1
00:00:00,000 --> 00:00:05,200
Hi. First, I'd like to say thank you to the IoT Village and DEF CON for having me here today.

2
00:00:05,580 --> 00:00:11,500
I really appreciate the opportunity to speak in front of a group of people that enjoy computer security almost as much as I do.

3
00:00:12,060 --> 00:00:16,340
So, as you can see by the slide here, I'm going to be giving the keynote for the IoT Village,

4
00:00:16,760 --> 00:00:22,280
and the name of my talk is Friends Not Foes, Rethinking the Vendor-Researcher Relationship.

5
00:00:23,860 --> 00:00:25,980
So, first to begin, a little bit about myself.

6
00:00:25,980 --> 00:00:32,240
Like I mentioned, my name is Vikram Gadi. I enjoy building and hacking web applications, reverse engineering mobile applications,

7
00:00:32,580 --> 00:00:36,300
most things to do with IoT security, and just casual reading.

8
00:00:36,640 --> 00:00:42,140
And I'm a security analyst at Independent Security Evaluators, which is the logo that you guys see around the room.

9
00:00:43,980 --> 00:00:46,340
So, a little bit about the company that paid for me to be here.

10
00:00:47,920 --> 00:00:52,940
Independent Security Evaluators is based in Baltimore, Maryland, but they also have an office in San Diego, California,

11
00:00:53,200 --> 00:00:55,460
and they work all around the world doing assessments.

12
00:00:56,180 --> 00:00:58,560
What type of assessments? We do security assessments.

13
00:00:59,600 --> 00:01:05,040
Just to give a couple of examples, mobile applications, web applications, infrastructure, native applications.

14
00:01:05,360 --> 00:01:08,460
If you have a custom DRM system that you want looked at, give us a call.

15
00:01:08,540 --> 00:01:11,580
Or a protocol that you need reverse engineered, we enjoy doing that too.

16
00:01:12,680 --> 00:01:16,020
We do all of our assessments from the perspective of a highly skilled adversary,

17
00:01:16,320 --> 00:01:21,240
and most of our assessments are white box, but we do black box assessments as well, and everything else under the sun.

18
00:01:22,680 --> 00:01:25,480
So, here is the outline for the talk today.

19
00:01:26,160 --> 00:01:30,820
At the beginning, I'll be talking about the IoT Village, and I think it's important because I'm the keynote for the IoT Village,

20
00:01:30,900 --> 00:01:32,300
and you guys are all here for the same reason.

21
00:01:33,320 --> 00:01:38,740
I'm going to be giving a CTF intro where I'm going to give a couple of ideas of how to play CTF if you don't know how to play,

22
00:01:38,780 --> 00:01:39,860
or if you want to start playing now.

23
00:01:40,780 --> 00:01:44,360
We'll be going over vulnerability disclosure models, what they are, and what they mean.

24
00:01:45,380 --> 00:01:47,960
The differences between full and responsible disclosure.

25
00:01:48,920 --> 00:01:53,880
And then we'll be going over what I think researchers and vendors can do together to improve security.

26
00:01:54,360 --> 00:01:55,960
And at the end, I'll have some time for questions.

27
00:01:55,980 --> 00:01:59,320
So, the talk overall is going to be between 20 to 25 minutes,

28
00:01:59,520 --> 00:02:03,040
and at the end, there should be 5 to 10 minutes for questions.

29
00:02:04,460 --> 00:02:06,560
So, where did the IoT Village come from?

30
00:02:07,160 --> 00:02:14,080
It all started off with some research into small office, home office routers, and network attached storage devices.

31
00:02:14,340 --> 00:02:16,180
So, SOHO routers and NAS devices.

32
00:02:16,880 --> 00:02:20,380
These security researchers found out that these devices were actually pretty easily hacked,

33
00:02:20,520 --> 00:02:22,640
as you can see if you've been playing the CTF,

34
00:02:22,720 --> 00:02:25,360
and they wanted to create something that will help

35
00:02:25,980 --> 00:02:28,120
develop a better methodology for hacking devices,

36
00:02:28,340 --> 00:02:32,500
and bring to light how vulnerable these devices really are.

37
00:02:32,700 --> 00:02:35,380
As a result, we had the first SOHO Policy Broking Contest,

38
00:02:35,560 --> 00:02:37,980
which sounds a lot like an emo band, but it's not.

39
00:02:38,060 --> 00:02:39,280
It's a router hacking contest.

40
00:02:40,300 --> 00:02:44,240
And this took place at DEF CON 22 in 2014,

41
00:02:45,120 --> 00:02:51,460
and 56 CVEs were brought to light that had to do with all the vulnerabilities in these devices.

42
00:02:51,940 --> 00:02:54,460
So, if you're playing the CTF and you wonder how it all started off,

43
00:02:56,120 --> 00:02:57,880
the URL is on the bottom of the page.

44
00:02:58,120 --> 00:03:00,700
I know the URL is really long and no one likes typing that out,

45
00:03:00,780 --> 00:03:03,880
so the Google URL shortened version is at the end between parentheses.

46
00:03:05,720 --> 00:03:08,960
So, after the first SOHO Policy Broking Contest, we have the first IoT Village.

47
00:03:09,260 --> 00:03:12,540
The first IoT Village took part in DEF CON 23, 2015,

48
00:03:12,960 --> 00:03:14,720
and it expanded to SOHO Policy Broking.

49
00:03:14,880 --> 00:03:15,520
What does that mean?

50
00:03:15,600 --> 00:03:19,800
It didn't only involve routers and NAS devices, it included a bunch of other stuff too,

51
00:03:19,860 --> 00:03:21,840
like cameras and multimedia devices,

52
00:03:22,080 --> 00:03:24,840
and now a bunch of other nonsense that people decided to create.

53
00:03:26,460 --> 00:03:31,200
So, the IoT Village in itself started off with SOHO Policy Broking in DEF CON 22.

54
00:03:31,940 --> 00:03:35,560
It's happened at DEF CON 23, DEF CON 24, and this year at DEF CON 25.

55
00:03:36,460 --> 00:03:39,760
It has included 30 devices in the CTF,

56
00:03:39,860 --> 00:03:42,000
60-plus devices in the zero-day track,

57
00:03:42,700 --> 00:03:46,700
38 talks, not included Daniel Legado's talk from this morning or my talk right now,

58
00:03:46,860 --> 00:03:49,240
and 113 vulnerability disclosures.

