start	end	text
2220	4320	Enable streamer mode.
5820	8120	Do we want that disabled?
8280	10480	I think you want it enabled, don't you?
15660	17300	That was my assumption.
17820	21440	Alright, well we should be going live.
22400	24300	Now we're live.
24800	27540	Okay, let's push that recording button.
30700	32940	Alright, chat!
32940	36540	If anybody is hanging out watching TrackOne,
36540	41680	feel free to start talking in the TrackOne channel on Discord.
41680	49260	You're also welcome to start giving us some questions over in the TrackOne live Q&A channel.
49260	56800	In the meantime, let's introduce our guests for right now.
56800	59480	We have Olek and we have Poontester.
59480	64460	I'm sure you two will come up with better ways to explain how to pronounce your names.
64480	66920	But thank you very much for joining us today.
66920	70380	Give us the name of the talk that you did,
70380	74520	and we'll start asking you some silly questions about it.
76400	81000	Okay, so the talk was Room for Escape,
81000	83800	Scribbling Outside the Lines of Template Security.
83800	87440	A talk around content management systems,
87440	91840	and in particular the template engines used in these systems,
91840	98420	and how we were able to break out of the sandboxes that they put in place.
99020	104740	If you have any questions about the talk or anything else,
104740	106960	maybe we can help you.
107660	109980	Just feel free to ask anything.
109980	112040	How do you like your handle pronounced?
114240	116160	I pronounce it Poontester.
116160	116640	Poontester?
116640	118000	I don't know if that's better.
118640	124360	I think that we just entered into one of the mighty arguments in the hacker world,
124360	125920	if it's Pwn or Pwn.
126040	129740	So we're going to go with Pwn because that sounds a little bit better.
130980	134540	So Olek, go ahead and give your little bit of an intro.
136000	136960	About myself?
137200	138880	Yeah, we'll click over to you.
140080	143910	I'm a security researcher for already more than 10 years,
144460	148040	and working for Micro Focus Spotify.
148620	157020	And I'm happy to have a chance to work with Pwntester for a couple of years already,
157020	160920	and it's our fourth shared research.
160920	163880	And I'm happy with these results,
163880	167440	and I hope to get something similar in the next years.
167440	168720	Absolutely.
168720	170300	I will retire.
171600	174060	Yeah, so that's a good segue, actually,
174060	177720	to talk while we're waiting for people to come up with some good questions for you.
177720	179760	Tell us a little bit about some of the...
180280	184320	This is definitely not your first talk here at DEF CON,
184320	190260	so just briefly give us some background on where you came from
190260	193620	and what the earlier talks were,
193620	197540	so that people know how to reach back and find you in the archives.
197540	200300	And then maybe touch on,
200300	204660	how does this one feel different than the other talks that you've done?
207610	215890	Okay, so I think the first one that we did together was Friday the 13th, JSON attacks.
216310	218130	No, actually it was...
218130	220970	Sorry, it was JNDI injections.
221030	221770	It was the first one.
221770	224810	Did we present that at DEF CON or just at Black Hat?
224950	226330	Just at Black Hat, you're right.
227240	231870	So the first one that we presented together was the JNDI injection.
231870	238290	I think the full title was something like JNDI injection...
239330	241470	How was that?
241470	243970	Dreamland to RC something.
244790	247750	Yeah, no, like a trip into RC.
247750	250930	I don't know. I don't remember the title anymore.
250930	257890	That was around JNDI injection in Java world of ecosystems,
257890	263120	which was then used for many of the visualization gadgets.
263630	266190	So that was a good one.
266190	269210	And then before that one, I presented at DEF CON,
269210	272260	one with Denis Cruz and AFPang,
272450	278330	that was called resting in your laurels will get you pwned or pwned.
278330	282030	Yeah, that was a nice one.
282030	286510	So the first one that we did together was this about JNDI injection attacks.
286510	290490	Then the first one that when we presented at DEF CON
290490	294170	and we had to drink our shots as newbie speakers
294170	300050	was this one about JSON attacks, JSON visualization attacks.
300050	300710	Gotcha.
300710	308190	And then last year we presented SSL Wars, the token menace,
308190	315730	where we presented an attack on some implementation in Microsoft stacks
315730	319390	that was flowing in .NET framework.
319830	325170	And now this year we repeat again as a team with this one.
326350	329730	Excellent. We really appreciate that you both came out to do that.
331070	335410	You two, as we're waiting for people to jump in with more questions,
335410	338870	you did present me with one that I'm going to sneakily slide in here
338870	340610	as if somebody else asked it.
