1
00:00:00,000 --> 00:00:03,840
Guys, we have our next talk that is about to start.

2
00:00:04,040 --> 00:00:06,580
It will be given by Vladimir Dushchenko.

3
00:00:07,060 --> 00:00:09,800
Unfortunately, his partner, Sergey, cannot be here,

4
00:00:09,940 --> 00:00:11,500
so he's going to be handling this one solo.

5
00:00:11,840 --> 00:00:14,860
And it's going to be on pawning the industrial IoT.

6
00:00:16,120 --> 00:00:18,060
RCEs and backdoors are around.

7
00:00:18,600 --> 00:00:19,620
All right, thank you.

8
00:00:20,800 --> 00:00:21,860
Hello, everyone.

9
00:00:21,980 --> 00:00:25,120
Thank you for joining our session with Sergey.

10
00:00:25,280 --> 00:00:27,680
He's supposed to be standing right here next to me,

11
00:00:27,680 --> 00:00:30,540
but unfortunately, he cannot come here due to, like,

12
00:00:30,600 --> 00:00:34,180
a super long process of getting a visa to the United States.

13
00:00:34,360 --> 00:00:36,560
But anyway, Sergey, hi.

14
00:00:37,580 --> 00:00:40,540
And, yeah, today, me and Sergey,

15
00:00:40,660 --> 00:00:43,420
we're going to talk about the different vulnerabilities

16
00:00:43,420 --> 00:00:47,880
that we have identified for the last, I guess, 15 months

17
00:00:47,880 --> 00:00:51,320
in different industrial devices.

18
00:00:51,520 --> 00:00:56,660
But we will be focusing on the industrial Internet of Things.

19
00:00:56,940 --> 00:00:57,500
So.

20
00:00:57,680 --> 00:01:01,580
So I will give a brief explanation what is the industrial Internet of Things,

21
00:01:02,680 --> 00:01:04,700
what we have identified.

22
00:01:05,160 --> 00:01:08,560
But first, I would like to mention that me and Sergey,

23
00:01:08,720 --> 00:01:14,880
we are working at the nonprofit project in Kaspersky Lab.

24
00:01:14,980 --> 00:01:17,000
It's called Kaspersky Lab ICS SERP.

25
00:01:17,120 --> 00:01:22,520
And basically what we do, we do different vulnerability research.

26
00:01:22,780 --> 00:01:25,560
We do different sophisticated malware analysis.

27
00:01:25,820 --> 00:01:26,820
We are trained.

28
00:01:27,680 --> 00:01:29,560
We are tracking different sophisticated attacks

29
00:01:29,560 --> 00:01:32,120
on the industrial components and stuff like that.

30
00:01:32,340 --> 00:01:36,340
So we are a group of people who has, like,

31
00:01:36,340 --> 00:01:39,480
different and super cool background in malware analysis,

32
00:01:39,640 --> 00:01:42,420
penetration testing, security audits,

33
00:01:43,460 --> 00:01:45,560
security analysis, and blah, blah, blah.

34
00:01:46,200 --> 00:01:46,620
All right.

35
00:01:47,360 --> 00:01:51,040
So what is the industrial Internet of Things?

36
00:01:51,200 --> 00:01:54,060
So you guys probably know that there are, like,

37
00:01:54,080 --> 00:01:57,540
normal general Internet of Things, like, right behind you, right?

38
00:01:57,680 --> 00:02:02,200
So this is a new type of the concept, like general Internet of Things.

39
00:02:02,360 --> 00:02:10,940
New type of the concept when different vendors are trying to make any product smart.

40
00:02:11,340 --> 00:02:12,960
Smart this, smart that.

41
00:02:13,040 --> 00:02:13,860
Everything is smart.

42
00:02:13,980 --> 00:02:14,660
People are smart.

43
00:02:14,840 --> 00:02:15,520
Things are smart.

44
00:02:15,680 --> 00:02:21,200
But industrial world is also trying to go towards that way.