59
00:03:51,180 --> 00:03:53,780
If you ever get bored of attending the IoT Village at DEF CON,

60
00:03:53,900 --> 00:03:55,560
there's a bunch of other conferences you can go to.

61
00:03:55,980 --> 00:04:02,120
Just to name a few, there's DerbyCon in Louisville, Kentucky, RSA.

62
00:04:02,520 --> 00:04:04,340
In RSA, it's a different CTF.

63
00:04:04,400 --> 00:04:08,060
They just have people giving demos on how vulnerable devices are exploited,

64
00:04:08,220 --> 00:04:09,260
because RSA is a different environment.

65
00:04:09,820 --> 00:04:13,920
Then there's two B-Sides events, one in B-Sides DC, one in B-Sides Charm,

66
00:04:14,020 --> 00:04:18,020
CypherCon in Milwaukee, TorCon in San Diego, and HackerLabs in Puerto Rico.

67
00:04:20,320 --> 00:04:23,840
So, the IoT Village itself is composed of three different parts.

68
00:04:23,900 --> 00:04:25,620
The stage, which is where I am right now,

69
00:04:25,980 --> 00:04:27,420
where people are going to be presenting their findings

70
00:04:27,420 --> 00:04:30,280
and what vulnerabilities they've identified in products.

71
00:04:30,680 --> 00:04:34,340
The zero-day track, which is at the back in just a couple devices.

72
00:04:34,580 --> 00:04:37,740
They have devices that haven't been hacked or don't have known vulnerabilities.

73
00:04:38,220 --> 00:04:40,980
You can responsibly disclose these vulnerabilities to a vendor,

74
00:04:41,120 --> 00:04:44,460
and then you can take part in the CTF where there's a payout

75
00:04:44,460 --> 00:04:45,760
for whoever finds the coolest vulnerabilities.

76
00:04:46,560 --> 00:04:49,000
And then there's the actual so hopelessly broken CTF,

77
00:04:49,100 --> 00:04:51,160
which is what I think a lot of people come here to play.

78
00:04:51,820 --> 00:04:55,440
Having in mind that a lot of people do come here to play this so hopelessly broken CTF,

79
00:04:55,980 --> 00:05:00,100
I do understand that not everyone that comes to DEF CON is a well-seasoned security analyst,

80
00:05:00,340 --> 00:05:02,520
and they don't really know where to start off.

81
00:05:02,780 --> 00:05:05,520
Lucky for them, I came up with a couple CTF tips

82
00:05:06,000 --> 00:05:07,720
so that anyone can play it if they want to.

83
00:05:08,620 --> 00:05:10,880
Tip number one is map the network.

84
00:05:11,140 --> 00:05:14,480
So, as soon as you drop into the network,

85
00:05:14,900 --> 00:05:17,080
you're going to have to figure out where these vulnerable devices are

86
00:05:17,080 --> 00:05:18,380
and which ones are the ones you want to attack.

87
00:05:18,840 --> 00:05:21,500
Obviously, you need to figure out which ones are easier and which ones aren't,

88
00:05:21,520 --> 00:05:25,220
so take some time, map the network, identify the devices, and then move on.

89
00:05:26,080 --> 00:05:28,520
I would recommend Nmap. You can use whatever you want.

90
00:05:28,580 --> 00:05:30,460
You can ping the devices to identify what's on the network.

91
00:05:30,540 --> 00:05:32,400
That's up to you. I'm not going to tell you what to do.

92
00:05:33,760 --> 00:05:34,760
Search all the surfaces.

93
00:05:35,360 --> 00:05:38,940
So, some of the vulnerabilities are going to be on the device in the web application

94
00:05:38,940 --> 00:05:41,040
or it might be on a port on the device.

95
00:05:41,840 --> 00:05:43,960
So, think about all the services running on the device.

96
00:05:44,160 --> 00:05:47,140
Think about whatever's exposed through the web app.

97
00:05:47,400 --> 00:05:49,720
Then you'll figure out how to become an administrator,

98
00:05:50,060 --> 00:05:53,140
get a shell, figure out what flag you need to get, and so on.

99
00:05:54,720 --> 00:05:55,620
My next tip is,

100
00:05:55,620 --> 00:05:56,560
think outside the box.

101
00:05:56,740 --> 00:05:58,800
So, a lot of these vulnerabilities, you need to be creative.

102
00:05:59,180 --> 00:06:03,700
So, some of them need, like, a well-seasoned Linux Kung Fu artist

103
00:06:03,700 --> 00:06:07,880
to get into the device and then have to hash some files and get it out.

104
00:06:08,400 --> 00:06:11,760
Sometimes the tools that you want are necessarily there on your first look,

105
00:06:11,860 --> 00:06:13,580
but there are other tools that will help you out.

106
00:06:14,180 --> 00:06:16,120
Search for canned exploits is another one.

107
00:06:16,160 --> 00:06:19,060
A lot of people think that they need to create a zero-day in this device right now

108
00:06:19,060 --> 00:06:21,460
in order to participate in the CTF.

109
00:06:21,640 --> 00:06:22,440
That's not the idea.

110
00:06:22,580 --> 00:06:24,220
A lot of these devices, you can just find them online.

111
00:06:24,220 --> 00:06:26,560
You can Google around, and you'll find the exploit.

112
00:06:26,740 --> 00:06:27,860
Then just compile and hack.

113
00:06:29,540 --> 00:06:29,940
Sweet.

114
00:06:30,060 --> 00:06:32,000
And then, for my last tip for the CTF,

115
00:06:32,040 --> 00:06:33,580
is try not to project.

116
00:06:33,900 --> 00:06:37,140
You might find yourself in a position where you want to hack a device

117
00:06:37,140 --> 00:06:38,640
that is a little bit more complex,

118
00:06:39,360 --> 00:06:41,820
and you don't really make any progress in the CTF.

119
00:06:41,900 --> 00:06:44,540
I recommend finding an easier device and moving on from there.

120
00:06:44,980 --> 00:06:49,080
So, the other thing is that there's other people here that want to play as well,

121
00:06:49,220 --> 00:06:50,340
and they are not experienced.

