does the web interface. 225 00:12:21,180 --> 00:12:22,540 It processes the video. 226 00:12:22,660 --> 00:12:23,620 It does face detection. 227 00:12:23,860 --> 00:12:24,900 All in one binary. 228 00:12:25,020 --> 00:12:26,420 One monolithic mass. 229 00:12:27,700 --> 00:12:31,880 So, by just sending this get request like that, we come back here. 230 00:12:32,020 --> 00:12:32,760 Run PS again. 231 00:12:32,980 --> 00:12:34,700 And you can see that Sophia's vanished. 232 00:12:35,000 --> 00:12:38,380 So, now your CCTV DVR has stopped recording. 233 00:12:38,920 --> 00:12:40,680 So, just by exposing it to the web, it's died. 234 00:12:40,900 --> 00:12:42,840 We've also got control of the program counter. 235 00:12:43,280 --> 00:12:45,980 Of course, they're not turned on ASLR or anything like that. 236 00:12:46,060 --> 00:12:46,940 So, it's not particular. 237 00:12:46,940 --> 00:12:48,200 It's particularly hard to exploit that. 238 00:12:48,340 --> 00:12:49,600 There are a couple of quirks. 239 00:12:50,320 --> 00:12:54,160 But yeah, all in all, these devices are absolutely ruined. 240 00:12:54,520 --> 00:12:55,340 They are terrible. 241 00:12:55,440 --> 00:13:01,020 So, we've got remote code execution on nearly three quarters of a million DVRs on the public internet. 242 00:13:01,220 --> 00:13:04,840 If you thought Mirai was bad in the first place, this is just terrible. 243 00:13:05,120 --> 00:13:06,280 It also made me chuckle. 244 00:13:06,300 --> 00:13:10,040 You can also restart the telnet daemon through the console on 9527. 245 00:13:10,380 --> 00:13:15,720 So, even vendors that have fixed the firmware and disabled telnet, you can re-enable it and start Mirai all over again. 246 00:13:15,880 --> 00:13:16,800 This is just nuts. 247 00:13:19,420 --> 00:13:22,260 So, all of the chips are made by a company called HiSilicon. 248 00:13:22,280 --> 00:13:26,640 And it's really difficult to write all of the code that processes video, does face detection and so on. 249 00:13:26,780 --> 00:13:28,820 So, there's a company that we mentioned earlier called Zhongmai. 250 00:13:29,020 --> 00:13:31,220 And what they do is they produce these binaries. 251 00:13:31,340 --> 00:13:33,980 But people want to put their own logos onto it and things like that. 252 00:13:34,220 --> 00:13:36,880 So, what they do is they have this tool called MakePack. 253 00:13:36,900 --> 00:13:39,020 And we found this wiki completely open to the internet. 254 00:13:39,160 --> 00:13:42,880 And it allows you to do these things like change the logo, change passwords and so on. 255 00:13:43,000 --> 00:13:45,400 So, this kind of pulled everything together and told us why. 256 00:13:45,400 --> 00:13:50,660 We'd found 30, 40 different DVRs that had exactly the same vulnerability on it. 257 00:13:50,920 --> 00:13:51,960 Now, this is quite amusing. 258 00:13:52,660 --> 00:13:58,340 On every single one of these we've looked at so far, they've had this same message. 259 00:13:58,680 --> 00:14:04,560 So, if you go to the IP of it and you type in er.htm, all of them have this message. 260 00:14:04,700 --> 00:14:07,680 The machine is suspected to be using a pirated program of Zhongmai. 261 00:14:07,980 --> 00:14:10,580 So, we don't know, has anyone actually bought this software? 262 00:14:10,740 --> 00:14:13,420 Or are these big names actually pirating this software? 263 00:14:13,540 --> 00:14:14,580 We've just got no idea. 264 00:14:20,660 --> 00:14:21,880 Just to point out there. 265 00:14:21,960 --> 00:14:25,180 So, we saw when Andrew made the request, he was looking for the capital A. 266 00:14:25,260 --> 00:14:28,380 Of course, the ASCII representation of hex of capital A is 41. 267 00:14:28,740 --> 00:14:29,460 And there we go. 268 00:14:29,780 --> 00:14:33,080 GDB, scrape memory, and there we see everything's overflowing. 269 00:14:33,300 --> 00:14:33,700 Fantastic. 270 00:14:33,920 --> 00:14:34,960 Control of the program counter. 271 00:14:35,160 --> 00:14:35,960 And we've got code execution. 272 00:14:36,340 --> 00:14:36,940 Get in. 273 00:14:37,380 --> 00:14:39,540 We've got absolutely no idea what this thing is. 274 00:14:39,600 --> 00:14:41,380 This is another one of their apps called Look at the Mail. 275 00:14:41,540 --> 00:14:43,020 And we really don't know what it's for. 276 00:14:44,020 --> 00:14:45,520 We have no idea. 277 00:14:47,180 --> 00:14:48,240 Anyway, moving on a bit. 278 00:14:49,800 --> 00:14:52,780 What we took from this is that Mirai was beautifully simple. 279 00:14:52,980 --> 00:14:58,960 It was amazing that such a simple root Telnet credential issue could take down very large websites. 280 00:14:59,520 --> 00:15:04,620 But what got us was the fact that because it was so simple, a lot of other really important vulnerabilities were missed. 281 00:15:04,860 --> 00:15:06,780 So, what we tried to do is try and fill those holes. 282 00:15:07,340 --> 00:15:11,040 Now, Zhongmai fixed the initial problem, but they didn't fix it properly. 283 00:15:11,040 --> 00:15:13,560 So, it's very easy just to recreate Mirai all over again. 284 00:15:13,800 --> 00:15:15,140 And, ah, yes, yeah. 285 00:15:15,380 --> 00:15:19,120 There's a huge botnet that's got potential to be exploited out there right now. 286 00:15:19,400 --> 00:15:20,040 It's not good. 287 00:15:20,440 --> 00:15:21,400 It's really quite nasty. 288 00:15:22,660 --> 00:15:23,060 Right. 289 00:15:23,200 --> 00:15:24,080 We're going to move on now. 290 00:15:24,220 --> 00:15:28,880 If anyone isn't comfortable with what we're about to talk about, we are going to be talking about adult toys. 291 00:15:29,120 --> 00:15:31,180 So, if you're not comfortable with that, please don't. 292 00:15:31,180 --> 00:15:32,020 Please just leave the room. 293 00:15:32,500 --> 00:15:33,680 Anyway, we're going to move on. 294 00:15:34,100 --> 00:15:38,260 This is going to explain to you why my Amazon recommendations are absolutely screwed. 