45
00:02:21,940 --> 00:02:27,580
So you probably can hear about or heard about the different,

46
00:02:27,580 --> 00:02:30,620
different smart meters, smart devices, and stuff like that.

47
00:02:30,700 --> 00:02:35,640
It helps to industrial companies to lower the expenses on different things.

48
00:02:35,720 --> 00:02:43,820
For example, smart meters are trying to help to track how much electricity we're using

49
00:02:43,820 --> 00:02:48,900
and, like, maybe we can, like, reduce the usage of electricity somewhere.

50
00:02:49,280 --> 00:02:53,940
Anyway, so this concept means that everything is connected.

51
00:02:54,160 --> 00:02:57,340
The smart industrial devices are also connected.

52
00:02:57,580 --> 00:02:57,880
Right?

53
00:02:58,020 --> 00:03:03,840
And they are connected with the, like, operators level.

54
00:03:04,040 --> 00:03:09,820
So all the information, all the metadata is going to the operators level.

55
00:03:09,980 --> 00:03:15,060
So the human can process that and can see, like, what's going on with the data.

56
00:03:17,280 --> 00:03:19,900
Yeah, basically, what is industrial IoT?

57
00:03:20,140 --> 00:03:22,740
Yeah, it's a fancy and cool concept, right?

58
00:03:22,840 --> 00:03:25,040
It's a fancy and cool solution.

59
00:03:25,280 --> 00:03:27,500
But still, it has...

60
00:03:27,580 --> 00:03:29,040
It has the old security problems.

61
00:03:29,320 --> 00:03:33,720
If we will take a look, if we will, like, see the low-hanging fruits and the vulnerabilities,

62
00:03:33,960 --> 00:03:43,360
even in new solutions in industrial control systems and, yeah, industrial IoT stuff,

63
00:03:44,060 --> 00:03:47,660
we will see that there are also still hard-coded passwords,

64
00:03:48,960 --> 00:03:54,160
I don't know, super stupid cross-site scripting vulnerabilities and stuff like that.

65
00:03:54,440 --> 00:03:57,440
But there is something bigger.

66
00:03:58,700 --> 00:04:03,720
This is the basic statistics that we have identified.

67
00:04:04,160 --> 00:04:07,980
So how many vulnerabilities and types of the vulnerabilities we have found.

68
00:04:08,260 --> 00:04:14,440
As you can see, the major part goes to the denial-of-service vulnerabilities.

69
00:04:14,780 --> 00:04:17,780
But the thing is that in industrial world,

70
00:04:19,740 --> 00:04:25,420
DOS vulnerabilities can be way more dangerous than remote code executions.

71
00:04:25,580 --> 00:04:26,300
So...

72
00:04:27,580 --> 00:04:32,840
If there is, like, a technological process and the attacker is trying to exploit the

73
00:04:32,840 --> 00:04:39,160
denial-of-service vulnerability, that vulnerability, that exploitation can stop the whole technological

74
00:04:39,160 --> 00:04:39,600
process.

75
00:04:40,040 --> 00:04:48,040
So they will start using the money, losing the money, or something more dangerous can

76
00:04:48,040 --> 00:04:48,360
happen.

77
00:04:49,180 --> 00:04:55,120
Yeah, we also found several injections, file manipulations, and there is one vulnerability

78
00:04:55,120 --> 00:04:55,900
right here.

79
00:04:55,960 --> 00:04:57,040
The account manipulation.

80
00:04:59,020 --> 00:05:03,400
It's basically, it's not a bug, it's a feature, I was told by the vendor.

81
00:05:03,540 --> 00:05:11,460
So the thing is that the remote attacker can disable Legimate user for, like, two or three

82
00:05:11,460 --> 00:05:13,980
hours, so the user will be blocked totally.

