start	end	text
9080	11400	Hey Bill, how do you pronounce your last name?
12980	17500	You're not going to be able to say it, but it's Demir Kapo.
18420	20040	Do you want me to try it?
21020	25880	I mean, I don't care. I won't get offended if you don't say it.
27880	29940	Looks like we are live.
29940	32180	Yep, we seem to be live. Alright.
33220	37840	Welcome everyone. I want to introduce Bill.
37840	43160	Bill, I just tried to do your last name in my head, and I was not successful at it,
43160	46340	so I'd like you to say it for everybody if you care to.
47120	48800	Sure, it's Demir Kapo.
48800	53780	Alright, thank you for that. Instead of me murdering that, I wanted you to try it.
53780	59520	So, Bill did a talk on demystifying modern Windows rootkits.
59520	62880	This is your opportunity to ask questions of Bill.
62880	70100	So, there are a few questions already coming in through the TrackOne Live QA channel.
70100	71740	Let's just go ahead and get started.
72760	81840	Eragon asks, what are the easiest features to find that might reveal a modern rootkit via static analysis?
83260	89120	I think a good place to start for static analysis is going to be the strings.
89120	94240	Because if they leave any debug strings behind, or any unique strings for that specific binary,
94240	97760	that's a good thing to maybe add to your signatures.
97760	103340	But another opportunity is going to be the imports of the driver.
103340	107940	For example, if a driver imports a bunch of undocumented functions,
107940	110420	that's obviously going to be a little bit more suspicious,
110420	116300	given that legitimate drivers tend to try to stick with what's documented and what's stable.
116300	124220	So, if there's any functions that it imports that is not stable, or it's just not really known about,
124220	126020	it's something to look at.
126180	129020	So, anything undocumented that's getting pulled in,
129020	134220	you're thinking that's going to be your opportunity for shenanigans on that side.
137060	137900	Potential.
138600	140120	What was that, Pasties?
140120	142540	I was just going to say that. Potential shenanigans.
142540	142980	Potential shenanigans.
142980	143980	It could still be legitimate.
143980	144920	Yeah, that's true.
144920	149860	So, next question from RPTK2015.
149860	154020	Did you actually find any P-key when searching in Greyhat?
154440	158980	Mentioned in the context of using a legitimate key to sign your driver.
159600	164560	Yes. So, I didn't, of course, crack any of them.
164560	167840	But, I mean, some of them were pretty obviously related to code signing.
167840	171080	For example, I remember one that had, like, code signing in its name.
171080	175600	So, it was pretty clear that these were probably associated with code signing
175600	181320	and that it's potentially, if you crack it, you could use it for kernel-mode code signing.
181320	188260	It all depends on the type of certificate it is and, you know, what vendor it came from and stuff like that.
188260	196820	But I have definitely, I can confirm that I've seen potentially viable private keys on Greyhat.
197340	201140	Do you know if there are some keys that are, like, more trusted than others?
201140	206800	Like, some that you can use to sign code but that aren't trusted for, like, kernel-level drivers or something like that?
206800	212600	I assume, like, a Microsoft signing key is, like, gold, but...
212600	218260	Yeah, yeah. So, usually how it works is that you have, like, these certificate companies
218260	220240	that issue these code signing certificates.
220240	224260	And they work with Microsoft to get what's called a cross-signing certificate.
224260	230200	So, this means that Microsoft says, yes, you can use this vendor or this root authority
230200	234280	can issue certificates for kernel-mode code signing, just to give you an example there.
234280	237740	And so, what you can do there is you can...
237740	243360	So, some vendors don't have a cross-signing cert and they probably will not work for kernel-mode code signing,
243360	244600	while others do.
245100	251220	And so, that's usually the different levels is whether or not the vendor has, you know,
251220	255340	deals with Microsoft or has a cross-signing certificate from Microsoft.
256020	261000	Where would I look up that information if I wanted to find out more of a specific cert?
261860	267020	Yeah, so, I think Microsoft has, like, a list of cross-signing certificates on just their...
268360	271180	on MSDN, Microsoft documentation.