122
00:06:50,640 --> 00:06:53,440
So, if you do want to team up with someone, do team up with them.

123
00:06:53,440 --> 00:06:55,240
If they say no, just back off and let them be.

124
00:06:55,540 --> 00:06:57,620
But if you do want to play with someone, have fun.

125
00:06:59,140 --> 00:07:03,180
For those of you that are still a little bit lost after that small intro,

126
00:07:03,700 --> 00:07:07,520
here are a couple of links for places that you can just read a blog post

127
00:07:07,520 --> 00:07:08,880
and figure out how to hack these devices.

128
00:07:09,620 --> 00:07:11,540
If you want to take a second to just take a picture, you can.

129
00:07:11,740 --> 00:07:15,140
On the right-hand side, I have the Google shortened URLs in between parentheses.

130
00:07:15,980 --> 00:07:18,980
I know that a lot of people don't like those because they're kind of sketched out by them.

131
00:07:19,200 --> 00:07:23,140
For those people, I have all the real URLs on the bottom page where my Twitter is.

132
00:07:25,200 --> 00:07:25,520
Sweet.

133
00:07:25,800 --> 00:07:29,400
And before I finish this CTF spiel, I have one more thing to say,

134
00:07:29,520 --> 00:07:30,720
and that's that you got this.

135
00:07:31,520 --> 00:07:34,220
I know, like I mentioned at the beginning, a lot of people come to DEF CON

136
00:07:34,220 --> 00:07:36,640
already knowing how to do security, but a lot of people don't.

137
00:07:36,720 --> 00:07:40,340
If you're not getting into this and you don't really understand it,

138
00:07:40,940 --> 00:07:41,840
don't fret too much.

139
00:07:42,000 --> 00:07:44,160
I know you think you suck, but it's okay.

140
00:07:44,240 --> 00:07:44,780
We all suck.

141
00:07:44,820 --> 00:07:46,380
It's all about sucking a little bit less every day.

142
00:07:47,140 --> 00:07:49,280
Talking about things that suck brings me on to my next thing,

143
00:07:49,360 --> 00:07:52,760
and that is vulnerability disclosure in IoT devices specifically.

144
00:07:53,560 --> 00:07:55,460
So, why does the IoT Village exist,

145
00:07:55,560 --> 00:07:58,060
and why does all these things with vulnerability disclosure being talked about?

146
00:07:59,160 --> 00:08:03,300
Well, IoT devices are finding their way into public places,

147
00:08:03,500 --> 00:08:08,300
so you don't really have a choice whether or not you're going to be interfacing with an IoT device at this point.

148
00:08:09,480 --> 00:08:12,460
It's also becoming the case that if you want to buy a device,

149
00:08:12,620 --> 00:08:14,280
there's only an IoT option, and that's it.

150
00:08:14,900 --> 00:08:20,020
Also, as time goes by, people are using IoT devices to further improve how they live their lives,

151
00:08:20,160 --> 00:08:22,000
and I think just shying away and saying,

152
00:08:22,000 --> 00:08:26,600
don't buy any IoT devices is not going to be a good idea,

153
00:08:26,700 --> 00:08:28,280
because then there's not going to be a choice.

154
00:08:28,360 --> 00:08:31,800
It's either you buy a fridge that has an IoT function in it,

155
00:08:31,820 --> 00:08:34,000
or you just don't buy any fridge, and that doesn't really make sense.

156
00:08:35,180 --> 00:08:39,700
Cool, so I have a simple scenario to give you more or less why I think IoT devices are important.

157
00:08:40,500 --> 00:08:41,740
So, think about it this way.

158
00:08:41,840 --> 00:08:45,740
You walk into your hotel, and the first thing that you see is an IP camera.

159
00:08:46,160 --> 00:08:47,480
So, this is pretty normal.

160
00:08:47,760 --> 00:08:49,860
Normally, you walk into a building, you see an IP camera.

161
00:08:50,200 --> 00:08:51,720
You're kind of used to it at this point.

162
00:08:52,000 --> 00:08:55,900
So, as you walk into your room, you find out that the fridge is also an IoT fridge.

163
00:08:56,120 --> 00:08:58,440
You're like, well, you know, I'm not really going to be using it.

164
00:08:58,480 --> 00:09:00,620
I'm not part of this network other than for checking my email.

165
00:09:00,940 --> 00:09:01,760
So, that's fine.

166
00:09:02,740 --> 00:09:05,720
Then later on, you find out that the light bulb is also an IoT light bulb,

167
00:09:05,820 --> 00:09:08,480
and your shower head in your room is also an IoT shower head.

168
00:09:08,820 --> 00:09:12,040
So, you get over it, and you go to your favorite security conference,

169
00:09:12,480 --> 00:09:15,120
and you do your talks, you do everything,

170
00:09:15,320 --> 00:09:17,440
and then at the end of the day, you decide you want to go back.

171
00:09:17,820 --> 00:09:20,740
When you go back to your room, you find out that you can't use a shower head,

172
00:09:20,740 --> 00:09:24,160
because the server that controls the shower head is no longer up,

173
00:09:24,280 --> 00:09:25,800
it's no longer accepting any data,

174
00:09:25,900 --> 00:09:27,900
and you no longer get to take a warm shower.

175
00:09:28,180 --> 00:09:29,560
This is kind of a comical example,

176
00:09:29,640 --> 00:09:33,220
but it does explain how this person that walked into their room

177
00:09:33,220 --> 00:09:36,360
didn't have a choice whether or not these IoT devices were part of their lives,

178
00:09:36,520 --> 00:09:40,300
because there's nothing illegal about having an IoT device.

179
00:09:40,620 --> 00:09:43,880
They may be unsecure, but there's nothing stopping you from having these things.

180
00:09:45,300 --> 00:09:49,900
So, just to further how much I think IoT devices are affecting our lives,

181
00:09:49,900 --> 00:09:51,620
I have a quote by McKinsey Global.

182
00:09:52,120 --> 00:09:55,900
McKinsey Global estimates that between $3.9 trillion to $11.1 trillion

183
00:09:55,900 --> 00:09:59,080
are going to be spent in IoT by the end of year 2025.