83
00:05:14,540 --> 00:05:19,800
So we submitted that vulnerability to the vendor, and the vendor was like, hey, you

84
00:05:19,800 --> 00:05:24,380
know what, it's not a bug, it's a feature, you can increase the time, like, in the configuration

85
00:05:24,380 --> 00:05:24,920
file.

86
00:05:24,920 --> 00:05:30,180
I was like, well, okay, it's not going to take, like, two hours, not two hours, but

87
00:05:30,180 --> 00:05:30,700
three hours.

88
00:05:30,920 --> 00:05:39,320
And they were like, we can just input this, you know, thing in our FAQ document so they

89
00:05:39,320 --> 00:05:41,260
can just increase the time to ten hours.

90
00:05:41,400 --> 00:05:43,600
I was like, well, it doesn't make any sense.

91
00:05:43,720 --> 00:05:49,460
So there is no CVE for that type of vulnerability, but, well, it looks funny.

92
00:05:49,600 --> 00:05:49,960
Anyway.

93
00:05:51,140 --> 00:05:53,880
So basic vulnerability research approach.

94
00:05:54,460 --> 00:05:54,900
First of all...

95
00:05:54,920 --> 00:05:59,820
First we start researching the custom-made protocols.

96
00:06:00,120 --> 00:06:06,260
It's super cool and it's super interesting to go deeper into the, like, custom-made

97
00:06:06,260 --> 00:06:06,660
protocols.

98
00:06:06,940 --> 00:06:16,360
Then we start playing with the DECOM protocol, and then we were playing with OPC UA.

99
00:06:16,520 --> 00:06:19,280
Did anyone heard about the OPC UA?

100
00:06:20,040 --> 00:06:20,720
Cool.

101
00:06:20,860 --> 00:06:21,500
Interesting.

102
00:06:21,780 --> 00:06:22,740
That's awesome.

103
00:06:23,280 --> 00:06:24,520
So OPC UA...

104
00:06:24,920 --> 00:06:25,960
It's a concept.

105
00:06:26,060 --> 00:06:31,960
It's open source type of the protocol and the way of communications of the devices.

106
00:06:32,360 --> 00:06:35,660
So yeah, the source code is available.

107
00:06:35,980 --> 00:06:39,120
And basically this is like a Lego for industrial companies.

108
00:06:39,760 --> 00:06:47,620
So using those tiny bricks of the OPC, any company, any vendor can build, like, a huge

109
00:06:47,620 --> 00:06:48,500
system on that.

110
00:06:48,680 --> 00:06:52,100
And the new approach is the common solutions.

111
00:06:52,460 --> 00:06:54,900
So we have identified that there are...

112
00:06:54,900 --> 00:07:00,660
There are lots and lots of different common solutions among the, like, hundreds of different

113
00:07:00,660 --> 00:07:01,120
vendors.

114
00:07:01,420 --> 00:07:04,120
So here are the examples.

115
00:07:04,500 --> 00:07:08,460
The first thing is about the custom implementation of the...

116
00:07:09,520 --> 00:07:10,460
Excuse me.

117
00:07:10,600 --> 00:07:13,820
About the custom implementation of the XML.

118
00:07:15,000 --> 00:07:22,200
So we have identified that if you're inputting the random data without knowing any, you know,

119
00:07:22,240 --> 00:07:22,560
tags.

120
00:07:24,000 --> 00:07:31,780
The server side returns you the, basically, what are the tags and what are the fields

121
00:07:31,780 --> 00:07:32,360
should be.

122
00:07:32,440 --> 00:07:33,520
The legitimate fields.

123
00:07:33,800 --> 00:07:36,920
We were like, okay, that looks interesting.

124
00:07:37,220 --> 00:07:43,800
So basically if you're input, like, XXXX, the XXX thing, it starts, you know, comparing

125
00:07:43,800 --> 00:07:48,300
if there is a field naming XXX with the real ones.

126
00:07:48,480 --> 00:07:51,880
And he's like, this thing is going through the whole thing.