295 00:15:38,800 --> 00:15:38,820 . 296 00:15:39,680 --> 00:15:44,080 If you buy adult toys on Amazon, you get some really weird recommendations. 297 00:15:44,600 --> 00:15:46,220 Some other things that we learned as well. 298 00:15:47,140 --> 00:15:47,580 Yeah. 299 00:15:47,680 --> 00:15:54,160 We're going to show you how you can use all the stuff that we showed you on DVRs to get a shell on a dildo. 300 00:15:54,800 --> 00:15:55,240 Anyway. 301 00:15:56,060 --> 00:16:01,720 Now, what I will say, as security researchers, this is the first time we've really done any work on adult toys. 302 00:16:02,040 --> 00:16:04,980 And there are a couple of really important things that we learned along the way. 303 00:16:05,420 --> 00:16:08,440 The first problem is that if you publish security research, 304 00:16:08,440 --> 00:16:11,420 on your website, you get a lot of hits. 305 00:16:11,940 --> 00:16:14,620 We got 77,000 hits on our blog in an hour. 306 00:16:14,720 --> 00:16:17,040 And we accidentally dosed our own website with a dildo story. 307 00:16:17,660 --> 00:16:17,900 . 308 00:16:19,640 --> 00:16:25,800 One of the other issues as well is that when you're blogging about stories that involve this, 309 00:16:25,900 --> 00:16:30,180 the way that Twitter will pick up the first image from a link that you embed, 310 00:16:30,380 --> 00:16:35,120 so if you post a blog, I think actually it was Motherboard Vice published this. 311 00:16:35,340 --> 00:16:37,860 And Twitter picked up the wrong image from their blog. 312 00:16:37,860 --> 00:16:41,920 So Motherboard Vice tweeted a picture of a woman's cervix, which was kind of bad. 313 00:16:42,560 --> 00:16:44,860 You need to be really careful when you're dealing with this stuff. 314 00:16:46,360 --> 00:16:50,520 This is the whole area of what's known as teledildonics, which was coined about 40 years ago. 315 00:16:50,680 --> 00:16:56,320 The idea of augmented reality using smart toys to improve experiences. 316 00:16:56,660 --> 00:16:58,000 It's a scary place. 317 00:16:58,440 --> 00:17:01,460 I want to start at the very beginning with a story we published a couple of years ago. 318 00:17:01,540 --> 00:17:03,420 This is the Lovance Nora. 319 00:17:04,680 --> 00:17:07,180 The idea is you have a smart app. 320 00:17:07,180 --> 00:17:08,400 It connects the app over Bluetooth. 321 00:17:08,800 --> 00:17:13,000 And then whoever you want to connect to has one of these and maybe the other part of this. 322 00:17:13,280 --> 00:17:16,760 And then you can have a remote control video session. 323 00:17:17,080 --> 00:17:20,080 And people can control your toy and vice versa. 324 00:17:20,360 --> 00:17:22,340 I didn't realize you can actually have group sessions as well. 325 00:17:22,480 --> 00:17:23,100 I was like, wow, okay. 326 00:17:23,740 --> 00:17:25,260 Do you want to just throw out the APK, Andrew? 327 00:17:25,360 --> 00:17:25,440 Yeah. 328 00:17:25,960 --> 00:17:29,060 We started having a bit of a poke around, having a play to see what we could find with it. 329 00:17:29,240 --> 00:17:33,500 The first thing we discovered that it can render stills from your video feed. 330 00:17:33,720 --> 00:17:36,960 And when it goes through the process of rendering from a bitmap to a JPEG, 331 00:17:37,180 --> 00:17:40,860 it creates a temporary image and writes it to slash SD card in Android. 332 00:17:41,060 --> 00:17:44,140 That's a really, really bad place to put temporary image files. 333 00:17:44,420 --> 00:17:44,860 Yeah. 334 00:17:45,040 --> 00:17:46,020 That's not so good. 335 00:17:46,200 --> 00:17:48,560 The other issue we found, this isn't really so much of a problem. 336 00:17:48,640 --> 00:17:51,620 We found a lot of pairing issues with all of these smart sex toys we looked at. 337 00:17:52,020 --> 00:17:54,680 It has a default Bluetooth pin of four zeros. 338 00:17:55,400 --> 00:17:59,820 The good news is, though, is it's only in a pairable state for about a minute after you power on. 339 00:17:59,920 --> 00:18:04,440 So, yes, you could in theory take remote control of someone's sex toy over Bluetooth. 340 00:18:04,440 --> 00:18:06,840 But it's probably a little impractical to do so. 341 00:18:08,400 --> 00:18:10,800 I also want to tell you about a story. 342 00:18:10,940 --> 00:18:13,440 A new guy started with us three weeks ago now. 343 00:18:13,520 --> 00:18:13,540 Yeah. 344 00:18:13,700 --> 00:18:17,740 And one of my colleagues was working on one of the smart sex toys. 345 00:18:17,860 --> 00:18:20,860 He was working on close up, taking the hardware off, getting the firmware out of it. 346 00:18:20,980 --> 00:18:24,880 And he turns around and out loud in the office goes, oh, I've got a smart butt plug. 347 00:18:27,320 --> 00:18:30,000 At which point everything goes very, very quiet. 348 00:18:30,500 --> 00:18:32,580 Everyone turns to look at him and goes, Alex. 349 00:18:34,440 --> 00:18:35,540 Is this something you want to share with us? 350 00:18:35,560 --> 00:18:35,960 Oh, no, no. 351 00:18:36,000 --> 00:18:36,760 I got it for research. 352 00:18:36,960 --> 00:18:37,320 Really? 353 00:18:37,540 --> 00:18:37,820 Okay. 354 00:18:38,040 --> 00:18:39,720 He actually shared it with us as well. 355 00:18:39,740 --> 00:18:40,260 This is it. 356 00:18:40,420 --> 00:18:41,540 This is not one we bought. 357 00:18:42,760 --> 00:18:44,720 We got his butt plug anyway. 358 00:18:47,400 --> 00:18:50,900 So most of the toys that we look at had pairing issues with Bluetooth. 359 00:18:52,660 --> 00:18:56,040 Now, if we think about the risk profile, I don't think it's particularly significant. 360 00:18:56,460 --> 00:18:58,940 Because they're generally local RF attacks. 361 00:18:59,120 --> 00:19:01,400 So you've got to be physically within RF range of somebody. 362 00:19:01,560 --> 00:19:04,120 So I don't think these are particularly significant. 