271600	277540	Yeah, I found a page here. It's, like, cross-certificates for kernel-mode code signing.
278340	281800	Gotcha. Okay, so, a follow-up question on that one would be,
281800	287240	what's a good place to find leaked certificates were I to decide I needed one?
288480	293920	Yeah, so, one of the places I mentioned that it's a good place to start for looking for leaked certificates
293920	298460	is going to be on the... so, cheating-related forums.
298460	301500	There's quite a few available there that some of them have been out for years.
301620	305980	And I still think that, so, you can use them because a lot of the...
306260	310780	a lot of antivirus simply don't have detections in place for these leaked certificates,
310780	312880	even ones that, again, have been out for years.
312960	318200	So, if you're out looking for a leaked certificate, look at game-hacking forums,
318200	322220	look, like, search for leaked certificates, and then the game-hacking forums' names,
322220	326060	and I can guarantee you that you'll find some.
326060	330220	That's an interesting crossover that totally makes a ton of sense, but I was...
330220	333580	it's not something that would have come to mind if I was ever going to go look for that.
335380	342000	Yeah, especially considering who's making these things and, you know, who builds a lot of the games out there.
343060	344900	RPTK has another question there.
344900	350180	Can you explain a little more about why would the kernel accept a driver signed by an expired certificate?
350920	357320	Yes. So, when you see a... let's say you go into the digital signatures section of a driver,
357320	361140	and you see a certificate there, and it says, this certificate has expired.
361140	367640	Well, what you're seeing there when you go to the digital signatures section is the result of winVerifyTrust,
367640	373580	which is a user-mode function, whereas the kernel-mode code-signing policy is completely different,
373580	376320	because that's in the kernel.
376540	381380	So what you see returned by the winVerifyTrust function will, generally speaking,
381380	385760	not always be what the kernel-mode code-signing policy checks for.
385760	390640	And what I mean by that is, if the winVerifyTrust returns, this is expired, or this is revoked.
391860	398060	Some reasons that a kernel code... that you might be able to still load that driver is because,
398060	401440	at the time of signing, it was still valid.
401720	410640	So, even without a timestamp, the kernel just assumes that, since this was at some point signed by a valid certificate,
410640	415400	even if the certificate expired, it still should be loaded.
415780	417500	That seems like a problem.
419140	420180	Yeah, it seems like an overstatement.
420180	423240	Yeah, I think it's mostly going to be for compatibility reasons.
423260	428360	That's what I'd, I guess, assume. But it's speculation, given that I don't work for Microsoft,
428360	429680	so I don't know the reasoning behind it.
429680	431480	I'm sure there's a whole lot of history there.
431980	434480	So we have another question.
435620	442660	Trinsky is asking if you have any interest in creating a roadmap of resources, courses, or tutorials on your blog,
442780	446480	a person can get to your level of reverse engineering competency.
447360	454800	Yeah, so, for that question, it's mostly, you know, most of my, I guess, knowledge comes from just experience.
454800	460940	And the best recommendation I can really give is to just try things out, you know, do CTFs.
460940	463860	If you want to learn reverse engineering, you know, do the CTS.
464140	470080	And really, you know, one of the ways that I go about, you know, looking for even projects or stuff to do,
470080	473560	is I always stay curious. And what I mean by that is,
473560	479340	if I see some weird functionality by a program I'm using, like in real life, on my machine,
479340	483860	I will probably quickly try to check underneath of what's happening here.
483860	486040	You know, why is it doing this one weird thing?
486040	490980	And oftentimes, I've found that that can actually lead to other issues, like actual security issues.
490980	495260	So if you're looking for what, you know, what projects to do or what to reverse,
495260	498660	it's really just going to be the software you use in your everyday life.
498660	507220	And I don't have any plans to do like a course or something on just, you know, tutorials on how to reverse engineer, for example.
507220	515600	But it's going to be really going out and finding your own projects that you find interesting,
515600	520360	so that you'll continue pursuing it. That's, I guess, the trick I did.
520360	525440	The reason that I was able to learn so fast was because I always did stuff I was always interested in.