184
00:10:00,240 --> 00:10:03,040
Likewise, Gartner estimates by the end of this year, in 2017,

185
00:10:03,700 --> 00:10:08,220
20% of companies are going to be using IoT devices to further their business initiatives.

186
00:10:08,660 --> 00:10:11,340
What that means is that companies are going to be using IoT devices

187
00:10:12,260 --> 00:10:16,020
to improve how they're doing shipping or marketing, whatever else it may be.

188
00:10:17,220 --> 00:10:19,600
So, now that we've talked about why I think IoT is important,

189
00:10:19,900 --> 00:10:20,980
let's talk about vulnerability disclosure.

190
00:10:21,580 --> 00:10:23,000
So, what is vulnerability disclosure?

191
00:10:24,200 --> 00:10:27,460
Vulnerability disclosure is the idea that you're reporting a vulnerability to someone, anyone.

192
00:10:27,660 --> 00:10:28,380
It doesn't really matter.

193
00:10:28,580 --> 00:10:30,640
So, if you just put it up on your Twitter page,

194
00:10:30,840 --> 00:10:33,240
or if you report it directly to the vendor,

195
00:10:33,400 --> 00:10:36,640
either of those are vulnerability disclosures, but they're different types.

196
00:10:37,400 --> 00:10:41,500
So, for this talk, I want to also say that there's two things you can do

197
00:10:41,500 --> 00:10:42,300
when you disclose a vulnerability.

198
00:10:42,680 --> 00:10:46,120
You can either A, disclose it, or B, not disclose it.

199
00:10:46,300 --> 00:10:49,380
So, if I chose to not disclose it, this talk would be really short,

200
00:10:49,900 --> 00:10:50,840
and we wouldn't really get anywhere,

201
00:10:50,980 --> 00:10:53,120
so let's focus on disclosing a vulnerability for right now.

202
00:10:53,660 --> 00:10:56,700
So, vulnerability disclosure is divided up into two different parts,

203
00:10:56,800 --> 00:10:57,920
or two main parts.

204
00:10:58,440 --> 00:11:01,340
The first one being full disclosure, which is the one on the right,

205
00:11:01,440 --> 00:11:03,940
and the second one being responsible disclosure, which is the one on the left.

206
00:11:05,200 --> 00:11:07,820
For this talk, I didn't want to tell people what to do,

207
00:11:07,860 --> 00:11:08,860
because I think that doesn't make sense.

208
00:11:08,960 --> 00:11:10,180
I want people to make their own choice.

209
00:11:10,580 --> 00:11:12,660
So, instead of calling it responsible disclosure,

210
00:11:12,920 --> 00:11:13,920
because it sounds kind of loaded,

211
00:11:14,120 --> 00:11:16,100
I'm just going to call it coordinated disclosure,

212
00:11:16,600 --> 00:11:19,640
which is something that the Microsoft Security Research Center does as well.

213
00:11:21,000 --> 00:11:24,960
So, to define these, let's first start by defining what full disclosure is.

214
00:11:25,260 --> 00:11:28,380
Full disclosure is the idea that whenever you find a vulnerability,

215
00:11:28,720 --> 00:11:30,460
you just immediately tell everyone, like,

216
00:11:30,480 --> 00:11:33,740
hey, I found this vulnerability in this product by this vendor.

217
00:11:34,240 --> 00:11:38,220
The idea behind this is that whenever someone does full disclosure,

218
00:11:38,380 --> 00:11:40,500
they want to inform everyone at the same time,

219
00:11:40,500 --> 00:11:43,540
so that the vendor makes a better effort for updating their software,

220
00:11:43,720 --> 00:11:45,840
and then people can take measures to secure themselves.

221
00:11:46,260 --> 00:11:48,320
I don't completely agree with the idea of full disclosure,

222
00:11:48,440 --> 00:11:49,880
but that's me, not like you guys can do it.

223
00:11:49,900 --> 00:11:50,960
You can make whatever decision you want.

224
00:11:51,980 --> 00:11:55,480
But the whole idea is that some security researchers believe

225
00:11:55,480 --> 00:12:00,660
that vulnerabilities are more of a PR issue than an actual issue with a company.

226
00:12:00,900 --> 00:12:02,840
So, if a company doesn't really take it seriously,

227
00:12:03,060 --> 00:12:05,260
they'll take it more seriously when their bottom line is affected,

228
00:12:05,460 --> 00:12:08,040
instead of just saying, hey, there's a vulnerability in this.

229
00:12:08,100 --> 00:12:08,740
You should fix it.

230
00:12:09,840 --> 00:12:13,660
The second thing that I want to define is coordinated disclosure

231
00:12:13,660 --> 00:12:16,200
or responsible disclosure, as some people refer to it.

232
00:12:16,840 --> 00:12:19,520
Coordinated disclosure is the idea that you're reporting to the vendor

233
00:12:19,900 --> 00:12:23,020
so you're coordinating with them that, hey, I found this vulnerability,

234
00:12:23,180 --> 00:12:24,580
and I think you guys should fix it.

235
00:12:24,760 --> 00:12:25,480
Here's a timeframe.

236
00:12:25,780 --> 00:12:27,340
You need to fix it within this timeframe.

237
00:12:27,540 --> 00:12:30,360
And if you don't, obviously, I'm going to fully disclose it.

238
00:12:30,540 --> 00:12:32,360
It's not that if you don't.

239
00:12:32,380 --> 00:12:35,340
It's kind of like they're going to responsibly fully disclose it anyways,

240
00:12:35,520 --> 00:12:38,480
but they're giving the manufacturer time so that they can fix it

241
00:12:38,480 --> 00:12:40,280
and not everyone's affected at the same time.

242
00:12:41,580 --> 00:12:44,780
So, let's do a side-by-side to compare what we just talked about.

243
00:12:45,020 --> 00:12:48,840
Full disclosure is that you're reporting the vulnerability to everyone at the same time.

244
00:12:49,420 --> 00:12:51,500
Coordinated disclosure is that you're disclosing the vulnerability

245
00:12:51,500 --> 00:12:54,700
only to the vendor at the beginning, and after they have patched it,

246
00:12:54,820 --> 00:12:56,740
you're going to fully disclose it to everyone.