127
00:07:51,880 --> 00:08:01,340
And shows, like, if XXX is equal to, like, AC, EC computer, object, and blah, blah, blah.

128
00:08:02,840 --> 00:08:06,220
Then we enhanced that thing.

129
00:08:06,320 --> 00:08:10,560
And, like, we have found that there are, like, different and different.

130
00:08:10,660 --> 00:08:13,960
So we basically have built the whole tree of the XML.

131
00:08:15,300 --> 00:08:16,420
That looks great.

132
00:08:16,540 --> 00:08:21,740
And that basically gave us the remote code execution.

133
00:08:21,820 --> 00:08:21,860
Okay.

134
00:08:21,880 --> 00:08:25,020
But it wasn't the binary remote code execution.

135
00:08:25,280 --> 00:08:27,400
It was the logical remote code execution.

136
00:08:28,240 --> 00:08:33,400
Which looks better than the binary one.

137
00:08:34,060 --> 00:08:39,580
The second example is about the OPC custom implementation.

138
00:08:40,100 --> 00:08:43,880
So this is basically the whole proof of concept of the denial of service.

139
00:08:45,180 --> 00:08:50,720
We have, like, internal feeling that there is remote code execution behind that.

140
00:08:50,720 --> 00:08:55,760
But we still haven't found the way how to exploit the remote code execution.

141
00:08:56,220 --> 00:09:03,200
So, yeah, this is the example how the, the, how we have identified that.

142
00:09:03,400 --> 00:09:09,280
And you have it just, you just need to send, like, a tiny packet to exploit the vulnerability.

143
00:09:09,680 --> 00:09:10,500
And that's it.

144
00:09:10,620 --> 00:09:12,060
The system goes down.

145
00:09:13,860 --> 00:09:15,720
And my favorite example.

146
00:09:16,880 --> 00:09:20,280
So if you probably, if you remember.

147
00:09:20,400 --> 00:09:20,700
How do you do that?

148
00:09:20,720 --> 00:09:27,320
my presentation yeah let me just show the name of the presentation right here

149
00:09:27,320 --> 00:09:33,100
right so you see it like there are remote code remote code executions and

150
00:09:33,100 --> 00:09:42,520
this word this this vendor didn't want me to name that word so I decided to

151
00:09:42,520 --> 00:09:51,780
change that word into the other one you will see now so yeah custom protocol but

152
00:09:51,780 --> 00:09:57,780
first custom protocol so first we have identified this thing just in like ICS

153
00:09:57,780 --> 00:10:07,160
and industrial IOT things but it became huge like super huge so there is a

154
00:10:07,160 --> 00:10:12,480
custom-made protocol so if you interact with that protocol as a

155
00:10:12,480 --> 00:10:12,500
protocol as a custom-made protocol so if you interact with that protocol as a

156
00:10:12,500 --> 00:10:19,420
with the HTTP server it will work with you as like HTTP server if you input

157
00:10:19,420 --> 00:10:26,240
binary data it allows you to do like some binary things with that so what

158
00:10:26,790 --> 00:10:31,260
happened these guys they had a custom made you

159
00:10:31,260 --> 00:10:36,480
know packer for for their solution so they wanted to protect their solution

160
00:10:36,480 --> 00:10:42,480
from like researching and stuff like that but for some reason

161
00:10:42,480 --> 00:10:48,380
for some reason they have removed removed well-known security things for

162
00:10:48,380 --> 00:10:54,880
example can we stack like safe cookie and stuff like that basically what does

163
00:10:54,880 --> 00:11:01,360
it mean if you find like the the the point where the this thing crashes you

164
00:11:01,360 --> 00:11:07,180
can just go like you can just exploit the remote code execution like super

165
00:11:07,180 --> 00:11:08,720
good so if you

166
00:11:08,720 --> 00:11:12,460
if you're paying attention to the security in the code and you