525440	528280	And that was, you know, in specifically game hacking.
528280	531360	I love games, and I'm bad at games.
531360	536180	So I had a, you know, self-interest to continue reverse engineering these games,
536180	540120	and figuring out how they work, and maybe how the anti-cheat works.
540120	544700	And then you'll end up learning a lot from just, you know, trying out things,
544700	549980	trying to reverse new programs you might have not had looked at before, stuff like that.
549980	555420	Well, a quick step back then. So you said you watch as a program does something unusual.
555420	560800	It's not exactly the words you used, but what types of unusual things are you expecting?
560800	564540	What types of things would make the radar go off?
564980	568880	So just to give you an example of like a vulnerability I found a few years ago,
568880	572320	was in the software called Dell Support Assist.
572320	578280	And how that worked was when I went to update my drivers, because I installed a new SSD,
578280	580400	I needed drivers for that one machine.
580400	585640	The website claimed to be able to update my drivers, but from the website itself.
585660	588500	And I was like, how does a website update my drivers?
588500	594320	Well, it turns out that Dell pre-installs this software that basically allows its own website
594320	598120	to communicate with it and install stuff like updates.
598120	602000	Well, that's kind of weird, you know, because you're allowing a website to have that sort of access.
602000	607680	And then I reverse engineered it further, and I found that the restrictions there weren't quite as strong.
607680	612360	And I found a way to bypass the restrictions the application had.
612680	617660	But so the weird part there was, well, it's a website claiming to, you know, update my drivers.
617660	624080	That's not normal. Websites, it normally can't just do it automatically update my drivers itself.
624180	626560	You know, it might be something I have to install and do it myself.
626560	628440	But so in that case, that was something weird.
628440	632400	It's just basically finding these, you know, why does this thing happen?
632400	634200	Why did they design it this way?
634200	640760	And it's looking for those logical flaws in their, like, design or just their code itself.
640900	644660	Yeah. So this is one that I've actually hit myself.
645980	650080	RPTK2015 asking another question, like, keep them coming.
650080	653720	This dude's pretty orchic. I don't know.
654000	657940	Could you explain on how secure boot blocks some of the driver signing methods?
657940	661160	I've definitely noticed that some drivers work with UEFI and some don't.
661160	663260	And it's usually a driver signature problem.
663260	674200	Yeah. So the main issue you're going to have with secure boot is if you're, like, going after using a leaked certificate or if you're buying your own certificate,
674200	680980	the thing to consider is if the certificate was issued after July 29th, 2015, that's the cutoff date.
680980	687400	Then you're going to need a EV certificate, so extended validation certificate on newer versions of Windows 10.
687400	696640	So what that means is you're going to have to, basically, the certificate vendors that give you these code signing certificates have to, you know, do extra validation.
696640	702520	And typically the certificate is given to you on, like, a USB drive instead of just sending you the private key file.
702800	708600	So that, you know, for versions of Windows 10 that have secure boot enabled,
708600	716140	you're basically preventing drivers that aren't signed with an EV certificate to be loaded just because that's the policy that follows.
716140	724320	And in those newer versions. And so, but if your leaked certificate was released before, issued before July 29th, 2015,
724320	731540	then it will still work on these newer builds with this secure boot protection, I guess you call it.
731820	742080	There is sort of an extension of that. When I encountered this issue, there was a registry flag that you could set that was sort of bypassed it.
742080	745760	It was unattended upgrade. It was from Windows 7 to Windows 10 upgrade.
745760	748900	Did you try playing around with that to see if we might?
749500	756560	I know, mostly because the leaked certificates, like you can just, the ones publicly available are issued before that cutoff date.
756700	760300	So, I mean, it's like, there's like, almost all of them are issued.
760300	766320	I mean, at least right now, you know, the leaked certificates I used was when I found it was issued before that date.
766320	770400	So I haven't actually found the leaked certificate that was issued after it yet.
770400	775740	So it's easy enough to find it that you haven't had to hunt down that possible other way to get it done.
777080	783360	Right, right, right. And so there's quite a number of ways you can approach the problem of, you know, getting your driver loaded.