247
00:12:58,320 --> 00:13:02,120
The goal of full disclosure is that they want to pressure the vendor

248
00:13:02,120 --> 00:13:06,140
into fixing more quickly and making everyone aware of the vulnerability

249
00:13:06,140 --> 00:13:07,920
so they can take measures to secure themselves.

250
00:13:09,080 --> 00:13:11,900
Coordinated disclosure is that you're trying to work directly with the vendor

251
00:13:11,900 --> 00:13:14,500
so that they can fix it and then everyone can know about it.

252
00:13:15,000 --> 00:13:17,480
There's parts and parts here, and I know it's open to discussion.

253
00:13:17,480 --> 00:13:20,340
So, obviously, with full disclosure, it doesn't always work out well.

254
00:13:20,420 --> 00:13:22,720
Some companies won't fix it, and they don't really care about it.

255
00:13:23,260 --> 00:13:26,340
Other times, with coordinated disclosure, even after you coordinate with a company,

256
00:13:26,540 --> 00:13:28,180
they don't really take measures to fix it.

257
00:13:28,280 --> 00:13:32,160
And also, with coordinated disclosure, since you don't immediately tell everyone about it,

258
00:13:32,220 --> 00:13:34,500
there are people left unsecured because they don't know about it,

259
00:13:34,520 --> 00:13:36,140
and they can't take measures to secure themselves.

260
00:13:37,840 --> 00:13:39,200
Obviously, neither of these are perfect.

261
00:13:41,900 --> 00:13:45,340
So, with full disclosure, public disclosure of the vulnerability

262
00:13:45,340 --> 00:13:47,040
is that the researcher is...

263
00:13:47,480 --> 00:13:50,160
the researcher is discretion, so they can do whatever.

264
00:13:50,380 --> 00:13:53,000
If they decided that they found it today and they were going to publicly disclose it,

265
00:13:53,080 --> 00:13:53,860
that's up to them.

266
00:13:54,080 --> 00:13:56,940
With coordinated disclosure, there's a time frame that they need to wait

267
00:13:56,940 --> 00:13:59,820
that it was agreed upon with the vendor.

268
00:14:01,800 --> 00:14:04,140
So, let's go over some scenarios, some real-life scenarios,

269
00:14:04,300 --> 00:14:05,200
and how this can go wrong.

270
00:14:05,520 --> 00:14:08,280
So, let's talk about first what can go wrong with full disclosure.

271
00:14:09,280 --> 00:14:11,700
So, a quick show of hands, does anyone know what the woody worm is?

272
00:14:11,820 --> 00:14:13,140
Has anyone been in security that long?

273
00:14:15,220 --> 00:14:16,320
I'm going to take that as a no.

274
00:14:17,400 --> 00:14:22,420
So, the woody worm was an exploit that happened on ISS systems.

275
00:14:22,860 --> 00:14:27,260
For those of you like me that didn't know what an ISS system was before doing the research,

276
00:14:27,480 --> 00:14:29,720
ISS systems are just pretty much firewalls,

277
00:14:29,740 --> 00:14:32,480
and here's a couple that were vulnerable to the woody worm.

278
00:14:32,660 --> 00:14:36,720
The woody worm exploited a buffer overflow vulnerability in this product,

279
00:14:36,980 --> 00:14:39,920
and how it happened is actually pretty interesting.

280
00:14:40,140 --> 00:14:43,480
It infected 12,000 computers within half an hour,

281
00:14:43,580 --> 00:14:45,820
and it happened because of a full disclosure.

282
00:14:46,080 --> 00:14:47,460
So, there was a security issue.

283
00:14:47,460 --> 00:14:48,960
There was a security company that identified a vulnerability,

284
00:14:49,420 --> 00:14:50,880
and after they identified the vulnerability,

285
00:14:51,120 --> 00:14:53,020
they immediately took to the internet, disclosed it,

286
00:14:53,060 --> 00:14:55,880
and said, hey, there's a buffer overflow in this product,

287
00:14:55,960 --> 00:14:57,820
and it gives you root access to all these firewalls.

288
00:14:58,280 --> 00:15:01,480
After that, somebody thought it was a really good idea to create a worm

289
00:15:01,480 --> 00:15:03,920
and infect all these firewalls at the same time.

290
00:15:04,040 --> 00:15:06,560
After they infected all these firewalls, they went on to infect other computers,

291
00:15:07,200 --> 00:15:10,900
and it ended up being that although those were 12,000 within half an hour,

292
00:15:10,960 --> 00:15:12,900
it ended up being a couple hundred thousand within a day.

293
00:15:14,940 --> 00:15:17,140
So, this is just an example of how, for disclosure,

294
00:15:17,460 --> 00:15:17,720
it can go bad.

295
00:15:18,680 --> 00:15:21,240
And for the sake of argument, I want, like I said,

296
00:15:21,300 --> 00:15:22,980
I want people to make the decision on what they want to do.

297
00:15:23,080 --> 00:15:25,340
I also have an example of how responsible disclosure can go bad.

298
00:15:26,100 --> 00:15:28,120
So, does anyone know what Groupon is?

299
00:15:28,980 --> 00:15:30,560
Oh, come on, people, you know what Groupon is.

300
00:15:31,680 --> 00:15:34,860
But Groupon is just like a website so that people can get, like,

301
00:15:34,880 --> 00:15:37,660
cheap offers on things that they want to buy or participate in.

302
00:15:39,460 --> 00:15:42,860
XSS is a vulnerability where you can inject JavaScript into a page,

303
00:15:42,940 --> 00:15:44,740
and then after that, you've got code execution

304
00:15:44,740 --> 00:15:46,580
on the user's side of the interface.

305
00:15:48,540 --> 00:15:50,300
So, BruteLogic, who is a security researcher,

306
00:15:50,460 --> 00:15:53,420
identified 32 instances of XSS in Groupon.

307
00:15:54,700 --> 00:15:55,980
When he identified this vulnerability,

308
00:15:56,400 --> 00:15:59,520
he responsibly disclosed it to them through the responsible disclosure policy.

309
00:16:00,960 --> 00:16:04,760
However, he also tweeted about it short after that,

310
00:16:04,800 --> 00:16:07,740
saying, like, hey, I found XSS in Groupon,

311
00:16:07,820 --> 00:16:09,220
but he didn't really give a lot of details.

