start	end	text
8320	12960	Are you seeing us, sir?
17620	19880	Okay, we're good.
20620	24520	Alright guys, we have Ellie Burstyn
24520	28960	here to talk to us today about Hacker's Guide to Side Channels.
29060	32340	And with that, I'd like to turn it over
32340	36000	to you to have any sort of first questions, or first answers.
36000	39120	And we'll start taking questions on the Discord channel.
39120	43120	So, thank you for joining us. And any sort of
43120	44420	open remarks or anything?
46920	51380	Thank you for watching the talk. I would have loved to do it in person.
51380	55200	I kind of miss the DevCon ambience, but I hope we'll try
55200	58740	to have a good chat, ask anything you want, and try to do my best.
59320	61620	And again, thank you so much for watching the talk.
63740	66140	So, I guess I'll start off.
66140	70020	I think you did a good job
70020	74260	in the talk, talking about the sort of why of machine learning, and why
74260	76760	the model predicted... or why
77960	81960	machine learning decided the way it decided,
81960	85200	if that makes sense. And why the model predicted what it predicted
86020	90020	in order to understand how a defender would react to that.
90020	93540	I don't know if you want to elaborate on that talk. I've never sort of...
93540	97340	I've never thought of machine learning...
97340	100980	you think of machine learning, judging it on what the outcome of it is,
100980	105340	not what led to that outcome, and what
105340	109240	defense to build from it. So, I don't know if you want to comment on that
109240	113360	thought, or if it even makes sense, what I just asked.
113420	115280	No, it does. It does. It does.
116700	121100	I think we have a lot of security tools for debugging.
121100	125280	I think if you want to debug a C++ program, we have debugger.
125740	129120	We have Python debugger, C++ debugger.
129980	133260	Most of the things we can debug, because we have a way
133260	137180	to introspect where the bug is triggered.
137180	140880	The systems, the entire stack is developed around
140880	145540	error handling. The problem is how the crypto is.
145540	148900	You run a crypto algorithm on the hardware, and
148900	154020	you have no idea why information is taken.
154060	155900	You have a leak. You know that the machine learning
155900	160680	is finding the correct key, or the correct attack point.
160940	164800	And you're like, OK, I developed this kind of implementation, and we do at Google
164800	169540	have our own cryptographic chip, so that's something we're very concerned about.
169540	173080	And everyone who has a crypto chip is interested in that question of, OK,
173080	176960	you have a leak, but then what? And prior to machine learning,
176960	180740	we didn't have a technique, or we didn't have a tool,
180740	185020	where you can ask, why? Why do you predict what you do?
185300	188280	This is kind of like a crazy thing about the machine learning thing.
188280	192700	It does things which we can't do otherwise. It's not ideal,
192700	196380	because, you know, we all say, well, machine learning is a black box. That's completely true.
196640	200620	But the only thing we have, which is like, OK, can you please tell me
200620	204620	why? The why is a little bit easy,
204620	208680	but it's like, why? And then we thought, OK,
208680	212900	since we moved from site-generator using statistical estimates to machine learning,
212900	215800	and we talked about it last year at DEF CON, it works really well.
216000	220480	Can we go one step further and try to also ask the model why? And then you can do that.
220480	224440	And as I said, it's very, very brittle. You have to be
224440	228000	super, super precise, and we make it work for one implementation.
228220	230880	And, you know, it's a tool, so obviously we're going to show you the best case.
230880	234280	The truth of the matter is, you know, you have to really be super precise,
234280	239040	which is like CPU instruction precise, so it's not super robust just yet,
239040	242840	but you can do that. And I think that's the only tool in the world who can do that.
242840	247140	That's why Scaled is one of its kind. It's the first generation of it.
247340	250300	You know, five years, ten years from now, we'll be laughing at it and be like, OK,
250300	254960	we've got a way to do it, I'm pretty sure. But it was
257540	259200	two crazy years of
259200	262860	brainstorming and trying ideas until we came up with an idea of doing it.
262860	267340	It came out of necessity. It came out from our project team inside Google
267340	271260	of like, OK guys, you make better attacks, which was not the goal,
271260	274940	but the goal of our whole project was to make a better world, like a more secure world.
275100	278700	I didn't have to pitch a choir, and then
278700	282960	we really wanted to make a tool for our engineering team of like, and around the world of like,
282960	287520	OK, here's a tool you can use, here's a tool lab, here's a debugger for hardware crypto.
287520	291600	And it just doesn't exist. So that's where it comes from.
291640	295540	And without machine learning, it doesn't work, but without the relations, it doesn't work, and without the community,
295540	299620	it doesn't work. We use a lot of the technology behind the scenes, like Unicorn.