783420	792040	And at that point, well, if you don't even need to look into, you know, other ways there, it's a non-issue, I guess you call it.
792040	800740	But it's something to keep in mind, you know, going forward, once those leaked certificates start to run out, you're probably going to run into that issue of that date restriction.
800740	812080	And at that point, I'd probably recommend the second method of loading a driver and abusing another legitimate driver that has been signed with like an EV certificate.
812280	820040	But again, the problem with that, in my talk, I mentioned it is that you can run into a lot of stability issues when abusing another driver and trying to load your own.
820040	825120	Just because there's oftentimes going to be stability concerns like race conditions.
825840	827200	That makes sense.
829980	835340	So Trunsky is asking, did you test your rootkit against any of the top EDRs?
835840	841720	No, I didn't. But I took EDRs into consideration when designing the application.
841720	847620	And for example, how I hook communication between the AFT driver and user mode applications.
847620	853880	I always went for methods that would try to make it as expensive as possible to detect.
853880	858600	Because I feel like that's the best approach is not security through obscurity.
858600	867620	It's going to be, how can I make the antivirus have to go through a very expensive and time-consuming process to detect me?
867620	870600	Because oftentimes they'll reconsider for those reasons.
870600	875680	Or another perspective might be, how can I cause compatibility issues?
875680	883120	If there's an application that already does these suspicious operations, maybe I can impersonate that application.
883120	888260	And the antivirus would have to accept it because the legitimate application also does suspicious operations.
888260	892120	Trigger bad false positives that they can't work around themselves.
892440	895720	Right, right, right. Or it's very difficult to detect around that.
896700	898600	Yeah, makes sense.
898600	904440	Yeah, I feel like a lot of security is just making the other side do more work to get to the same goal.
906980	910180	So RPTK asks another question here.
910560	917260	There were some methods you were able to see that were not HVCI compatible.
917260	921000	Can you please explain a little bit about HVCI mitigations?
922280	926960	Yeah, so the HVCI, let me look what it stands for.
926960	930620	It's like, yeah, virtualization-based protection of code integrity.
930620	933500	So essentially what it does is it's a mitigation.
933500	936720	If you have virtualization enabled, you should be able to enable it.
936720	943960	That basically makes it so once the driver is loaded into memory, especially its executable sections,
943960	948240	it can never again have those executable sections set to writable.
948720	958420	The memory protections will never be able to be writable for that memory page because it's an executable section.
958420	966920	So essentially it prevents code hooking, for example, or basically modifying the actual bytes of the driver's executable code.
967780	969580	That makes sense.
972260	979420	So I apparently missed this. Can you talk a little bit about your Peacemaker project and how it compares to Spectre?
980680	991840	Sure. So Peacemaker was a proof-of-concept EDR that I wrote a few months ago, which was basically the opposite of what I'm doing now.
991840	995960	Instead of writing a rootkit, I wrote a driver to detect malware.
996240	1004940	And the biggest difference between the two is the fact that one of them is a blue-teaming defense application while the other one is a rootkit.
1005260	1008020	But how does it compare?
1008020	1014020	Well, Peacemaker is going to be... I believe it's a little bit less efficient in general.
1014020	1021400	And I followed a stricter code design policy for myself in this latest one.
1021400	1028300	So, I mean, those are, I guess, how it compares. But they're two different projects for two different reasons.
1030100	1037200	That's fair. So speaking about other projects and other places you might want to push this research...
1037800	1050920	You already mentioned a little bit about a gap of the upgrade process for if you end up running out of certificates that were signed before the cutoff date.
1050920	1057920	What other interesting things are out there for somebody who wants to do research in the same field that you're in?
1057920	1064300	What would you recommend for somebody who is looking for a neat project to jump in and start working?
1065900	1072440	So for, I guess, neat projects of where to start, it would first of all be...
1072440	1078100	If you're interested in learning more about the Windows kernel or the internals of the Windows operating system,
1078100	1082960	the best recommendation I have, besides experience, is going to be...