312
00:16:10,020 --> 00:16:12,860
He just said, I found XSS in Groupon, and that was it.

313
00:16:13,640 --> 00:16:16,560
Groupon decided that they weren't going to pay out the bug bounty anymore

314
00:16:16,560 --> 00:16:19,700
because he tweeted about it, although he didn't give any details about it,

315
00:16:19,720 --> 00:16:22,240
about the actual vulnerability in these products.

316
00:16:23,680 --> 00:16:27,240
And also, on top of that, there was some legal, I guess,

317
00:16:27,260 --> 00:16:30,420
both of them pursued each other legally, arguing that I wanted, like,

318
00:16:30,480 --> 00:16:33,300
I want my money, and Groupon saying, I'm not going to pay you

319
00:16:33,300 --> 00:16:36,120
because you didn't responsibly disclose according to my standards.

320
00:16:36,540 --> 00:16:38,320
That's one of the problems with responsible disclosure,

321
00:16:38,440 --> 00:16:41,460
is that both parties need to agree upon what they want to do

322
00:16:41,460 --> 00:16:42,960
before they start things off.

323
00:16:43,480 --> 00:16:45,400
And in the case of BruteLogic,

324
00:16:45,400 --> 00:16:49,240
he didn't log out after he disclosed his vulnerability on his Twitter,

325
00:16:50,080 --> 00:16:55,100
and Groupon did actually make sure that all 32 instances were secured.

326
00:16:55,240 --> 00:16:57,140
He did all that work and didn't get a payout,

327
00:16:57,240 --> 00:16:58,400
which isn't necessarily fair.

328
00:16:59,600 --> 00:17:02,680
So I know, like I mentioned, you can either disclose or not disclose.

329
00:17:03,280 --> 00:17:05,160
A lot of people don't want to disclose vulnerabilities

330
00:17:05,160 --> 00:17:07,480
because they don't want to be in the position like BruteLogic was,

331
00:17:07,660 --> 00:17:09,780
where a company may pursue you legally.

332
00:17:10,080 --> 00:17:11,840
And for those of you that are worried about that,

333
00:17:11,920 --> 00:17:15,280
there is a very good organization out there called

334
00:17:15,400 --> 00:17:16,160
the Zero Day Initiative,

335
00:17:16,400 --> 00:17:20,960
that they take measures to help you, as a researcher,

336
00:17:21,000 --> 00:17:22,920
report these vulnerabilities to vendors

337
00:17:22,920 --> 00:17:26,560
and try to avoid all the friction that may happen in those cases.

338
00:17:28,140 --> 00:17:30,140
Likewise, for those of you that want to participate

339
00:17:30,140 --> 00:17:31,880
in the Zero Day Track today, you can.

340
00:17:32,640 --> 00:17:35,040
The Zero Day Track is just a bunch of IoT devices

341
00:17:35,040 --> 00:17:36,540
that the IoT Village brings here.

342
00:17:36,860 --> 00:17:39,340
And if you want to participate, just pick one, hack it,

343
00:17:39,480 --> 00:17:41,060
responsibly disclose to the company,

344
00:17:41,220 --> 00:17:44,160
and then you can participate in whatever assets,

345
00:17:44,160 --> 00:17:47,580
or I guess whatever is going to be given out at the end of the CTF.

346
00:17:50,060 --> 00:17:52,680
So now I want to go into the last part of my talk,

347
00:17:52,760 --> 00:17:54,080
and that's how we can make things better.

348
00:17:54,260 --> 00:17:55,640
So how can we make things better?

349
00:17:56,800 --> 00:17:58,140
There's two things to look about here.

350
00:17:58,200 --> 00:18:00,200
What can we do as a vendor to make things better?

351
00:18:00,320 --> 00:18:02,540
And what can we do as a researcher to make things better?

352
00:18:03,180 --> 00:18:04,540
From the perspective of a vendor,

353
00:18:04,700 --> 00:18:08,020
things that I think that we can do to make things better is

354
00:18:08,020 --> 00:18:09,560
first, identify the problems.

355
00:18:10,140 --> 00:18:11,220
The problem is availability.

356
00:18:11,840 --> 00:18:13,580
Not all companies have a bug bounty program.

357
00:18:14,260 --> 00:18:16,920
Or some companies don't even have a contact that you can say,

358
00:18:16,980 --> 00:18:19,760
hey, there's a vulnerability in here, you need to fix it.

359
00:18:20,340 --> 00:18:22,780
It's been the case that I've found that I've found

360
00:18:22,780 --> 00:18:24,800
cross-site request forger, cross-site scripting

361
00:18:24,800 --> 00:18:26,300
in two web applications recently.

362
00:18:26,520 --> 00:18:28,940
I contacted the company maybe in May,

363
00:18:29,020 --> 00:18:30,280
and they haven't gotten back to me yet.

364
00:18:30,540 --> 00:18:32,960
And it's just that case that I'm stuck in this loop

365
00:18:32,960 --> 00:18:35,680
where I'm talking to IT and no one really knows what to do.

366
00:18:36,080 --> 00:18:38,740
So hopefully if you're a vendor and you want to figure out

367
00:18:38,740 --> 00:18:39,940
what you can do to help people out,

368
00:18:40,100 --> 00:18:41,920
start off by being more available.

369
00:18:42,620 --> 00:18:42,980
Combativeness.

370
00:18:42,980 --> 00:18:45,300
So now I think things have gotten better.

371
00:18:45,460 --> 00:18:48,640
But before, whenever you found a vulnerability in a product,

372
00:18:48,820 --> 00:18:50,360
the first thing the company would do would be

373
00:18:50,360 --> 00:18:52,120
send off their lawyers to attack you.

374
00:18:52,360 --> 00:18:53,460
That's not necessarily fair.

375
00:18:53,540 --> 00:18:54,640
These people are trying to help you out.

376
00:18:54,720 --> 00:18:57,080
Think about that before you send the lawyers off.

377
00:18:58,300 --> 00:18:59,100
And naivety.

378
00:18:59,120 --> 00:19:00,500
And I put it in parentheses.

379
00:19:00,580 --> 00:19:01,600
I'm familiar with security.