363 00:19:04,120 --> 00:19:10,220 But it's still worth pointing out, you can actually take over and hijack someone's butt plug. 364 00:19:10,400 --> 00:19:12,520 Because the BLE pairing process is a bit screwed. 365 00:19:12,680 --> 00:19:13,700 It just pairs without a pin. 366 00:19:13,860 --> 00:19:17,360 So if anyone's within Bluetooth range, you can hijack their butt plug. 367 00:19:21,580 --> 00:19:23,680 It's also worth noting, we found another bug as well. 368 00:19:23,800 --> 00:19:27,860 Within the FAQ, the vendors often state, look, we encrypt everything. 369 00:19:28,100 --> 00:19:28,920 It's supposed to be secured. 370 00:19:29,080 --> 00:19:29,760 It's great. 371 00:19:29,940 --> 00:19:31,320 And that gives you lots of confidence. 372 00:19:31,420 --> 00:19:33,960 Unfortunately, some of the chats we discovered was in plain text. 373 00:19:33,960 --> 00:19:35,160 Which wasn't so good. 374 00:19:35,280 --> 00:19:39,700 So it was being stored and processed in a way that really wasn't very good. 375 00:19:39,820 --> 00:19:41,460 Now, we disclosed this to Lovance. 376 00:19:41,680 --> 00:19:43,220 And we did it privately. 377 00:19:43,400 --> 00:19:44,680 And they came back and said some stuff. 378 00:19:45,140 --> 00:19:48,760 But what was really weird is they've got a new version of the app. 379 00:19:48,960 --> 00:19:50,100 Which is called Body Chat. 380 00:19:50,240 --> 00:19:51,120 Which does SSL. 381 00:19:51,160 --> 00:19:51,680 It's really secure. 382 00:19:51,820 --> 00:19:52,340 It's really good. 383 00:19:52,500 --> 00:19:55,380 It's only some old users of the app that have this problem. 384 00:19:55,480 --> 00:19:56,260 The old wearables app. 385 00:19:56,360 --> 00:20:00,800 I don't understand why they don't just pull the old vulnerable app and force everyone onto a new one. 386 00:20:00,840 --> 00:20:01,400 It's really weird. 387 00:20:01,640 --> 00:20:02,740 Very, very odd discussion. 388 00:20:03,140 --> 00:20:04,580 We've still got some stuff to work on. 389 00:20:04,640 --> 00:20:06,700 The next thing we want to do is pull the firmware off the butt plug. 390 00:20:06,820 --> 00:20:08,220 Unfortunately, Alex says he wants it back. 391 00:20:08,860 --> 00:20:09,220 Okay. 392 00:20:09,360 --> 00:20:09,940 Fair enough. 393 00:20:10,200 --> 00:20:12,160 He doesn't know where that's been in the last couple of days. 394 00:20:12,980 --> 00:20:13,340 Anyway. 395 00:20:14,360 --> 00:20:15,880 It's also worthwhile noting as well. 396 00:20:15,980 --> 00:20:20,580 If you want to do some research on anything that's smart, go and use the FCC website. 397 00:20:20,980 --> 00:20:24,580 Because you can pull internal photographs and get the chipsets from them. 398 00:20:24,680 --> 00:20:25,360 It's really good. 399 00:20:25,560 --> 00:20:27,300 So on that one we found the TX and RX. 400 00:20:27,540 --> 00:20:28,720 It's really straightforward to use. 401 00:20:29,480 --> 00:20:31,960 It saves you a lot of time when you're reverse engineering. 402 00:20:31,960 --> 00:20:33,880 Because you don't have to buy the product first. 403 00:20:34,000 --> 00:20:37,020 You can go and use the FCC website and it's all on there for you. 404 00:20:37,140 --> 00:20:40,320 So this afternoon we might have a bit of a go at this and see what we can do. 405 00:20:40,380 --> 00:20:41,700 See if we can pull the firmware off it. 406 00:20:42,720 --> 00:20:44,720 Another piece of research. 407 00:20:44,860 --> 00:20:45,480 This wasn't us. 408 00:20:45,580 --> 00:20:47,040 This is a guy called Alberto Segura. 409 00:20:47,140 --> 00:20:48,280 He published it three weeks ago. 410 00:20:48,460 --> 00:20:50,220 We had no idea it was going out there. 411 00:20:50,560 --> 00:20:53,160 It was published a day before we did a talk about this. 412 00:20:53,400 --> 00:20:55,120 There is also a new version of this. 413 00:20:55,140 --> 00:20:56,020 The Camgirl version. 414 00:20:56,140 --> 00:20:57,340 Which is interesting. 415 00:20:57,660 --> 00:21:01,940 And he looked at the Chrome plug-in that the user spoke about. 416 00:21:01,960 --> 00:21:04,100 And discovered a bunch of security flaws. 417 00:21:04,220 --> 00:21:07,080 It was also really dodgy the way that you actually installed it. 418 00:21:07,160 --> 00:21:07,440 Yes. 419 00:21:07,460 --> 00:21:08,600 So this is absolutely brilliant. 420 00:21:08,660 --> 00:21:12,700 On the Lovense website what they actually recommend is you download their own build of Chromium. 421 00:21:12,820 --> 00:21:14,300 With the plug-in built into it. 422 00:21:14,340 --> 00:21:15,280 It's unsigned. 423 00:21:15,320 --> 00:21:17,620 And you need to turn off your anti-virus to install it. 424 00:21:17,940 --> 00:21:18,940 Now this doesn't. 425 00:21:18,960 --> 00:21:23,020 The one piece of software on your computer you want to be signed and secure is your browser. 426 00:21:23,580 --> 00:21:25,200 And yet they're suggesting you don't. 427 00:21:25,580 --> 00:21:29,100 Now what Alberto found is that there is XSS all over the place. 428 00:21:29,260 --> 00:21:31,880 And also you've got the ability to take remote control. 429 00:21:31,960 --> 00:21:33,720 Using the API of someone's sex toy. 430 00:21:34,220 --> 00:21:36,460 And you can also carry out denial of service attacks. 431 00:21:36,660 --> 00:21:38,060 So you can knock the Camgirl offline. 432 00:21:38,360 --> 00:21:40,460 But you have to know their email address. 433 00:21:41,060 --> 00:21:42,740 Which is going to be pretty tough to find. 434 00:21:42,800 --> 00:21:42,960 Right? 435 00:21:43,120 --> 00:21:47,060 Except their API has got a call that allows you to enumerate their email address. 436 00:21:47,300 --> 00:21:49,260 And enumerate whether they're a Camgirl or not. 437 00:21:49,780 --> 00:21:50,220 Wow. 438 00:21:51,220 --> 00:21:52,380 How useful was that? 439 00:21:53,400 --> 00:21:56,500 You can also take control of the device through the API. 440 00:21:56,600 --> 00:21:59,580 Again all you have to know is the email address of the user I believe. 