1082960	1088080	Some of the books out there include the Windows internals, 7th edition is the latest one,
1088080	1092580	that really goes into depth about the internals of the Windows operating system.
1092580	1101200	But it's really going to be finding a way to make security interesting for you or make learning interesting to you.
1101200	1105080	And that's the best way I can recommend, I guess, of how to...
1105080	1114660	What's the best way to go about learning these difficult topics is to gamify it and is to incentivize the research itself.
1115920	1119660	But yeah, in general, it's going to be...
1119660	1126060	Most of your experience and knowledge is going to come from experience and just playing with things, trying new things.
1126060	1129920	And for projects you could do, it varies.
1129920	1135820	You can try looking at reversing drivers for vulnerabilities in their IOCTL interface.
1135820	1138760	That's what I started with, at least.
1139020	1143640	And you can try to find a way to abuse those drivers.
1143640	1146260	Like the abuse legitimate drivers portion.
1146260	1153760	If you're looking for some drivers to, I guess, that might be vulnerable, a lot of OEM drivers have security issues in them.
1154200	1155820	I'm always shocked.
1156680	1158980	I've become desensitized to it.
1158980	1164100	Almost every OEM driver has something questionable in it.
1164380	1169280	And I guess that's the place to start if you're looking for vulnerable drivers.
1169280	1176720	It almost sounds like as you're approaching these projects, the new thing pops out at you.
1176720	1183000	Maybe not from getting a depth into, hey, I'm going to find all of the drivers out there.
1183000	1187040	But you're looking for other things, you're learning everything you can.
1187040	1191820	And then the context for your next project kind of filters out from that.
1191820	1196520	Or do you find that you have to go searching for what you're going to attack next?
1197640	1200900	In general, not even just Windows Kernel stuff.
1201040	1204720	I generally don't search for projects to do.
1204720	1207520	Again, it's just finding stuff that might be interesting.
1207920	1212940	If a program is doing something suspicious, there you go, that's a project right there.
1212940	1214780	Find out why it's doing that thing.
1214780	1218720	Or anything similar it's doing that could be called into question.
1218720	1228380	But for Windows Kernel, one thing I do is I try to get part of the virus scanning platforms out there.
1228380	1230560	One I am part of is hybrid analysis.
1230560	1233940	And what I'll do is I'll occasionally search for drivers on there and download them.
1233940	1237880	And just take a quick peek under the hood and you can see what's going on there.
1238280	1242780	And so that's a good place to find these driver files if you're trying to search for them.
1243840	1245080	Sorry, go ahead.
1245080	1247800	I was going to say, are those already infected drivers?
1247800	1253120	Or are these just tons of driver repository kind of thing?
1253280	1257520	It's just a repository. These aren't necessarily bad drivers or vulnerable drivers.
1257520	1261520	These are just potent, might be legitimate drivers as well.
1261520	1263300	So it's just a driver repository.
1264760	1269880	Have you looked at any other driver infections just to see how they are doing those hooks?
1269880	1275700	Get basically similar ideas and work back from the attack side rather than being like, oh, this is weird.
1275800	1278780	Instead of like, oh, this is an active attack, how are they doing this?
1278780	1281020	Could this apply to other situations?
1281520	1286120	So basically, do you look at malware or do you just look for new things in weird drivers?
1286700	1289400	I look for new things in weird drivers.
1289500	1293300	I don't specifically just look at drivers I know that are malicious.
1294460	1298160	What I do is I'll reverse engineer, like I said, OEM drivers.
1298160	1300940	And that's a starting point. Those are legitimate.
1300940	1304660	And I'll just look into what I can find.
1305080	1309440	First of all, it's like auditing attack surfaces, finding out what can you actually talk to.
1309540	1312960	And then it's finding out now you know what you can talk to.
1312960	1318120	What are the access controls in place that limit how much you can talk to the application?
1318200	1324420	And it's going from there. It's that type of investigation of what can you access and how can you manipulate what you can access.
1325820	1326820	Cool.
1327120	1331560	So Truinsky asked a question that fits into kind of the direction I was pointing there.
1331560	1334700	How do you balance your personal life and doing research?