380
00:19:02,100 --> 00:19:04,180
Is that you might find yourself in a situation

381
00:19:04,180 --> 00:19:05,600
where you're talking to a company

382
00:19:05,600 --> 00:19:07,480
and they don't really understand security.

383
00:19:07,740 --> 00:19:09,140
And if they don't really understand security,

384
00:19:09,340 --> 00:19:11,280
they think that this is not necessarily a problem

385
00:19:11,280 --> 00:19:12,660
and they just brush you off.

386
00:19:13,600 --> 00:19:15,260
So just to go over quickly

387
00:19:15,260 --> 00:19:17,500
over some of the solutions that I just mentioned.

388
00:19:18,340 --> 00:19:19,480
Create a bug bounty program.

389
00:19:20,100 --> 00:19:22,320
Have a contact for security-related issues.

390
00:19:24,400 --> 00:19:26,220
You have to understand that vulnerabilities,

391
00:19:26,620 --> 00:19:28,600
finding vulnerabilities in a product is a good thing,

392
00:19:28,640 --> 00:19:29,340
not a bad thing.

393
00:19:29,660 --> 00:19:31,940
So if a good guy finds a vulnerability in your product

394
00:19:31,940 --> 00:19:32,980
and they disclose it to you,

395
00:19:33,060 --> 00:19:35,860
take some time to fix it instead of arguing with them.

396
00:19:37,020 --> 00:19:37,860
Train your team.

397
00:19:38,040 --> 00:19:40,120
So I know I've talked to a couple people here

398
00:19:40,120 --> 00:19:41,120
that do trainings.

399
00:19:41,260 --> 00:19:42,540
But the whole idea is,

400
00:19:42,540 --> 00:19:43,520
if a company understands,

401
00:19:43,780 --> 00:19:45,680
if your developer understands what security is,

402
00:19:45,840 --> 00:19:47,920
it's going to be easier for them to understand

403
00:19:47,920 --> 00:19:49,520
what the vulnerability exactly is.

404
00:19:50,080 --> 00:19:51,780
And become part of a security community.

405
00:19:51,940 --> 00:19:53,860
If you're a company that wants to be better,

406
00:19:54,220 --> 00:19:56,520
improve yourself by attending a security conference

407
00:19:56,520 --> 00:19:58,260
and understanding that there are security vulnerabilities

408
00:19:58,260 --> 00:19:59,020
in your product,

409
00:19:59,140 --> 00:20:00,860
whether you understand them or not.

410
00:20:02,120 --> 00:20:04,760
So next I want to go over what, as a researcher,

411
00:20:04,820 --> 00:20:06,140
we can do to make things better.

412
00:20:06,640 --> 00:20:08,860
As a researcher, there are a couple problems,

413
00:20:08,980 --> 00:20:09,700
and that's arrogance.

414
00:20:10,120 --> 00:20:11,660
So you might find yourself in a situation

415
00:20:11,660 --> 00:20:13,260
where you're talking with a security analyst

416
00:20:13,260 --> 00:20:15,700
that doesn't really care about whether or not

417
00:20:16,460 --> 00:20:17,480
a product is secure.

418
00:20:17,580 --> 00:20:19,360
They care more about their own, I guess,

419
00:20:19,360 --> 00:20:21,140
being noted and understanding,

420
00:20:21,360 --> 00:20:23,100
like knowing that people think that they're important.

421
00:20:23,540 --> 00:20:24,760
Which isn't a good thing,

422
00:20:24,780 --> 00:20:26,400
because then after companies don't want to work with you

423
00:20:26,400 --> 00:20:27,700
because you're arrogant and it's not fun.

424
00:20:28,900 --> 00:20:30,360
Understanding complexity of a problem.

425
00:20:30,600 --> 00:20:32,900
So a lot of times you'll talk with security researchers

426
00:20:32,900 --> 00:20:36,060
that they will find a security vulnerability in a product

427
00:20:36,060 --> 00:20:38,140
and they'll just immediately disclose it

428
00:20:38,140 --> 00:20:39,060
without thinking about, like,

429
00:20:39,060 --> 00:20:40,820
oh, there's other issues related to this.

430
00:20:40,820 --> 00:20:42,940
I should responsibly disclose this to the vendor

431
00:20:42,940 --> 00:20:44,460
because there are higher problems

432
00:20:44,460 --> 00:20:45,620
that need to be taken care of.

433
00:20:45,900 --> 00:20:48,440
And I put stop fear mongering

434
00:20:48,440 --> 00:20:50,360
and a question mark and an asterisk

435
00:20:50,360 --> 00:20:53,580
because sometimes we may find a vulnerability in a product

436
00:20:53,580 --> 00:20:55,860
and say, like, this is a very big vulnerability

437
00:20:55,860 --> 00:20:56,740
in this product,

438
00:20:56,800 --> 00:20:58,680
but it's like an information disclosure or whatnot.

439
00:20:58,920 --> 00:21:01,900
I'm not saying information disclosure is not a big issue,

440
00:21:02,000 --> 00:21:04,280
but it's not as big comparing to something like RCE.

441
00:21:04,580 --> 00:21:05,840
So if you do find an issue,

442
00:21:05,900 --> 00:21:09,000
understand that the company needs to think about

443
00:21:09,000 --> 00:21:10,720
what they're doing as a business to improve themselves.

444
00:21:11,960 --> 00:21:14,720
So here are the solutions of what I think we can do

445
00:21:14,720 --> 00:21:16,700
as a researcher to improve security,

446
00:21:17,100 --> 00:21:18,360
and that is play by the rules.

447
00:21:18,580 --> 00:21:20,460
If a company does have a bug bounty program

448
00:21:20,460 --> 00:21:21,880
and you want to get the payout,

449
00:21:21,920 --> 00:21:23,860
the best that you can do is actually play by the rules.

450
00:21:24,080 --> 00:21:27,060
You can discuss with them what the rules are before playing,

451
00:21:27,200 --> 00:21:28,940
but if they do have something saying like,

452
00:21:29,000 --> 00:21:31,480
hey, we're not going to give you a payout if you disclose this,

453
00:21:31,640 --> 00:21:33,220
then you have to understand that that's the case.

454
00:21:34,600 --> 00:21:37,000
Work with companies to understand how complex an issue is.