441 00:22:00,000 --> 00:22:01,740 Some research that was published last year. 442 00:22:01,740 --> 00:22:02,760 You might remember WeVibe. 443 00:22:02,880 --> 00:22:04,580 They did a main stage talk in DEFCON. 444 00:22:04,680 --> 00:22:07,160 There was a search called Follower and another one called GotMilk. 445 00:22:07,240 --> 00:22:09,100 They did a really cool reverse on WeVibe. 446 00:22:09,120 --> 00:22:15,420 And found all sorts of issues to do with the way that the WeVibe device was collecting excessive information. 447 00:22:15,940 --> 00:22:19,820 And what was really interesting is over the last year there have been various class actions. 448 00:22:19,900 --> 00:22:21,340 One of which resulted in a settlement. 449 00:22:21,520 --> 00:22:24,240 And I believe the settlement was for 3.7 million Canadian. 450 00:22:24,540 --> 00:22:26,180 Which was used to compensate users. 451 00:22:26,620 --> 00:22:29,000 They've just been taking too much data. 452 00:22:29,320 --> 00:22:30,060 But what freaked me out. 453 00:22:30,060 --> 00:22:30,900 If you can pop the slides up. 454 00:22:30,980 --> 00:22:31,440 We had a look. 455 00:22:31,720 --> 00:22:36,380 So this is an organization, a business that's just been taken to task over excessive data collection. 456 00:22:36,700 --> 00:22:39,620 And we had a quick look at the permissions on the Android app. 457 00:22:39,720 --> 00:22:43,980 And even today it's still collecting network based location. 458 00:22:44,460 --> 00:22:44,900 Wow. 459 00:22:45,780 --> 00:22:49,160 What do you have to do to convince these companies to be a bit more careful? 460 00:22:49,440 --> 00:22:51,040 They've just settled out of court. 461 00:22:51,340 --> 00:22:53,360 Yet they're still collecting location data. 462 00:22:53,440 --> 00:22:53,720 Why? 463 00:22:53,940 --> 00:22:54,440 That's crazy. 464 00:22:55,480 --> 00:22:56,540 Another device we found. 465 00:22:56,600 --> 00:22:57,940 This is the Leelo which is over here. 466 00:22:59,000 --> 00:22:59,960 A stimulator. 467 00:23:00,020 --> 00:23:05,380 And again, complete lack of pairing security which isn't so good. 468 00:23:05,600 --> 00:23:08,000 We're going to be having a go at the controller later today. 469 00:23:08,440 --> 00:23:10,860 It uses JTAG spy-by-wire. 470 00:23:11,080 --> 00:23:12,100 Nice news to use. 471 00:23:12,520 --> 00:23:14,800 You can get the screenshots from FCC. 472 00:23:15,200 --> 00:23:17,240 And you'll see there's VCC, TX and RX. 473 00:23:17,380 --> 00:23:20,000 So we've got a good chance of getting the firmware off there. 474 00:23:20,740 --> 00:23:21,720 This is a bit odd. 475 00:23:22,480 --> 00:23:25,780 This is a Kiru Onyx. 476 00:23:26,040 --> 00:23:26,980 This is a flashlight. 477 00:23:28,860 --> 00:23:30,080 We borrowed from my bag. 478 00:23:30,200 --> 00:23:31,620 I'm sure you all know what one of these things does. 479 00:23:32,200 --> 00:23:33,240 And actually not too bad. 480 00:23:33,360 --> 00:23:34,620 We didn't find too much wrong with it. 481 00:23:34,640 --> 00:23:36,420 Although we did discover that the pairing link, 482 00:23:36,480 --> 00:23:38,320 so if you share this link with somebody else, 483 00:23:38,340 --> 00:23:40,780 this is how you can set up a session. 484 00:23:40,960 --> 00:23:43,360 The link never expires as far as we can make out. 485 00:23:43,440 --> 00:23:45,580 So don't write down that one because that's his flashlight, right? 486 00:23:47,760 --> 00:23:48,700 Yeah, we won't go into that. 487 00:23:48,840 --> 00:23:50,040 But again, what are the issues here? 488 00:23:50,100 --> 00:23:51,220 So we've got a pairing pin problem. 489 00:23:51,400 --> 00:23:53,340 Again, it's really low risk. 490 00:23:53,520 --> 00:23:55,180 But actually I'm more worried about that link. 491 00:23:55,620 --> 00:23:56,580 It doesn't expire. 492 00:23:56,580 --> 00:23:57,580 That's not good. 493 00:23:59,620 --> 00:24:01,800 What I want to point out with all this is that 494 00:24:02,260 --> 00:24:06,360 there is not much in terms of interactivity with the toy. 495 00:24:06,440 --> 00:24:07,060 This is good. 496 00:24:08,120 --> 00:24:09,480 Because if there aren't many sensors, 497 00:24:09,640 --> 00:24:11,800 there isn't much data gathering going on in the toy itself. 498 00:24:12,200 --> 00:24:12,780 That's good. 499 00:24:13,500 --> 00:24:16,380 Because it means that compromising these devices 500 00:24:16,380 --> 00:24:17,340 isn't that significant. 501 00:24:18,200 --> 00:24:20,360 It's not involving anything more than 502 00:24:20,360 --> 00:24:22,400 is it buzzing? Is it not? 503 00:24:22,580 --> 00:24:23,560 How is it buzzing? 504 00:24:23,700 --> 00:24:24,760 So that's not so serious. 505 00:24:24,760 --> 00:24:27,600 But as I'm sure you've seen from recent media coverage, 506 00:24:28,780 --> 00:24:30,520 smart sex dolls are on their way. 507 00:24:30,640 --> 00:24:31,920 This is one from a company called Real Doll. 508 00:24:32,100 --> 00:24:36,600 And again, we've got jaws, ears, eyes, 509 00:24:37,180 --> 00:24:38,880 all collecting much more data. 510 00:24:39,140 --> 00:24:40,480 Now, I have to say, 511 00:24:40,500 --> 00:24:43,000 it does worry me a bit when we start to see sex dolls. 512 00:24:43,120 --> 00:24:43,920 Will they become Satan? 513 00:24:44,080 --> 00:24:45,580 Will they actually realize what's about to come? 514 00:24:45,680 --> 00:24:46,380 I don't know if you saw this, 515 00:24:46,440 --> 00:24:48,160 the security robot that committed suicide. 516 00:24:49,080 --> 00:24:50,840 I think the sex dolls are probably going to do 517 00:24:50,840 --> 00:24:52,340 something very similar when they realize what's coming. 518 00:24:52,420 --> 00:24:52,780 Don't you think? 