340610	343850	The vulnerabilities that you disclose all seem to require
343850	347130	that the attacker have user-level access to the system.
347130	348430	Is that true?
350190	351890	Is that a hurdle for most...
351890	354850	Oh, see, now I'm talking over you. So your turn, Hugo.
355970	358350	Okay, I think it's mostly true.
358350	361470	It still depends on applications, on configuration,
361470	363510	on specific configuration.
363510	366410	But to be able to perform such attacks,
366410	371070	attackers should be able to create or at least modify some template.
371210	376250	And in most cases, it's at least user-level account.
376250	378790	For SharePoint, it's just user-level account.
378790	381690	It's default configuration and just user-level account.
381690	384810	Any user in default configuration can do this.
384810	388330	For other applications, it still depends.
388330	390270	Sometimes it's just user-level.
390270	394330	Sometimes you need to be like writer or some other roles,
394330	396410	more powerful roles.
396410	398730	Sometimes even administrator.
399330	404050	So one requirement for our attack,
404050	407790	attackers should be able to manage these templates
407790	412370	or ISPX pages in case of SharePoint.
412370	414330	Okay, so maybe not.
414330	418710	The minimum is just they have to be able to deal with the SharePoint side.
418710	420990	They have to be able to control that.
420990	424350	But it's not necessarily that...
424350	433570	So for SharePoint, it's a bit simpler.
433570	438610	Any user can have access to own private site and can manage it.
438610	440650	It's your site.
440650	446290	And you can use at least this site for performing attacks.
446290	448730	For other applications, yes.
448730	452870	It depends on configuration, depends on permission for specific projects,
452870	458750	for specific sub-sites and other things.
458750	459610	Okay.
461230	465110	So I was going to add that our assumption in this talk
465110	469670	is that we were able or the attacker were able to control the templates.
469670	477130	And then our research was around breaking outside of those sandboxes.
477130	482710	So in a similar way that we may present something around breaking mitigations
482710	488030	for buffer overflows, but our research was not how to find those buffer overflows
488030	489930	in the first place.
489930	496090	So I'm saying that because apart from being able to control the contents
496090	500090	of the template, different vectors may include things
500090	504150	like server-side template injection, or maybe, for example,
504150	507070	if there is a cross-site scripting vulnerability in that page,
507070	512650	you can use that to fool a victim into submit a malicious template
512650	514170	on your behalf.
514170	518750	Or maybe there is a cross-site request for you that you cannot use
518750	521910	in order to manipulate or modify the template content.
521910	526510	So we didn't really care about how you were able to get access to the content.
526510	530650	It may be because you have access to, like Alexander explained,
530650	534110	it's the normal case, for example, in things like SharePoint
534110	537410	or a wiki, for example, where you can edit your own articles
537410	538370	and things like that.
538370	542150	But maybe in other systems, some of the ones that we reported,
542150	544730	like Office, for example, they were vulnerable to server-side
544730	545950	template injection.
546110	551890	And for example, in some cases, we were able to request trial accounts
551890	555610	in content management systems that were deployed on the cloud,
555610	559150	like in software-as-a-service architectures.
559150	564690	And with those trial accounts, we were able to hone those servers
564690	566970	and compromise the underlying servers.
567230	573990	So in a big way, you've given us another step in our chain,
573990	579110	another tool to escalate how much damage we can do once we have a foothold.
580390	581650	Yeah, exactly.
581650	582310	Excellent.
582310	588390	What level of access were you using to get that remote code execution?
588390	592510	Were you just a regular user and able to escalate that far?
593110	596610	So in some cases, like Alexander explained for SharePoint,
596610	601090	just having an account in SharePoint, like a regular user account,
601090	602970	allows you to create your own site.
602970	606390	And then you can control the template or the ASPX page,
606390	608130	in this case for SharePoint.
608130	610590	And then you can use that to get remote code execution
610590	612690	on the underlying server.
612790	616390	In other cases, like XWiki, just a regular user as well.
616410	619190	Other systems, like for example, Atlassian Confluence,
619190	624270	you were required to be administrator in order to edit a template.
624270	627170	So in those systems, either you are an administrator,
627170	629430	so it's kind of more like an insider attack,
630210	634550	or maybe those systems are vulnerable, as I explained before,
634550	636610	you find a cross-site scripting vulnerability,
636610	638970	and you can escalate from cross-site scripting
638970	643170	to remote code execution by being able to fool the victim
644170	648030	to submit or modify a template on your behalf.