299760	303800	And we had a pretty good talk today about Unicorn as well. A lot of people are using Unicorn,
303800	307180	which is a CPU emulator, which is very close to the community, so we are
307180	311260	standing on shoulder of giants, which is bringing some of the interesting
311260	314160	twists to it. That's what it is.
315520	319240	Great. So actually, just jumping off what you said,
319240	322360	are people actually using this to
323900	326380	help identify side channels yet, or
326380	328660	have you been approached by anyone? No, not yet.
330800	334160	To be clear,
335380	338380	we had a lot of debate actually internally, because
338380	341760	it's really super out of the press. I would say the initial
341760	346180	complete success was probably one or two weeks old.
346180	349640	We knew it was somewhat working, but we didn't get it to work as
349640	353780	clearly as it should. It took like, I think maybe 24 hours before
353780	357760	I recorded the talk to be clear. But we saw that
357760	361840	DevCon is virtual, we really want to contribute, we really want to be part
361840	365200	of the community. Usually we're not really good at
366040	370260	things ahead of what we do, but this year we saw that we wanted to really show you
370700	373840	the trading engine, what we were working on as a way to
375740	378520	participate and to be part of the community.
378620	382720	So, no, it's not there yet. The research effort is not there yet.
382760	386280	I'm sure the COVID question is going to come, so I'll answer. Yes, the code will be public
386280	390980	next week. I'm still cleaning up the GitHub to tell you how new it is.
391300	394900	But we went for, here is something new and exciting that we work on.
394900	398560	You guys might get a kick out of looking at it and be inspired,
398560	402480	and that's what we go for. So, the talk, sometime I'm bumping into the middle of it.
402700	405840	Sorry about that, too. I tried to record it with the door closed.
405840	410220	In California, it's like 28 degrees in the room when I try to record, so I was
410220	414540	straining a little bit. I apologize also for my English. But, yeah, we really tried to do
414540	418300	like, this is the state mode talk, which is like, we do show you
418300	422260	bleeding edge. Like, it's a true, you know, very old DevCon spirit.
422260	426320	Like, this is new, we're here to transform it. That's what it was. So, no, it's not here.
426320	427880	Absolutely not.
432300	434100	That's great.
434740	438380	So, the example we're using
438380	441220	were mostly around power, if I understood the
442120	446540	presentation right. And, you know, you mentioned other side channels,
446540	450460	you know, heat, emissions, timing, etc.
450460	453760	I mean, do you see these techniques would apply to all those, or
453760	457980	there wasn't anything unique to the instrumentation
457980	460920	you used, right? No, I don't see there's anything
461720	465840	special to it. I never used, I said, I don't
465840	470000	know if anyone ever used heat. I would be super curious if someone knows about
470200	474140	a heat attack, timing attack, which is super, super interesting.
474140	477940	I've never seen one. Like, in crypto, they might exist,
477940	481760	I don't know. But we thought about, yeah,
482180	484540	magnetic, I think, is one of the big deal.
487580	490140	We wanted to do this here, to be clear.
490600	493500	And extend what we do from power to EM as well.
493880	497780	The truth of the matter is, we cannot go to the office, right, doing remote work in our team,
497780	501720	as many of us are doing in the community, and we don't have
501720	505700	access to our equipment, right. The only thing we can really do is power, because that's what is
505700	509740	plugged into our lab. And the only thing we can access remotely to do
510260	514220	is EM. You have to literally have an EM table, and you have to be on top of the chip.
514460	517320	And that is not doable in the near future.
517320	521600	So, we'd love to do EM. I think the next big target
521600	525640	is that. You would do, maybe timing.
525640	529580	Timing might work too, probably. I think there is a few papers coming out this year
529580	534220	from other groups on machine learning and timing attacks for
536320	537460	Parasite, I believe.
537840	541920	I don't think we'll be able to cure it, so I think it will most likely show that you can use machine learning for that.
542000	544780	So, as I said, machine learning is an easier way to
545660	549320	take over such an attack for hardware in the next 2-3 years
549320	553280	than when it's going to do it. We just happened to be the first few groups
553280	555480	who are doing it. There are other groups in France.
557240	561240	There's a German group as well who is doing some of it. Some vendors
561240	565160	are taking some of the research and putting it into products. I think that's where it's going to go.
565160	569280	But I think most people are on the power train for now.
569300	572440	Maybe a little bit of timing attack is pretty new this year.
572720	574400	I guess the end is the next.