519 00:24:53,920 --> 00:24:55,260 So I want to move on to now, 520 00:24:55,440 --> 00:24:56,860 which is a story we published 521 00:24:56,860 --> 00:24:58,440 about three, four months ago. 522 00:24:58,720 --> 00:25:02,240 Which was the first sex toy we found 523 00:25:02,240 --> 00:25:04,260 with interesting feedback. 524 00:25:04,620 --> 00:25:06,160 Which was the SiMi, 525 00:25:06,360 --> 00:25:07,080 or the See Me. 526 00:25:07,180 --> 00:25:08,460 I'm not quite sure how you're supposed to say it. 527 00:25:08,520 --> 00:25:11,100 But it's a vibrator camera endoscope 528 00:25:11,100 --> 00:25:12,760 with stuff in the end. 529 00:25:12,820 --> 00:25:15,600 And it's really quite scary. 530 00:25:16,160 --> 00:25:17,780 We did a bunch of research on this 531 00:25:17,780 --> 00:25:20,960 and found a stack of quite worrying security holds. 532 00:25:21,300 --> 00:25:22,760 The first one is that it works 533 00:25:22,760 --> 00:25:24,400 over Wi-Fi. So all the rest of the toys 534 00:25:24,400 --> 00:25:26,280 generally have a Bluetooth. This one is Wi-Fi. 535 00:25:26,540 --> 00:25:28,420 And unlike most IoT devices, 536 00:25:28,600 --> 00:25:30,520 which only act as an access point 537 00:25:30,520 --> 00:25:31,700 until you've configured it, 538 00:25:32,200 --> 00:25:33,780 this stays as an access point. 539 00:25:33,940 --> 00:25:35,860 And of course that means there's some interesting things you can do with it. 540 00:25:35,900 --> 00:25:38,680 The first one is that as an access point it shows up on Wiggle. 541 00:25:38,760 --> 00:25:40,100 So you can actually geolocate 542 00:25:41,120 --> 00:25:41,840 these devices. 543 00:25:42,180 --> 00:25:44,520 Now, in fairness, we only found two. 544 00:25:47,660 --> 00:25:48,900 And one of them I think 545 00:25:48,900 --> 00:25:50,740 was in a sex shop in the Akihabara district 546 00:25:50,740 --> 00:25:51,640 of Tokyo. 547 00:25:51,640 --> 00:25:53,340 But yes, you can geolocate 548 00:25:53,340 --> 00:25:55,700 sex toys, which is just a bit freaky. 549 00:25:56,380 --> 00:25:57,700 Yeah, that makes me feel 550 00:25:57,700 --> 00:25:58,200 very uncomfortable. 551 00:25:59,300 --> 00:26:01,380 We also then started looking at the Android app. 552 00:26:01,500 --> 00:26:03,140 And this is where things got really weird. 553 00:26:04,040 --> 00:26:06,000 Can you flick up the APK for us, Andrew? 554 00:26:06,200 --> 00:26:06,480 Yep. 555 00:26:06,920 --> 00:26:07,320 So, 556 00:26:09,280 --> 00:26:11,820 we pulled the APK apart and had a bit of a look. 557 00:26:11,920 --> 00:26:13,680 And discovered that it had 558 00:26:13,680 --> 00:26:15,800 a lot of classes that dealt 559 00:26:15,800 --> 00:26:17,200 with a SkyViper drone. 560 00:26:17,840 --> 00:26:19,500 And we realized after a while that 561 00:26:19,500 --> 00:26:21,560 actually what had been happening is it looks like 562 00:26:21,640 --> 00:26:23,500 the dildo manufacturer had simply 563 00:26:23,500 --> 00:26:25,200 used the code from a 564 00:26:25,860 --> 00:26:26,740 camera drone 565 00:26:27,640 --> 00:26:29,200 to control their dildo. 566 00:26:31,260 --> 00:26:33,380 And there are classes in there that deal with 567 00:26:33,380 --> 00:26:34,120 propeller speed. 568 00:26:36,620 --> 00:26:38,960 It's just crazy. 569 00:26:39,200 --> 00:26:41,420 It's got a static pre-share key, so you can geolocate 570 00:26:41,420 --> 00:26:43,280 these. The key can't be changed 571 00:26:43,280 --> 00:26:45,060 as far as I know. The key is 572 00:26:45,060 --> 00:26:47,040 8-8, which is just brilliant. 573 00:26:47,300 --> 00:26:49,280 I actually had a chat with the guys at SkyViper 574 00:26:49,280 --> 00:26:51,460 who were quite surprised that code that 575 00:26:51,460 --> 00:26:53,500 they used in their drone was being reused 576 00:26:53,500 --> 00:26:55,500 in a dildo. I don't think they owned the IP 577 00:26:55,500 --> 00:26:57,040 on the code, which is why that happened. Although 578 00:26:57,040 --> 00:26:59,440 their later drones, it's their own IP and they have control 579 00:26:59,440 --> 00:27:01,460 over it. So, that was quite interesting. 580 00:27:02,300 --> 00:27:03,220 We also found 581 00:27:03,220 --> 00:27:05,520 within the APK, a hard-coded IP 582 00:27:05,520 --> 00:27:08,640 address, hard-coded port, 192.168.1.1, 583 00:27:08,660 --> 00:27:09,340 port 80. 584 00:27:09,440 --> 00:27:11,620 Andrew, would you like to see if you can open it up? 585 00:27:12,500 --> 00:27:13,580 Unfortunately, it's rebooted. 586 00:27:14,680 --> 00:27:15,680 The worst thing about, 587 00:27:15,820 --> 00:27:17,620 well, maybe not the worst thing about this, it reboots 588 00:27:17,620 --> 00:27:19,240 all of the time. So, we're just waiting for the AP 589 00:27:19,240 --> 00:27:21,300 to come back up on it, and then we'll show 590 00:27:21,300 --> 00:27:23,000 you how you kind of get onto it. So, yeah, 591 00:27:23,060 --> 00:27:25,220 it's got default credentials of admin and blank 592 00:27:25,220 --> 00:27:27,280 to log into the web interface. So, once you're 593 00:27:27,280 --> 00:27:29,340 on the Wi-Fi with all the 8s, then you're 594 00:27:29,340 --> 00:27:31,160 onto it, you can control it as you would 595 00:27:31,160 --> 00:27:33,400 normally. And then, 596 00:27:33,440 --> 00:27:35,380 you can start looking through the camera. 597 00:27:37,340 --> 00:27:39,700 It kind of gets more interesting, though, 598 00:27:39,720 --> 00:27:41,140 because we don't just want to control it as 599 00:27:41,140 --> 00:27:42,800 a normal device. We want to take it further 600 00:27:42,800 --> 00:27:44,460 and actually root the dildo. 601 00:27:45,560 --> 00:27:47,560 Which is something I hadn't said until about 602 00:27:47,560 --> 00:27:49,220 six months ago, which is quite interesting. 603 00:27:49,220 --> 00:27:50,860 It's quite cool. Yeah, it's also worth noting, 604 00:27:50,960 --> 00:27:52,800 because it works over Wi-Fi, unlike the Bluetooth 605 00:27:52,800 --> 00:27:54,880 devices, which is a one-to-one pairing process. 