650430	654370	Okay, so can you give us a little bit of background
654370	657370	on how you came upon this type of research?
657370	661270	What was your entry point into doing this attack?
664310	666790	It's not easy to answer.
666790	671750	It's as usual, when you have some target that allows you something,
671750	675570	and you think, wow, it's a lot of things for attackers,
675570	677410	and it starts the game.
677410	681250	You try to use one thing to bypass something.
681250	686750	For example, SharePoint, it allows you to upload ASPX pages.
686750	691870	So the first thing, why we cannot put only the code there
691870	693890	and execute code there?
693890	696010	No, we cannot. Why we cannot?
696010	698110	And game starts.
699630	702110	And it's not only SharePoint.
702110	706210	There are a lot of such server or services that allows you
706210	710650	to define some templates for dynamic content,
710650	713650	and actually you can access getters.
713650	715630	You can access some methods.
715630	718270	You can access some objects.
718750	720430	Why we cannot abuse them?
720430	723200	Let's try. Let's see what we can do.
723200	726360	What we can do further with all this stuff.
726420	730540	And it starts our research investigation,
730540	733580	and at the end, we have such results.
734360	736320	You chained it down.
736960	738220	I'm on mute.
738220	740780	So you pushed it down that direction. That makes sense.
741440	746740	And I'm assuming then we're kind of talking to a general mindset
746740	749200	when you're doing your normal day-to-day work.
749200	751580	You find something that's a little funny,
751580	754840	and you just can't let it go.
754840	757800	I mean, this is that greater question about,
757800	760020	what does it take to be a hacker?
760480	764700	It's always nice to hear people who are out there in the world
764700	767720	doing these presentations, doing this research,
767720	773580	talk to the rest of us who are getting our feet wet
773580	776580	in the world of web application security
776580	780100	or whatever your niche is.
780100	784100	How do the rest of you folks who are getting all of the success,
784100	785940	doing these cool presentations and research,
785940	788060	how do you approach these?
788060	790180	How do you know when you have something cool?
792940	799120	So in my case, and continuing Alexander's response,
799120	802980	I guess that I started this research because Oleg came to me
802980	806020	and said, like, okay, I found these four different ways
806020	808960	of breaking the server in safe mode.
808960	812760	For that time, I mean, we found a lot of more.
813380	817980	So he said, like, maybe if we also look at the Java side,
817980	821120	we get something interesting that can be interesting,
821120	826560	like a full research, like something that is more self-contained somehow.
826580	829360	And then he told me, like, can you take a look
829360	832320	at some of the most popular engines in Java?
832320	835500	And when I was there, I was like, okay, let's see.
835500	839260	Before I started looking at the implementation of those engines
839260	842460	and do, like, code review and things like that,
842460	844880	it was like, okay, I'm here. I get access.
844880	847220	I assume that I get access to a template.
847220	850160	What can I do now? What objects are available?
850160	854280	So I started looking and inspecting the template context
854280	858520	by debugging the applications and setting some breakpoints.
858520	861860	And then I was surprised that I was able to access
862560	867980	thousands of objects that were non-intentionally exposed.
867980	871860	They were, like, they're indirectly exposed by other objects.
872000	875020	And with that big amount of attack surface,
875020	876980	it was like, this is going to be easy to find something
876980	879480	that I can use to get remote code execution.
879480	880580	That was the case.
880580	882920	And then as a second part of the research,
882920	886540	we started looking at the implementation of those libraries.
886540	891400	And then we found some specific flaws in the implementation.
891400	894840	The way they were checking block lists, for example,
894840	898920	or gaps on those block lists or things like that,
898920	900760	that I explained in the talk.
901000	903080	That was your entry.
903080	904920	You, all of a sudden, you're like, I have something.
904920	907460	And then you spent a significant amount of time
907460	910820	testing the boundaries of the thing that you had
910820	914640	until you worked your way towards where we are now.
914740	916340	That makes sense.
916340	919400	It's always good to hear from you folks,
920100	922020	kind of where you're coming from on that.
922460	927300	So I saw a few different content management systems
927300	928520	that you looked at.
928520	931980	And I imagine at some point, you just kind of run out of time
931980	934060	to keep checking things.
934060	936120	Do you think that there are still more out there
936120	937840	that people could follow your techniques
937840	942060	and do the same kind of thing to find vulnerabilities?
942060	943840	Is that also going to be an area
943840	946940	that you plan to continue to research?