167
00:11:12,480 --> 00:11:18,380
you will see that there is like aaa and so it goes like really good and fast so it allows you

168
00:11:18,380 --> 00:11:25,280
to do the remote code executions but after after we have submitted the vulnerability to the uh to

169
00:11:25,280 --> 00:11:32,620
this vendor strange things started happening uh we submitted the vulnerability uh in december

170
00:11:33,660 --> 00:11:42,040
december 5th uh 2000 uh what is it 16 16 right so we submitted them two different uh remote code

171
00:11:42,040 --> 00:11:49,980
executions and 11 daniel service uh then i sent one more reminder because i didn't get any feedback

172
00:11:49,980 --> 00:11:57,480
from them uh then i sent one more reminder and one more reminder and um in january of 2017 i got

173
00:11:57,480 --> 00:12:04,700
the feedback from them that they received our vulnerability report and stuff like that uh then

174
00:12:04,700 --> 00:12:10,620
i was sending them reports almost every month but nothing happened so they were just sending me back

175
00:12:10,620 --> 00:12:11,440
like uh

176
00:12:12,040 --> 00:12:20,500
like hey just uh yeah thanks for your email uh you just have to wait for our feedback uh then they

177
00:12:20,500 --> 00:12:28,920
uh in when was it may or june they have submitted a new version of the driver but they didn't make

178
00:12:28,920 --> 00:12:36,060
any announcement after i didn't know that and our team didn't know that and we were still sending

179
00:12:36,060 --> 00:12:41,640
them emails and they were still replying that hey we're still working on that problem but the driver

180
00:12:42,040 --> 00:12:42,300
is updated

181
00:12:44,380 --> 00:12:52,040
it turns out that even after the driver was updated uh the uh they didn't submit the new

182
00:12:52,040 --> 00:12:59,180
version of the driver to to the like microsoft so if you update your windows system it will not

183
00:12:59,180 --> 00:13:07,020
get the new version of the driver that's that looks strange um after we decided to do this

184
00:13:07,020 --> 00:13:12,020
defcon talk on this vulnerability i have sent them email saying that hey guys we're gonna do like a

185
00:13:12,040 --> 00:13:17,520
uh iot village talk on the devcon about this vulnerability and they were like oh hold on

186
00:13:17,520 --> 00:13:23,600
a second we got the uh we got actually the advisory published but the advisory is on the

187
00:13:23,600 --> 00:13:29,920
like private website so you cannot like get it like online so you have to get the uh you have

188
00:13:29,920 --> 00:13:34,720
to log in somewhere get the advisory and stuff like that they didn't want to submit any cves so

189
00:13:34,720 --> 00:13:42,020
we did that for them um and yeah we of course notified the um usac cert on the, we are notified

190
00:13:42,020 --> 00:13:46,860
this vulnerability because the thing is that first we thought that this

191
00:13:46,860 --> 00:13:51,820
vulnerability is only like in like super custom-made solution and it and we

192
00:13:51,820 --> 00:13:56,920
didn't pay an attention but then we start like looking deeper and wider and

193
00:13:56,920 --> 00:14:07,700
we have identified that it's super huge yeah so those CDs are already it turns

194
00:14:07,700 --> 00:14:13,760
out that these guys they work with the thousands and thousands vendors under

195
00:14:13,760 --> 00:14:23,240
the OEM under the OEM theme and basically each vendor has thousands of

196
00:14:23,240 --> 00:14:29,400
the clients right so we still don't know how many people and how many companies

197
00:14:29,400 --> 00:14:35,800
are still vulnerable and we don't know how to notify everyone we didn't know how

198
00:14:35,800 --> 00:14:37,280
to notify everyone too

199
00:14:37,700 --> 00:14:45,680
to update the driver so this strange things started happening we continued

200
00:14:45,680 --> 00:14:52,140
our research on that and we have identified several strange functions

201
00:14:52,140 --> 00:15:00,120
yeah some functionality okay so basically what if you can remotely