606 00:27:55,120 --> 00:27:56,980 So, if someone else is paired with it, then, 607 00:27:57,020 --> 00:27:59,120 you know, there's nothing else you can do. This is one-to-many. 608 00:27:59,200 --> 00:28:00,960 So, it's a Wi-Fi access point. So, you can have 609 00:28:01,780 --> 00:28:03,100 multiple people join the 610 00:28:03,100 --> 00:28:04,720 access point concurrently. So, even if the 611 00:28:05,100 --> 00:28:07,080 legitimate user is using it, someone else 612 00:28:07,080 --> 00:28:09,060 can jump onto it, unauthenticated, and take control. 613 00:28:09,320 --> 00:28:10,980 Has it come up yet? Yeah, it's come up. Oh, 614 00:28:11,000 --> 00:28:13,180 good. Great. Sorry, I don't know why I get so excited 615 00:28:13,180 --> 00:28:13,800 by doing this. 616 00:28:15,420 --> 00:28:16,900 Right. So, if we bring it up like this, 617 00:28:17,260 --> 00:28:19,140 it might take a second for the web interface to start. 618 00:28:20,460 --> 00:28:21,080 It's still 619 00:28:21,860 --> 00:28:22,880 waiting a little bit. 620 00:28:23,060 --> 00:28:23,620 Come on. 621 00:28:28,000 --> 00:28:29,380 Okay, we're connected to it. Hopefully, 622 00:28:29,440 --> 00:28:30,480 the web interface will come up. 623 00:28:31,100 --> 00:28:33,420 Come on. Never do live 624 00:28:33,420 --> 00:28:35,300 demos. Yeah, this is probably 625 00:28:35,300 --> 00:28:37,340 the least reliable live demo that we do. 626 00:28:37,640 --> 00:28:38,000 It's 627 00:28:39,280 --> 00:28:40,300 really, really fragile. 628 00:28:43,340 --> 00:28:45,380 Okay, let's move on. Yeah. We'll come back 629 00:28:45,380 --> 00:28:47,380 to that. Oh, wait. Hang on. 630 00:28:47,420 --> 00:28:47,640 Hang on. 631 00:28:49,220 --> 00:28:50,720 There we go. It's working. It's up. 632 00:28:52,800 --> 00:28:53,260 It's also 633 00:28:53,260 --> 00:28:55,020 very slow. It's very slow, yeah. 634 00:28:55,120 --> 00:28:57,120 So, we're actually bringing up the IP camera interface. 635 00:28:57,820 --> 00:28:59,160 It is starting to do that. 636 00:28:59,200 --> 00:29:01,060 We'll move on to the next slide and we'll keep on talking 637 00:29:01,060 --> 00:29:03,080 for a bit. Oh, there we go. So, we can go to 638 00:29:03,080 --> 00:29:03,760 image stream mode. 639 00:29:06,260 --> 00:29:07,100 And we're now 640 00:29:07,100 --> 00:29:09,260 looking through the camera on the front 641 00:29:09,260 --> 00:29:10,900 of it, which is great. 642 00:29:11,120 --> 00:29:13,320 Say hello. But, yeah, there's loads 643 00:29:13,320 --> 00:29:15,020 and loads of functionality in here that 644 00:29:15,020 --> 00:29:17,240 we just wouldn't expect to see. So, you go 645 00:29:17,240 --> 00:29:19,200 through here and you've got things like alarm settings, 646 00:29:19,200 --> 00:29:21,220 so it can actually be motion activated 647 00:29:21,220 --> 00:29:23,280 and then if it were connected to 648 00:29:23,280 --> 00:29:25,220 the internet, it would allow you to send stills, which is 649 00:29:25,220 --> 00:29:25,680 just crazy. 650 00:29:28,340 --> 00:29:29,320 So, as I said, 651 00:29:29,320 --> 00:29:31,120 we wanted to take that to a root shell. So, 652 00:29:31,460 --> 00:29:33,260 what we always do with embedded devices is 653 00:29:33,260 --> 00:29:34,860 start looking for command injection. 654 00:29:35,980 --> 00:29:37,280 But unfortunately, we didn't have 655 00:29:37,280 --> 00:29:39,000 any way of getting output from this device. 656 00:29:39,280 --> 00:29:40,980 So, what we thought we'd do is we'd rip it apart 657 00:29:40,980 --> 00:29:43,220 and start looking at it and getting the firmware off it. 658 00:29:43,300 --> 00:29:45,040 So, we're going back to what we did with the DVR, 659 00:29:45,100 --> 00:29:47,220 but this time we're doing it with a dildo. 660 00:29:47,960 --> 00:29:49,140 I'm going to bring up the camera again. 661 00:29:49,200 --> 00:29:50,000 So, you can see. Now, 662 00:29:51,060 --> 00:29:53,100 I think it would be fair to say that my colleague, 663 00:29:53,200 --> 00:29:55,520 Dave, never let him take your dildo 664 00:29:55,520 --> 00:29:57,240 apart, because he's not 665 00:29:57,240 --> 00:29:59,280 very good at it. But, taking 666 00:29:59,280 --> 00:30:01,200 it apart, what we see is we've got a very 667 00:30:01,200 --> 00:30:03,060 similar thing to a DVR. You've got a Wi-Fi 668 00:30:03,060 --> 00:30:05,200 sock here on a little module. On the 669 00:30:05,200 --> 00:30:07,200 other side of the board, we have 670 00:30:08,120 --> 00:30:09,100 that little chip there 671 00:30:09,100 --> 00:30:11,200 again that you can see. It's an SPI flash 672 00:30:11,200 --> 00:30:13,120 chip that we can read. So, we pulled the 673 00:30:13,120 --> 00:30:15,060 firmware off it by clipping onto it 674 00:30:15,060 --> 00:30:17,240 and then we can inspect how the device operates. 675 00:30:17,600 --> 00:30:19,120 We also got on the side here, 676 00:30:19,200 --> 00:30:21,300 a serial console. So, again, 677 00:30:21,360 --> 00:30:22,940 we can connect to it and see what happens. 678 00:30:23,240 --> 00:30:25,220 And what we found, with a lot of playing 679 00:30:25,220 --> 00:30:26,880 about, was within 680 00:30:26,880 --> 00:30:28,860 the record settings 681 00:30:28,860 --> 00:30:31,320 here, when you have recording 682 00:30:31,320 --> 00:30:33,360 enabled and you're saving 683 00:30:33,360 --> 00:30:34,980 it to an SMB share, as 684 00:30:34,980 --> 00:30:37,120 I often want to do with my dildo, you could 685 00:30:37,120 --> 00:30:39,360 put command injection here, so you could just run commands 686 00:30:39,360 --> 00:30:41,200 on it. So, at that point, we were able 687 00:30:41,200 --> 00:30:43,160 to arbitrary add 688 00:30:43,160 --> 00:30:45,220 users and do things like that. And, of 689 00:30:45,220 --> 00:30:47,420 course, enable telnet on a dildo. 