946940	948740	Or are you guys kind of done with this one?
949980	952620	Definitely, there should be a lot of products.
952620	955060	We think there are a lot of products.
955060	961180	As you mentioned, just a couple of them are under our focus.
961180	964580	And actually, for example, if you're talking about SharePoint,
964580	966480	it is not an automated approach.
966480	969240	It's just manual and just to find some patterns.
969240	973440	And we try to show this pattern in our presentation.
973580	977700	And I believe there's still a lot of things to look for
977700	981980	in SharePoint specifically and about other content,
981980	984220	even not content management system.
984220	991140	In any other system, like maybe email servers,
991140	996240	if you can define a template for dynamic content
996240	998840	for some auto-creation emails,
998840	1002680	it can be a starting point for your research as well.
1002680	1006940	So our purpose of our research, our presentation,
1006940	1015080	just show our patterns, our approaches and say,
1015080	1019040	hey guys, we use this and we got such results,
1019040	1021920	like 30 new vulnerabilities.
1022080	1023900	You can use the same.
1023900	1025820	It's not only for offensive side.
1025820	1028180	It's for defensive as well.
1028180	1037360	Guys, if you are developing something that go in this bucket,
1037360	1042280	you need to look on these areas to check this
1042280	1046660	because you can see what can happen.
1046820	1051520	So, of course, anybody welcome to continue this research.
1051520	1054400	About myself, I'm not sure.
1054400	1060220	I need to have some rest, vacation, couple months after that, maybe.
1060220	1065780	But usually, if you can see our talks, they are not linear.
1065860	1068600	We are jumping from one topic to another topic.
1068600	1071220	It's more interesting for me.
1071220	1073820	But I do not know, maybe.
1074060	1078140	If I still find something interesting, I will continue.
1078140	1081540	But for the next year, to be honest, it will be more difficult
1081540	1084220	because competition will be more higher.
1084220	1090460	Maybe it's better to leave this for others and try to find some new areas.
1091620	1097680	Based on all the different presentations that you two described earlier,
1097680	1102320	it seems like you two work together really well in finding these types of things.
1102320	1105000	I know some people earlier were asking,
1105000	1110700	how should somebody go about starting out research and picking out targets?
1110700	1117200	Do you have any suggestions for people on how they can start getting into the type of research field
1117200	1120840	that you two seem to do really well?
1123080	1127900	I don't think that one is easy to answer.
1129020	1135660	It's just like, at least for me, being up to date with the latest research
1135660	1139680	from other people in the community and industry.
1139680	1144660	Or maybe reading articles that are not directly related with what you do.
1144660	1149560	For example, I think that the JNDI injection that was the first one that we did together
1149560	1156440	started out of reading an article about a malware analysis.
1156720	1161800	And in that malware analysis, the malware was using some JNDI lookups.
1161800	1164900	We found that interesting. We started researching that.
1164940	1168020	And that led to the JNDI injection attack.
1168020	1172700	As part of that attack, we found some gadgets that were using setters
1172700	1177060	instead of magic methods in Java deserialization and so on.
1177060	1183320	And we found that as an entry point to the JSON deserialization attacks that we did the following year.
1183320	1186800	So sometimes one thing takes you to the next one.
1186800	1188820	Sometimes they are not even related.
1188820	1196000	Like jumping from JNDI to JSON deserialization or Mars Alert deserialization.
1196000	1201880	So sometimes just reading a lot of stuff gives you ideas.
1201880	1206960	Sometimes you just are playing with something in your regular work
1206960	1211600	and then you find something interesting and you just pull the thread and find something else.
1212060	1215900	It's just... I mean, things are not going to come to you.
1215900	1219760	You have to be actively reading, looking for things,
1219760	1222400	and then you will always find something that is interesting
1222400	1225540	and you can pull the thread and find something more.
1225540	1235300	If you just stay passive, like reading, but not asking yourself why things are working in such or such other way,
1235300	1238360	then I don't think that there is room for research.
1238900	1243220	And my suggestion is not to be focused on the results of the talk.
1245220	1251000	It's very difficult on the first year to be accepted in Black Hat or DEF CON or something like that
1251000	1252860	and produce such level of results.
1252860	1257940	I would suggest just to be focused on something, some area, what you like best
1257940	1262960	and you are passionate on that and follow for new research.
1262960	1268040	Try to understand each novel technique and maybe try own thing.
1268040	1271860	Maybe you have ideas and be passionate.