202
00:15:00,120 --> 00:15:06,800
remotely turn on and turn off the administrative panel

203
00:15:06,800 --> 00:15:07,300
you can turn on and turn off the administrative panel

204
00:15:07,300 --> 00:15:07,320
you can turn on and turn off the administrative panel

205
00:15:07,700 --> 00:15:18,100
using undocumented API functions what if you can remotely make a

206
00:15:18,100 --> 00:15:24,700
configurations on the computer do the changes in the configuration file using

207
00:15:24,700 --> 00:15:32,860
the legitimate API functions again and it will not be so the security

208
00:15:32,860 --> 00:15:37,200
administrator will not see that right how do you call that

209
00:15:39,680 --> 00:15:42,980
how do you call that what's the name for that I'm not allowed to say that word

210
00:15:42,980 --> 00:15:45,980
what's the name for that I'm not allowed to say that word but anyway so it turns out that the those guys

211
00:15:45,980 --> 00:15:51,200
so we're doing some stuff someday I have no idea when so when we reported this

212
00:15:52,000 --> 00:15:56,920
functionality undocumented functionality to them they were like no no it's not

213
00:15:57,480 --> 00:16:02,380
it's not the bear it's not that thing it's our mistake in the code and we were

214
00:16:02,380 --> 00:16:07,060
like hey you just have a hidden functionality like in your solution right

215
00:16:07,060 --> 00:16:15,320
but like how can we manage that so how can we how can we how you cannot agree

216
00:16:15,320 --> 00:16:15,700
but like how can we manage that so how can we how can we how you cannot agree

217
00:16:15,700 --> 00:16:19,220
with this word and they were like no we don't agree with this or so we decided

218
00:16:19,220 --> 00:16:26,600
to call like not a bear thing yeah this is the basically what I have just said

219
00:16:26,600 --> 00:16:31,560
like remotely enable and disable admin administrative panel is nondocumented

220
00:16:31,560 --> 00:16:38,540
and the panel is available by default on like the local host right and the other

221
00:16:38,540 --> 00:16:47,980
thing is that basically if you have a Windows based computer right and the

222
00:16:47,980 --> 00:16:56,620
computer is locked right so you can just take this thing you know this USB device

223
00:16:56,620 --> 00:17:02,100
like it's official thing from from the vendor like it's not fake you just plug

224
00:17:02,100 --> 00:17:10,140
in this thing right what happens next the driver the vulnerable version of the

225
00:17:10,140 --> 00:17:16,780
driver is being uploaded from the like Microsoft service right the this thing

226
00:17:16,780 --> 00:17:25,520
opens a port the port is being added to the like a legitimate and open port to

227
00:17:25,520 --> 00:17:26,380
the Windows

228
00:17:26,380 --> 00:17:26,600
system

229
00:17:26,620 --> 00:17:31,300
firewall and the bit Windows firewall allows that port open and that's it

230
00:17:31,300 --> 00:17:37,480
that's done basically right you have the like the vulnerable Windows machine with

231
00:17:37,480 --> 00:17:42,620
open port and with some strange functionality so we started researching

232
00:17:42,620 --> 00:17:49,880
that thing and so the manipulations from the configuration file so basically you

233
00:17:49,880 --> 00:17:56,140
can change the the proxy server for the binary updates so if the attacker change

234
00:17:56,140 --> 00:17:56,520
the

235
00:17:56,620 --> 00:18:00,820
proxy server for the binary updates so you know what's gonna happen and we also

236
00:18:00,820 --> 00:18:06,380
have identified that it is possible it is possible to capture the NTLM hash of

237
00:18:06,920 --> 00:18:14,100
the built-in user of like there are several built-in users in the Windows

238
00:18:14,100 --> 00:18:18,640
operation system so you can capture that NTLM hash function and that's it so

239
00:18:18,640 --> 00:18:22,580
we submitted the thing to the vendor and they were like hey you cannot do the SMB