574480	581180	Yeah, I was wondering that too. It's kind of, as you were saying, you built
581180	584740	your model, I guess, using mostly an emulator. How well
584740	589220	does that scale then to other hardware? Is it kind of the research you've
589220	593280	done, it's that one sample? Or do you think that you're going to need to build your machine learning models
593280	597140	for different types of processors or setups, right? Does that make sense?
597400	601120	Yeah, so for the attack side, we know it works.
601420	604920	I mean, I hope it's not a unique paper, but
605420	609220	since last year we've been working. The last three years we have collected a massive
609220	613420	set of data sets that we really hope to publish.
613420	617580	I'm not going to give a date at that point. Last year I said very soon, and it didn't happen this year.
617800	621160	Or the next year we have. But yes, we have that for
621160	625200	multiple data sets, multiple hardware that works. For the emulation side,
625680	629200	the other side, which is not the machine learning side, the dynamic analysis where we need to
629200	633200	be site-precise, we don't even have a normal. And the thing
633200	636560	is, Intel is, for example, out of the question because
637160	641220	they have a predictive pipeline, so we don't even know, like, depending on
641220	644920	how the Intel predictive pipeline will work or the flush pipeline will work,
644920	649120	the number of instructions is completely non-deterministic. Or at least to the point where, in our
649120	653380	poor brain, we're not going to be able to do it just yet. So if your CPU is too complicated,
653380	657200	I don't think we can. Reduce set instructions should work,
657200	660980	I guess, but like I said, we don't even have a device now because
660980	665480	it's like, oh, it's between, I don't know what the range is, 2 to 12 cycles.
665480	669200	So we have to make an estimated guess. So it works
669200	672800	for ARM, mostly embedded stuff, I assume. Smaller
672800	677260	power would work too. But yes, the emulation side of it is
677260	681100	hard because if you're off, you know, if your
681100	685140	machine learning is correct, it finds the attack, then if you're off
685140	689220	for the cycle for the emulation, you end up, I don't know, like, 6, 12, 15,
689220	693160	100 cycles left or right, and then you're on the wrong
693160	697340	line of code, right? The line of code that I said is true for instructions,
697340	700440	so you might have, you know, you might get lucky if you're a little bit slowly, but
700440	705280	that margin becomes terrifyingly hard. And similarly, there is
705380	709360	a back point at the end of the... you can also apply the end
709360	713000	of the implementation, not the first round, but the end. And then, again,
713000	716960	at that point, every error is compounded, right? So the further you
716960	721660	undertrace on the right side of this, the more you're going to
721660	724960	have a chance of mixing it up. So yes, we choose easy
724960	729700	case, which is like very well-defined ARM, which is a very small set of instructions,
729700	733080	well-defined, well-documented, on an easy C
733080	736360	non-vectorized, because that's the easy case.
737260	740880	Harder case would be like more features of engineering. I think
740880	745300	the people in the committee are interested to help us improve the analyzer
745300	748800	or add more targets. It's probably doable, it's just going to be interesting
750180	753120	reversing engineering exercise, right? And that's what people
753120	757220	put at hardware. It's fun to do, it's just, it's going to be quite worse.
758640	760140	It's a really good question.
761820	764200	Yeah, so, I mean, the attacks
764200	767160	themselves are pretty hard, so it goes to show that
767160	771160	the defensive analysis would be just as hard, right?
774160	776260	Yeah, I mean, we know
776260	780260	that hardware, I mean,
780260	784640	we know that stationary attacks are inevitable, right? Almost inevitable.
784640	788160	There are defenses which might exist, like doubling the bus for
788160	792080	power supply, power attack, but that's not going to be implemented
792080	796360	in hardware. It's too expensive or too costly or too big.
796720	800360	So, everything is inevitable to size your attack to an extent.
800640	804360	The question is, how can we make it right? There are
804360	807500	really cool set of work done
808200	812000	mostly by the French ANSI on MASSKS
812000	816580	which is kind of like the way you make it harder. You can also make it slower.
817260	820280	So, the question is, how slow can be hardware
821380	824740	encryption, right? The question is, how many milliseconds can you tolerate?
825100	828560	The reason why I mention that is, if you use security keys, right,
828560	832580	we create security keys, they use NFC. And the problem with NFC,
832580	836500	NFC is super fast and super low power. So, now, in those settings,
836500	839680	making a super resilient implementation is going to be challenging.
839920	844720	So, being said, this is not AES as we show, but even for that
844720	848860	you cannot switch out. If you want APK, also you cannot switch out.
850180	852280	Well, I don't have a lot of time.
852520	856200	I don't have a lot of power. And with more computation to
856200	860700	harden my thing, that becomes kind of impossible. So, there will always be a trade-off, right?