455
00:21:37,100 --> 00:21:37,980
So like I mentioned,

456
00:21:38,060 --> 00:21:39,560
you might find a vulnerability in a product

457
00:21:39,560 --> 00:21:42,620
and not fully understand the impact of that vulnerability on everything.

458
00:21:42,840 --> 00:21:43,840
If you work with them,

459
00:21:43,860 --> 00:21:45,000
you can understand this in more detail.

460
00:21:45,840 --> 00:21:48,840
And understand some of the issues that have different impact

461
00:21:48,840 --> 00:21:50,900
comes with that whole vulnerabilities,

462
00:21:50,920 --> 00:21:53,000
information disclosure compared to RCE.

463
00:21:53,260 --> 00:21:54,340
If you do have something,

464
00:21:55,060 --> 00:21:56,000
talk with the company,

465
00:21:56,100 --> 00:21:57,460
understand what the impact is to them,

466
00:21:57,560 --> 00:21:58,660
and work with them,

467
00:21:58,700 --> 00:22:01,300
because you may understand things that they don't,

468
00:22:01,300 --> 00:22:04,120
which is that whole thing where companies don't really understand

469
00:22:04,120 --> 00:22:04,860
how security works,

470
00:22:05,040 --> 00:22:06,760
and you can work with them to improve that.

471
00:22:08,040 --> 00:22:08,480
So,

472
00:22:09,280 --> 00:22:10,920
this is kind of the end of my talk,

473
00:22:11,000 --> 00:22:12,860
but I want to do a recap to see where things are.

474
00:22:13,360 --> 00:22:14,940
So we have the IoT Village today.

475
00:22:15,280 --> 00:22:16,380
There's a bunch of different events.

476
00:22:16,520 --> 00:22:17,660
Play all of them if you want to,

477
00:22:17,720 --> 00:22:20,300
or just sit around and talk with people that have played them

478
00:22:20,300 --> 00:22:21,280
if you want to get a better idea.

479
00:22:21,640 --> 00:22:22,500
I'll be sitting around,

480
00:22:22,620 --> 00:22:23,920
or if you see people with purple shirts,

481
00:22:24,160 --> 00:22:25,340
they actually work here,

482
00:22:25,900 --> 00:22:27,220
or purple shirts with the logo,

483
00:22:27,280 --> 00:22:28,080
they actually work here.

484
00:22:28,420 --> 00:22:29,200
Talk with them,

485
00:22:29,280 --> 00:22:31,440
see what kind of things you can do in the CTF to participate,

486
00:22:31,640 --> 00:22:33,360
and get the most out of being a DEF CON.

487
00:22:35,140 --> 00:22:37,080
Vulnerability disclosures are definitely important,

488
00:22:37,300 --> 00:22:38,360
but you need to do them securely,

489
00:22:38,360 --> 00:22:39,760
and you need to talk with vendors

490
00:22:39,760 --> 00:22:41,460
so that you can improve security overall,

491
00:22:41,880 --> 00:22:44,560
and I think that we as researchers need to work with vendors,

492
00:22:44,560 --> 00:22:45,980
and vendors need to work with researchers

493
00:22:45,980 --> 00:22:48,160
to improve security if we think about going anywhere.

494
00:22:48,740 --> 00:22:49,120
So,

495
00:22:49,800 --> 00:22:50,620
thanks for your time.

496
00:22:50,820 --> 00:22:51,780
That's the end of my talk.

497
00:22:52,100 --> 00:22:53,420
We do have time for questions,

498
00:22:53,560 --> 00:22:55,320
and I really appreciate your time.

499
00:22:55,400 --> 00:22:55,740
Thanks.

500
00:23:02,360 --> 00:23:03,960
So, David, if you're here,

501
00:23:04,020 --> 00:23:05,020
that is four shots.

502
00:23:05,200 --> 00:23:07,120
Four shots, David, you need to take.

503
00:23:08,640 --> 00:23:10,500
And, yeah, so we do have time for questions

504
00:23:10,500 --> 00:23:12,260
if anyone has questions, or, yeah.

505
00:23:12,780 --> 00:23:13,760
You can come see me.

506
00:23:13,800 --> 00:23:15,900
I'll be around sitting if you want to talk about stuff,

507
00:23:15,980 --> 00:23:16,700
and thanks.

508
00:23:16,780 --> 00:23:17,440
You have a question.

509
00:23:17,500 --> 00:23:17,720
Go ahead.

510
00:23:22,700 --> 00:23:24,140
Can you speak a little bit louder?

511
00:23:24,160 --> 00:23:24,420
I'm sorry.

512
00:23:24,500 --> 00:23:25,280
There's, like, people talking.

513
00:23:40,880 --> 00:23:41,600
I've never...

514
00:23:41,600 --> 00:23:42,780
I haven't had the opportunity, like,

515
00:23:42,820 --> 00:23:43,820
talking with vendors on that.

516
00:23:43,880 --> 00:23:45,780
So I've talked with them mostly about their security issues,

517
00:23:45,840 --> 00:23:47,200
and sometimes I've spoken with them

518
00:23:47,200 --> 00:23:48,840
where it's more catered,

519
00:23:48,840 --> 00:23:50,780
so, like, having an on-premise instance of something

520
00:23:50,780 --> 00:23:52,280
is a good example of how that would work.

521
00:23:52,840 --> 00:23:55,600
But I, like, speaking of vendors, like,

522
00:23:55,600 --> 00:23:58,380
oh, like, not moving user information all on one server,

523
00:23:58,560 --> 00:24:00,520
having a centralized server being distributed,

524
00:24:00,780 --> 00:24:02,160
the best that I've seen is, like,

525
00:24:02,160 --> 00:24:04,240
whenever someone has an on-premises instance of something

526
00:24:04,240 --> 00:24:06,660
is the closest that you can get to that, I guess.

527
00:24:07,360 --> 00:24:07,720
Cool.

528
00:24:07,800 --> 00:24:07,920
Thank you.

529
00:24:08,220 --> 00:24:08,340
Thank you.

530
00:24:09,680 --> 00:24:10,240
Anyone else?

531
00:24:12,780 --> 00:24:13,200
All right.

532
00:24:13,220 --> 00:24:13,420
Cool.

533
00:24:13,680 --> 00:24:14,420
Thanks for your time, people.