690 00:30:49,300 --> 00:30:50,220 Do you want to do it live? 691 00:30:50,540 --> 00:30:52,980 Yeah. So, what we've done is we've kind of 692 00:30:52,980 --> 00:30:55,140 weaponized this. Well, weaponized, is that maybe? 693 00:30:55,220 --> 00:30:56,100 That's not a great word, is it? 694 00:30:56,960 --> 00:30:58,120 Let's go a bit softer on that. 695 00:30:59,880 --> 00:31:00,960 I need to stop talking. 696 00:31:02,020 --> 00:31:03,340 So, what we've done is we've scripted 697 00:31:03,340 --> 00:31:04,920 this. And it's a simple Python script. 698 00:31:06,380 --> 00:31:07,200 And what it does 699 00:31:07,200 --> 00:31:08,840 is it adds a new user, 700 00:31:09,500 --> 00:31:11,420 we restart telnet, then we log 701 00:31:11,420 --> 00:31:12,800 into it, and we can view the video. 702 00:31:13,000 --> 00:31:15,580 So, let's give this a go and see if it works. 703 00:31:17,220 --> 00:31:19,180 So, it's trying to turn on telnet. It does take a 704 00:31:19,180 --> 00:31:21,100 little while to do this. So, 705 00:31:21,160 --> 00:31:23,120 what should we do while it's doing that? 706 00:31:23,320 --> 00:31:25,100 It took about two minutes last time, didn't it? 707 00:31:25,200 --> 00:31:27,180 Did it take two minutes? The other thing that's really freaky 708 00:31:27,180 --> 00:31:29,000 is some of the additional functionality 709 00:31:29,000 --> 00:31:31,080 you find. Because they've essentially taken 710 00:31:31,080 --> 00:31:32,620 a consumer grade router, 711 00:31:33,200 --> 00:31:35,340 they've got loads of additional functionality in there. 712 00:31:35,440 --> 00:31:37,420 So, it's got the function, for example, 713 00:31:37,420 --> 00:31:39,060 to do Skype, 714 00:31:39,780 --> 00:31:41,080 which I was a bit shocked about. 715 00:31:41,720 --> 00:31:43,120 And also, deep in 716 00:31:43,120 --> 00:31:45,060 the web code, we found 717 00:31:45,060 --> 00:31:46,240 an IP address 718 00:31:46,940 --> 00:31:49,160 that it looks to be reporting back 719 00:31:49,180 --> 00:31:51,280 to. We can't prove it, we can't see it's actually working, 720 00:31:51,420 --> 00:31:53,460 but there are unusual characteristics 721 00:31:53,460 --> 00:31:54,900 in there, which suggest... There you go. 722 00:31:55,120 --> 00:31:57,080 Right. So, what it does, once it's popped the shell, 723 00:31:57,240 --> 00:31:59,480 it starts up this page and dumps loads of other information. 724 00:31:59,760 --> 00:32:01,280 So, we've got a video stream, and if 725 00:32:01,280 --> 00:32:03,200 we jump back onto where I was running 726 00:32:03,200 --> 00:32:04,320 the Python there, 727 00:32:05,480 --> 00:32:07,260 we've now got a root shell on 728 00:32:07,260 --> 00:32:09,200 a dildo, which is absolutely brilliant. I mean, 729 00:32:09,260 --> 00:32:10,980 can it get any better than that? 730 00:32:11,020 --> 00:32:13,360 Our careers, where are they going to go? Yeah, down the toilet, I think. 731 00:32:15,240 --> 00:32:16,340 Yeah, so there you go. 732 00:32:16,400 --> 00:32:17,580 You can actually go through some of the code here. 733 00:32:17,840 --> 00:32:19,160 And if you look through your 734 00:32:19,180 --> 00:32:20,400 browser, you'll see references to... 735 00:32:20,400 --> 00:32:21,020 Really? 736 00:32:24,840 --> 00:32:26,980 We found references to Skype in here. 737 00:32:27,180 --> 00:32:29,200 We found references to email 738 00:32:29,200 --> 00:32:31,040 addresses. We found references to 739 00:32:31,040 --> 00:32:32,920 calls to unusual 740 00:32:32,920 --> 00:32:34,620 IP addresses in the Far East. 741 00:32:34,820 --> 00:32:36,400 This is all just a bit odd. 742 00:32:37,520 --> 00:32:38,120 Yeah. 743 00:32:39,700 --> 00:32:41,620 I don't know where to go from here. 744 00:32:43,360 --> 00:32:43,960 Right. 745 00:32:45,640 --> 00:32:46,240 Uh... 746 00:32:46,240 --> 00:32:47,060 Uh... 747 00:32:49,180 --> 00:32:49,520 Ah... 748 00:32:51,220 --> 00:32:52,220 All right. Sorry. 749 00:32:52,560 --> 00:32:53,620 Should just be there. 750 00:32:53,660 --> 00:32:54,700 Yeah, it's just... 751 00:32:55,900 --> 00:32:57,500 Oh, no, it's not. Scroll down. 752 00:32:58,920 --> 00:32:59,400 . 753 00:33:00,920 --> 00:33:01,660 There you go. 754 00:33:02,100 --> 00:33:02,180 . 755 00:33:05,360 --> 00:33:07,080 So, the point we're trying to make there is 756 00:33:07,080 --> 00:33:09,080 there's lots of really useful skills 757 00:33:09,080 --> 00:33:11,220 you can learn to do with hardware reverse engineering. 758 00:33:11,500 --> 00:33:13,080 And kind of what you use 759 00:33:13,080 --> 00:33:14,900 them for can sometimes be quite odd. 760 00:33:15,140 --> 00:33:17,380 Um, we happen to choose 761 00:33:17,380 --> 00:33:19,180 an adult toy because 762 00:33:19,180 --> 00:33:20,800 it was interesting and different. 763 00:33:21,100 --> 00:33:23,500 Um, we found code injection on it. We found you could 764 00:33:23,500 --> 00:33:25,540 re-enable Telnet on it just like we did 765 00:33:25,540 --> 00:33:27,420 with the Mirai worm. And also, finally, 766 00:33:27,500 --> 00:33:29,620 once we've been through the firmware, we found the, uh, 767 00:33:29,640 --> 00:33:31,320 the root password, which is recam4debug, 768 00:33:31,480 --> 00:33:33,100 which we did try to crack, but, um, 769 00:33:33,120 --> 00:33:34,980 we weren't going to get through that in time, were we? 770 00:33:35,140 --> 00:33:35,680 No, no. 771 00:33:36,960 --> 00:33:39,180 Um, it's on our GitHub, so if you have 772 00:33:39,180 --> 00:33:41,240 a SiMi dildo you want to 773 00:33:41,240 --> 00:33:43,400 root, you can run our Python script 774 00:33:43,400 --> 00:33:45,480 if you wish. It's all there. It's all 775 00:33:45,480 --> 00:33:47,280 blogged as well. It's on the website, too. There's a 776 00:33:47,280 --> 00:33:49,280 full write-up if you want to know how to do this. 777 00:33:49,540 --> 00:33:51,420 Um, disclosure was a train wreck 778 00:33:51,420 --> 00:33:53,420 as it is with most adult toy vendors. 