1334700	1338580	So you're clearly deeply involved in this.
1338580	1346600	At what point is this all you do and how do you fit in the rest of the stuff you want to do with your life?
1347660	1351420	Yes. So, well, specifically how I manage my time is going to...
1351940	1358000	The big thing is, you know, over the summer I didn't do most of my most of my research was before I was in school.
1358040	1361080	So before, you know, any internship or summer work.
1361200	1366040	So it's going to be in school. I've just I've got too much free time.
1366960	1373580	And so I just spend that time researching or, you know, I spend some of that time trying to research things.
1373580	1377600	And it's different. You know, if you have a full time job, I don't know if I have a recommendation for you.
1377600	1381960	Because a fact is, I know how like 40 hours a week is rough.
1382820	1386260	You know, you'll probably be tired when you get home.
1386260	1389660	So, you know, doing research then it can be difficult sometimes.
1389660	1392340	And so I don't know if I have any recommendations specific to that.
1392340	1398820	But in general, I try to use this free time I have as much as possible, like valuably, I guess.
1399100	1406240	And since I have so much free time in school, you know, I dedicate a portion of that to doing my own research.
1407620	1408860	That's awesome.
1409400	1418480	So not that we want to point towards anything specific, but you did mention that there were some CTFs out there that are good training resources.
1418620	1424860	Maybe this is a good time for you to say, do you have a favorite CTF for teaching this type of material?
1424860	1431960	Other than, you know, you were talking about the Windows, Windows internal stuff that you can read the 30 pound book.
1432540	1438540	So it's actually unfortunate. I find that a lot of CTFs don't really focus on Windows related challenges.
1438540	1444000	It's really rare you'll see like an actual challenge that's dedicated about Windows internals.
1444000	1451000	It's usually, you know, like if it's like a binary exploitation thing, generally speaking, I see it being like Linux application, right?
1451120	1453800	Maybe running even on the ARM architecture.
1453880	1458640	But I just rarely see I don't have any good CTFs to recommend for Windows related stuff.
1458640	1464060	Just because oftentimes you probably won't see Windows related stuff.
1464280	1468240	One of them I can I know I can mention that it's pretty good.
1468240	1473680	It's I guess you call my favorite CTF overall is the Flareon reversing CTF.
1473700	1475740	They have some really interesting challenges there.
1475740	1477520	You know, it's not just going to be Windows stuff.
1477520	1483760	It's going to be, you know, reversing a bunch of different architectures and applications, figuring out what they do.
1484280	1487460	It's one of the favorite ones I participate in.
1489100	1493980	Also, I mean, I guess that also kind of exposes like that CTF sounds awesome.
1493980	1497900	It seems like any for anyone that's watching that there's a gap in the community.
1498080	1501380	Windows CTFs. There you go.
1503100	1504800	Next DEF CON talk.
1506720	1508540	Well, so what's next for you?
1508540	1513100	If you could pick which direction you would point for your for your next research topic?
1515260	1518120	That's simple to say, I honestly don't have a next direction.
1518160	1519920	I don't have the next project.
1519920	1522520	I'm again, I kind of just go with the flow.
1522620	1529300	I see it really is literally just looking at the everyday software I use.
1529300	1533660	And then if I know that I just tend to notice stuff like this is weird.
1533660	1537960	And that's how I how I go about doing it for this specific for my talk.
1537960	1544160	I came up with it, I guess you could say is is our schools or our schools security club.
1544200	1550960	A red team needed a new we wanted new malware to use against our best blue team competitors.
1550960	1555360	So we run competitions where we do like we simulate a corporate environment.
1555360	1560460	And you have a red team that tries to maintain persistence and a blue team that tries to kick you out.
1560460	1567140	Blue teams also have like uptime and these challenges that they have to keep services up while the red team tries to mess with them.
1567140	1573520	And so there was just a need there for me to develop some tooling against our top blue teamers.
1573820	1578560	And so that's why I decided to look into this, you know, maybe like two birds with one stone type thing.
1578560	1580100	You know, I thought it'd be interesting.