1272080	1277880	I think... I do not know. For me, it took a couple of years to get some...
1277880	1288120	If you are new, start to give your results and you can start to think about how to summarize this and present to others.
1288960	1296900	And just to start a career from Let's Talk at DEF CON, for me, it's difficult to imagine.
1296900	1302860	You need to have some background in this area and produce something new.
1302860	1306380	And for this, you need year... not years, you need time.
1306780	1310440	For somebody, it's months. For somebody, it's years.
1310800	1316660	But still, for me, it's main target, it's my passion in that areas.
1317280	1320780	Not just talk in DEF CON. DEF CON, it's results.
1320780	1322860	If you have results, you can present it in DEF CON.
1322860	1327000	If you do not have results, let's wait, let's try other direction.
1327000	1331420	But you need to like this. Without passion, it's difficult.
1331420	1336320	I love that you two said really quite different things there.
1336320	1341320	In one case, you have, hey, I was reading an article and then I thought really deep about that article.
1341320	1345480	But it seemed like it was something different from your previous research.
1345500	1351820	And then the other answer would be, I just really like this stuff and I learned everything I could about it.
1351820	1357940	So it's nice to hear the two different sides, if not the two different sides,
1357940	1363240	about how to approach a new topic and how to find something cool in it.
1363240	1368740	Which is probably why they work together so well and have had so much great research through the years.
1368760	1372760	We have very different approaches for everything.
1373600	1375960	Even research is different.
1375960	1387940	For example, I never read documentation before research.
1387940	1391920	It took more time, but I have some rules.
1391920	1395980	Do not open documentation.
1395980	1400330	Arvaro starts with documentation and can find something more quickly.
1401400	1403280	Significantly quickly.
1410580	1414780	So what did we not get to see during this presentation?
1414780	1419740	I know you've already talked about when your presentations tend to jump around a little bit.
1419740	1427300	So maybe you have the opportunity to hit more content or whatever you wanted to present during your go.
1427300	1433900	But due to time or due to not having it fully formed in your head,
1433900	1440600	what would you have liked to have put into this presentation where there was more time, more ability?
1441920	1447440	So there is a lot of content that is not in the actual talk, in the actual video.
1447440	1452000	But it's available in the white paper that we released as part of the talk.
1452000	1456560	It's simply that we were not able to fit all the content in those 40 minutes.
1456560	1464580	Apart from that, that's something that just didn't fit into the time allocated for the video.
1464640	1468840	I think that I would also like to have looked into other languages.
1468840	1471480	We just focused on .NET and Java.
1471660	1479040	And maybe for .NET, I would also have looked into other content management systems that are different from ServePoint.
1479040	1483660	Maybe, I don't know. I'm not really very familiar with .NET ecosystems.
1483660	1492400	But, for example, .NET Nuke is a potential target that we just didn't have time to look into.
1494280	1497400	I agree with Alvaro. Actually, we have more findings.
1497400	1501440	And usually, when you start to search something, you have more findings.
1501440	1505240	But you need to collect them in some topic, in some scope.
1505240	1507780	Of course, a lot of things are out of scope.
1507780	1511680	Maybe for the later research, maybe for some blog posts.
1511680	1514120	Maybe not. Maybe it's not interesting.
1514400	1515660	Something like that.
1516060	1523040	It depends. If you have, like, a two-hour talk, maybe we will include some new stuff for SharePoint.
1523040	1528780	There was some interesting stuff, because there was some playing with roles and other things.
1529900	1541580	But I think our current white paper meets the scope of what we drew before this white paper and talks.
1541580	1542780	And it's more interesting.
1542780	1549520	When you have a lot of stuff, it's not good as well, because it's very difficult to focus on something.
1549540	1552720	Even this stuff, we have two parts, .NET and Java.
1552720	1557080	It's a bit different. Java has a lot of templates and giants.
1558300	1560480	.NET has only SharePoint.
1560480	1565820	It's a bit difficult to keep focus audience for these two parts.
1565820	1574080	I think if you want to include something else, maybe it's better to have separate talk, not in this.
1574080	1576540	To build a new talk. Makes sense.
1576540	1578920	It's nice to be able to isolate down.
1578920	1582760	We always keep some sprouts.
1582760	1584180	How do you say that in English?
1585600	1589180	Something like seed sprouts for the next talk.
1589180	1591280	Something that looks promising.
1591700	1598440	Maybe it's a new way into a new road that can lead to something.
1599720	1603540	That's also something that we normally don't include in the talks.