779 00:33:53,780 --> 00:33:55,260 Um, we got no response from 780 00:33:55,260 --> 00:33:57,100 these guys. We did try reasonably hard. I think we probably 781 00:33:57,100 --> 00:33:58,520 could have tried harder, but 782 00:33:59,200 --> 00:34:01,300 we reached out to them on the email address 783 00:34:01,300 --> 00:34:03,320 that they published for contact, and 784 00:34:03,320 --> 00:34:05,060 we got no response at all. Um, 785 00:34:05,180 --> 00:34:07,260 I just want to leave you with the thought that why on earth 786 00:34:07,260 --> 00:34:09,300 would you put a camera in a dildo? 787 00:34:09,340 --> 00:34:11,200 I mean, surely that's asking for trouble. It's just 788 00:34:11,200 --> 00:34:13,340 bizarre. I want to move 789 00:34:13,340 --> 00:34:15,040 on to the serious bit now, though, because, I mean, again, 790 00:34:15,240 --> 00:34:17,260 you know, I think we could be accused of being a bit pure-eyed, 791 00:34:17,280 --> 00:34:19,180 with some of these toys. But actually, there is a very serious 792 00:34:19,180 --> 00:34:21,260 message behind all this. Pornography is 793 00:34:21,260 --> 00:34:23,460 a very big business. And if you don't believe me, 794 00:34:23,480 --> 00:34:25,000 go and see how much Follimer's Pornhub has. 795 00:34:25,580 --> 00:34:27,280 Toys are out there. People 796 00:34:27,280 --> 00:34:29,200 don't talk about it, but there are a lot of toys 797 00:34:29,200 --> 00:34:31,300 out there. This is a big area of business. A lot of 798 00:34:31,300 --> 00:34:32,880 these toys sell in big numbers. 799 00:34:33,080 --> 00:34:35,440 And I think we laugh about it, because we're a bit uncomfortable 800 00:34:35,440 --> 00:34:37,400 about it. We're a bit surprised that these vulnerabilities 801 00:34:37,400 --> 00:34:39,620 exist. We're a bit surprised 802 00:34:39,620 --> 00:34:41,400 that we're seeing vulnerabilities that we've seen 803 00:34:41,400 --> 00:34:43,300 resolved on mainstream devices ten 804 00:34:43,300 --> 00:34:45,640 plus years ago. We're just a bit surprised, 805 00:34:45,680 --> 00:34:47,260 and we feel a little uncomfortable, so we laugh. 806 00:34:47,280 --> 00:34:49,260 But I'm going to quote someone 807 00:34:49,260 --> 00:34:51,180 I know who says, please stop 808 00:34:51,180 --> 00:34:53,180 laughing. And actually, I think he's right. 809 00:34:53,480 --> 00:34:55,400 And that quote comes from RenderMan, 810 00:34:55,520 --> 00:34:57,520 who runs the internet at DONG's website. 811 00:34:57,640 --> 00:34:59,380 And he does a lot of really, really good stuff. 812 00:34:59,740 --> 00:35:01,480 We can all, as security 813 00:35:01,480 --> 00:35:03,560 researchers, help improve things in this market. 814 00:35:04,080 --> 00:35:05,480 I think we find disclosures 815 00:35:05,480 --> 00:35:07,520 often ignored, but you'll find that RenderMan can help 816 00:35:07,520 --> 00:35:09,320 you reach out to vendors and 817 00:35:09,320 --> 00:35:11,360 help you to get in touch with them, help them to respond. 818 00:35:11,740 --> 00:35:13,020 Now, just think about it for a minute. 819 00:35:14,700 --> 00:35:15,500 People have had 820 00:35:15,500 --> 00:35:17,260 very personal data stalls, and they've had 821 00:35:17,280 --> 00:35:19,280 stolen, very personal photographs stolen 822 00:35:19,280 --> 00:35:21,300 in other ways. Maybe through 823 00:35:21,780 --> 00:35:23,440 Snapchat, for example, and other things 824 00:35:23,440 --> 00:35:25,100 that has driven people to 825 00:35:25,680 --> 00:35:27,660 commit terrible acts such as suicide. 826 00:35:27,840 --> 00:35:29,340 They've felt they've been extorted, they've been 827 00:35:29,340 --> 00:35:31,320 held to ransom over data, and it's driven 828 00:35:31,320 --> 00:35:33,380 people to the ultimate, which is really scary. 829 00:35:34,820 --> 00:35:35,540 I think 830 00:35:35,540 --> 00:35:37,560 there should be an offence of online rape. 831 00:35:37,740 --> 00:35:39,600 I don't think the legal statutes in many 832 00:35:39,600 --> 00:35:41,140 territories actually consider this 833 00:35:41,760 --> 00:35:42,700 to be rape. 834 00:35:43,180 --> 00:35:45,540 But I think it is, and I think our 835 00:35:45,540 --> 00:35:47,020 lawmakers need to step up. 836 00:35:47,020 --> 00:35:52,480 And I think they need to raise the bar so that people do steal these images. They can be prosecuted 837 00:35:52,480 --> 00:35:54,120 It's very difficult to do 838 00:35:54,120 --> 00:35:57,460 There are some really good people out there driving hard into this territory 839 00:35:57,460 --> 00:36:03,140 Trying to get the law to catch up because it's scary and it's nasty and it's horrible that people have died through similar instances 840 00:36:04,620 --> 00:36:06,040 the conclusion for me was that 841 00:36:07,160 --> 00:36:11,960 Iot adult toys have got a long way to go in terms of security. We're seeing the basics are missing 842 00:36:11,960 --> 00:36:16,460 It's not just missing pinning. It's missing SSL. It's enumeration 843 00:36:16,460 --> 00:36:22,760 It's weak api's it's everything but I think what we can all do to help improve the security of adult sex toys is frankly 844 00:36:22,760 --> 00:36:24,280 Go screw up your Amazon recommendations 845 00:36:24,280 --> 00:36:28,940 Just like I did go and get a toy have a play with them find out what the security flaws are 846 00:36:28,940 --> 00:36:33,100 Disclose them and help the industry up their game. So we see everyone 847 00:36:34,320 --> 00:36:36,260 Have more confidence in their adult toys 848 00:36:37,500 --> 00:36:43,600 That's Andrews Twitter handle. That's me. That's the company blog. We blog about stuff like this hardware hacking every day of the week 849 00:36:43,600 --> 00:36:46,380 Go follow you find it really interesting. Thanks very 850 00:36:46,460 --> 00:36:48,160 Much. I hope you weren't too put off by it 851 00:36:49,420 --> 00:36:49,740 You