240
00:18:22,580 --> 00:18:26,400
relay attack I was like yeah of course we cannot do because like it's a building a

241
00:18:26,400 --> 00:18:31,740
user so it's not possible but still there is a possibility to do that so we

242
00:18:31,740 --> 00:18:40,200
decided to we agreed with the vendor to publish this advisory so but the thing is

243
00:18:40,200 --> 00:18:44,840
that we don't want to leave the world like you know vulnerable we decided to

244
00:18:44,840 --> 00:18:49,640
provide like open source and free overall definitions so they are available and you

245
00:18:49,640 --> 00:18:56,280
can download them and you can use the Mitre tool to you know to play with those overall rules all the

246
00:18:56,280 --> 00:19:01,640
definitions and you can check if your system vulnerable or not vulnerable to

247
00:19:01,640 --> 00:19:08,460
that thing so yeah the alert is being well is available here under this link

248
00:19:08,460 --> 00:19:16,940
link and so what are the conclusions so if the best thing is which can help to

249
00:19:16,940 --> 00:19:21,540
protect this world is knowledge sharing if you share the knowledge like everyone

250
00:19:21,540 --> 00:19:25,960
will be protected the second thing is well if you made a mistake someday

251
00:19:25,960 --> 00:19:31,000
you have to admit it you have to admit that well there was a problem but we

252
00:19:31,000 --> 00:19:35,900
are doing our best to fix the vulnerabilities and of course if you

253
00:19:35,900 --> 00:19:41,640
are going towards the new concepts for example industry 4.0 or like

254
00:19:41,640 --> 00:19:46,100
industrial Internet of Things or blah blah blah whatever well you have to do

255
00:19:46,100 --> 00:19:49,660
it right you have to put this security on the basement everything should be

256
00:19:49,660 --> 00:19:55,820
secured by design not like you know those things and of course if there

257
00:19:55,820 --> 00:20:01,180
are different third-party solutions I used in in a huge like industrial or

258
00:20:01,900 --> 00:20:06,660
industrial systems or industrial Internet of Things you have to test them

259
00:20:06,660 --> 00:20:11,460
properly so if you are like if there are any vendors and if you are using the

260
00:20:11,460 --> 00:20:17,180
different third-party solutions you have to test them first you have to see like

261
00:20:17,180 --> 00:20:22,080
the source code or you have to do the vulnerability research of that so you

262
00:20:22,080 --> 00:20:25,060
have to work you have to do what you have to do okay

263
00:20:25,820 --> 00:20:27,360
that's it thank you

264
00:20:37,500 --> 00:20:45,760
yeah so if you have any questions I'll be happy to answer yeah yeah

265
00:20:54,360 --> 00:20:55,720
oh it's different

266
00:20:55,820 --> 00:21:05,080
it's different our so our research group is working on the so we're CERT

267
00:21:05,080 --> 00:21:10,520
with like we're like a computer emergency response team so what do we do

268
00:21:10,520 --> 00:21:15,820
we do the like vulnerability research incident response if the customer asks

269
00:21:15,820 --> 00:21:20,560
us to do the penetration testing we do that so it's like we're research

270
00:21:20,560 --> 00:21:22,820
department the research group of people

271
00:21:43,500 --> 00:21:55,800
actually do that uh so in a job it just works like that every time the

272
00:21:55,800 --> 00:22:04,720
let me show you so yeah you're talking about like this case yeah so basically

273
00:22:04,720 --> 00:22:11,340
they have turned off not turn off but they didn't use for example safe cookie

274
00:22:11,340 --> 00:22:16,840
there there is a special mechanism it's called like safe cookie and they didn't

275
00:22:16,840 --> 00:22:23,660
use that like when they were writing is the code for that binary and like they

276
00:22:23,660 --> 00:22:29,600
didn't use like a really common and the world-known security mechanisms yep

277
00:22:36,360 --> 00:22:37,720
all right