1604920	1607280	You're never going to retire from this, are you?
1607280	1611220	There's always going to be something new and interesting to do a talk on.
1611740	1616500	It's difficult because competition from year to year, it's more harder and harder.
1616500	1620000	A lot of new guys and a lot of old guys.
1621240	1623020	It's not easy.
1623540	1628160	Let's hope that we will have motivation and time and resources for new researchers.
1628160	1629380	We like this.
1629680	1631380	Life will show.
1633380	1636940	We have about five minutes left in our scheduled time here.
1638920	1640920	What's your call to action?
1640940	1646000	Where would you direct people to keep poking at this?
1646000	1651040	Or what's something that, as you were hunting through all of this, that you were like,
1651040	1658140	Oh, this would be something that I want somebody to look at, but maybe I don't have the background or the time.
1659220	1661340	What's the gap?
1665370	1667410	There's your question out of the blue.
1668150	1674490	Yeah, so as I said, we didn't look at other languages.
1674690	1682710	I know there is a lot of research around server-side template injection in JavaScript and Python.
1683630	1686510	But yeah, so those are sandboxes as well.
1686510	1690450	And probably those sandboxes need to be bypassed.
1690450	1704850	A good direction for people wanting to look into this area of research is looking at how these other languages implement sandboxes and maybe try to find a way to break them.
1705770	1710930	I agree with Edovara. Actually, we have two different .NET and Java languages.
1710930	1717470	I think if we found something similar in these two languages, we can assume that many others are affected.
1717470	1720430	It's not a problem in languages, it's a problem in design.
1720430	1725650	Actually, it's very difficult to implement good sandboxes for these cases, I believe.
1725750	1727490	It's very difficult.
1727490	1733550	There are a lot of potential areas and we try to highlight the most obvious of them.
1733550	1746450	And I think it's a good idea to look in any places, in any languages, in any system, in any other place.
1746450	1749350	That makes sense. Well, thank you for that.
1749610	1756910	If you would be so kind, you can toss us in probably the TrackOne channel would be a good place for this.
1756910	1760250	Any place that folks can contact you later.
1760270	1769630	Since this is a new format, we can actually put down if there's an email address or a Twitter profile or a GitHub.
1769650	1771570	You could post that in that channel.
1771570	1772870	I don't know if you can hear me.
1773450	1775170	I can, as a matter of fact.
1775170	1776450	Oh, maybe.
1777130	1778530	I can hear you.
1779710	1782190	We might have just lost him.
1782190	1783230	You're back.
1783230	1786910	Yeah, I'm back. I lost all of you.
1787630	1788830	Well, welcome back.
1788830	1795370	So we were just chatting about if there is a GitHub or a Twitter profile or an email or something that you...
1795370	1799610	I believe you put something like that in your talk, but...
1799610	1801410	Can everybody hear me?
1802150	1807190	So my personal Twitter handle is Pontester, obviously.
1807190	1815070	And also I work for the GitHub Security Lab, where all the advisories for the different content management systems
1815070	1822970	with the details about how we were able to exploit them or break their sandboxes are being published.
1822970	1825790	Some of them have been published already.
1825790	1827670	Some of them are still to be published.
1827670	1830450	So you may also want to follow that one.
1830450	1834630	I think it's ghsecuritylab.
1834630	1835630	Just let me...
1835630	1841870	You can type that into the TrackOne channel at your leisure.
1842830	1845410	And people can see that there.
1846310	1847450	If there's...
1847970	1850650	And that's pretty much the last of the questions I have.
1850650	1859450	I want to thank you both very much for building this presentation and taking time out of your day to come and do this QA with us.
1859450	1864250	This is what makes this community better than anything else I've ever been a part of.
1864250	1866870	So thank you very much for your efforts.
1866870	1870250	And I hope to see more from you folks in the near future.
1871590	1873530	Thank you very much for having us.
1873530	1877750	And hopefully, yeah, we can present again in DEF CON next year.
1878110	1879670	And next time in person.
1880310	1881190	Definitely.
1881370	1882690	Next time in person.
1882690	1884430	Well, I appreciate it.
1884430	1885970	Have a great rest of your day.
1885970	1886970	Enjoy the con.
1886970	1898070	And to everyone watching, you should be able to see here in the next little while the contact information show up in the TrackOne channel.
1898070	1900570	Otherwise, we will see you for the next one.
1900630	1901610	Bye, everyone.
1902210	1903350	Have a good one.
1903530	1904470	Bye-bye.