1580820	1585600	So there's educational resources about rootkits out there like books, I know for sure.
1585720	1592680	But I haven't really seen open source tooling around, you know, kernel level Windows rootkits out there.
1592680	1594100	It's rare to see it.
1594100	1596920	So I thought it would actually be a pretty interesting project.
1598920	1600580	Looks like it turned out that way.
1601720	1604380	Did you end up crushing the blue team with this?
1605740	1607320	Yes, yes, definitely.
1607420	1615780	I remember having conversations about, you know, like, when I suggested that I was abusing legitimate communication,
1615780	1618140	explaining to these blue teamers how I was doing things.
1618200	1623200	They were really confused about, you know, like, how would you abuse a legitimate port on my machine?
1623200	1626900	Because they were looking for malware and I was using...
1626900	1629760	So they have to have certain services uptime, right?
1629760	1632380	So they have to have these services always up.
1632480	1636320	So I was just using that fact to get into their machine.
1636320	1638700	Because they could, like, take down that service.
1638700	1644220	So even if they knew, and they didn't, that I was abusing these legitimate services for communication,
1644220	1647780	you know, they would firewall everything except for those services.
1647780	1652480	And I'd still be able to get access because, you know, communicating through their services.
1652480	1655720	Yeah, it was a really fun time.
1657740	1663320	One person is asking for a clarification on the CTF, like, where they can find it, the Flareon.
1663320	1667500	They found flare-on.com.
1667720	1670480	Yeah, it is the Flareon.
1670480	1673700	Flare-on.com is the one I mentioned.
1673820	1677340	And another question from RPTK2015.
1677340	1682340	In the resources you proposed, ReactOS, could you explain a little bit about that?
1682980	1689940	Yeah, sure. So ReactOS is essentially a bunch of engineers, reverse-engineered Windows kernel,
1689940	1692440	and wrote it one-to-one.
1692440	1695280	I wouldn't say, obviously, it's not one-to-one 100%,
1695280	1699800	but it's actually, like, insanely accurate of the actual Windows kernel.
1699800	1702760	So it's kind of like an open-source Windows kernel.
1702760	1707740	You'll find that a lot of the functions in the actual kernel has been re-implemented in there.
1707740	1713540	It follows the same structure. It's just quite literally an open-source clone of Windows.
1714000	1719180	And it's an amazing resource because sometimes you'll find undocumented functions.
1719180	1720420	You don't know what it does.
1720420	1725640	And luckily, you can go to the ReactOS project and just take a look at the source of that
1725640	1729560	because people have spent hours reversing that one function for you.
1729560	1734780	Now, some of this is going to be outdated because the ReactOS kernel replicates the XP kernel.
1734900	1738810	But still, the core functionality is going to be pretty similar.
1740500	1743980	Excellent. So we are right at the end of our scheduled time.
1743980	1750300	Is there anything else you'd like to impart upon us before we call it for the day?
1751320	1755760	Yeah, I mean, not really. I appreciate everyone for coming out to my talk.
1755760	1764760	Keep in mind that I'd like more red teamers to start using Windows kernel-level rootkits
1764760	1768760	and going that route because I think there's some interesting...
1769320	1771040	more advanced actors use it.
1771040	1776580	And I feel like more red teamers need to start simulating those advanced actors
1776580	1779820	that have been using these rootkit techniques for years.
1779820	1783840	I just feel like we have such a good community for user-mode malware.
1783840	1789040	But we rarely see much for kernel-mode, if that makes sense.
1789040	1793000	So I guess that's the parting message is please start looking into it
1793000	1798140	because the real adversaries out there already have this ready to go.
1798280	1803900	That makes sense. Well, we'll get you to post all of your contact information into track one
1803900	1809440	and let people find you wherever you tell them that they can find you.
1809440	1815160	And I really appreciate that you gave us some time today to both give that presentation
1815160	1817440	and then spend this time in the Q&A.
1817660	1822700	So thank you very much and hopefully we'll see more from you soon.
1823240	1825360	Yep. Have a good one.
1825360	1826340	Thank you, Bill.
1826340	1826980	Thanks, guys.