860700	863640	And as long as there is a trade-off, there is a vulnerability.
863960	868640	So, you know, Tyler's channel attack is probably the most powerful
868640	872180	attack you can do against cryptos these days because this is the one where we know
872180	875380	we cannot solve it. So, interesting.
875380	877600	It's an interesting space.
877840	883100	Pretty interesting.
883400	887600	Yeah, and I'll say, I really appreciated your talk, too, how you went through the different steps.
887600	891920	It was very informative and instructive. Like, even just mentioning explainers,
891920	896860	you did a very good job of explaining everything and really showing the real world examples.
897140	900540	You say, though, you say side-channel attacks are really important for encryption.
900540	904080	How did you get into the side-channel attack space? What drew you to that?
904080	909640	Was it the encryption aspect? How did your research end up on side-channel attacks?
910700	912080	Oh, wow.
914850	916410	That's a hard question.
916850	922550	I think what happened is
923350	925950	before, I always did cryptanalysis.
927390	930070	People might or might not remember it, but
930530	935010	a few years back, we announced the first collision on SHA-1.
935750	939550	And we did it all at that time.
941230	943110	And it took us a while.
943110	946190	It took us a while to do it. Breaking SHA-1 in collaboration
946190	949230	with Mark Stevens, the CWI, took three years.
949610	953550	Most people don't realize that sometimes when we do talk, it's like, oh, that's great. That's nice.
953550	958250	It took three years of effort for us, and I think Mark spent almost ten years on it.
958250	961170	So you get out of breaking SHA-1
961910	965910	I mean, putting it in practice, it was broken by one, but like
966470	969990	providing the first collision, and then, as I said, in 2015
971190	974370	we did the first collision. We showed these two PDFs
974370	978750	which are about to send SHA-1, and then the world did break SHA-1, which was our goal.
979530	982490	Interestingly enough, the backstory, the reason why we decided
982490	986430	to do it is not to do a talk, but because we really wanted to
987790	990550	help people realize that they need to move away from it
990550	994270	at the time Microsoft, XCOR, did not deprecate it
994270	998430	and Firefox was lagging, and it had the immediate effect
998430	1001970	that both of them immediately deprecated it, so it was like
1001970	1006770	why would you ever go into this crazy amount of money
1006770	1010430	and amount of energy to literally compute
1010430	1012790	all this? And the answer was
1015170	1017350	because, at that time, we wanted to show
1017350	1020610	to the world, it was with both Microsoft and XCOR, and we should
1020610	1024990	treat it seriously. Again, it was important to get this always in the context
1024990	1028610	of our team, the research team,
1028610	1032910	we tried to set up an XOR where people come up to this project and try to figure out
1032910	1036450	if it can help the world. And then we finished that, and we were like, okay
1038510	1041030	what else? And then, so yeah,
1041030	1043950	our first research team is almost a hangover
1044410	1047910	because we had to get professional marketing and we were like, what's next?
1048250	1051330	A piece of crypto, and then we were like, okay what's next?
1052010	1055950	And then we started to talk with the project team, and at that time
1057430	1060750	something called the Titan chip, publicly,
1060750	1064530	is developed by Google. It's Google's own crypto chip. And the crypto chip
1064530	1068150	we talked to the hardware engineer, and they told us, well, no.
1068690	1071650	So this crazy idea, we come up with one
1072270	1076190	paper from the French agency, which is the French
1076190	1080270	control agency specializing in crypto. They have this very, very interesting work
1080270	1084190	on machine learning and crypto, you should check it out. And I was totally
1084190	1088050	in love with the idea. The internal team was very interested in
1088050	1091930	having more resources, and then we realized
1091930	1096050	it's very, very powerful, very interesting. It's played well into what Google do,
1096050	1099930	which is machine learning at the time, it's here. It plays well
1099930	1103870	into core and fundamental research that we do.
1103970	1107670	It plays well with... that's what we decided to go for. Honestly, we got
1108190	1111110	from our project team, so it was
1113370	1116210	completely serendipitous, and has been seen in research more like
1116210	1119270	you know, talking to people, and it's like
1119730	1124030	something like that. You want to talk, you get inspired by other people, you build on
1124030	1128610	other people's work or ideas, and we all keep it to push it further.
1128910	1132250	So I think that's what it was. I think that was this idea
1132250	1136370	of come from other people, and take credit for it all.
1136390	1140310	We met a lot of wonderful people from Ledger,
1141450	1144050	from Chipwister, you know, Colleen, and many Chipwisters
1144050	1147730	by the way, the scaffolding committee, the institutional community,
1147730	1151630	we also have a lot of time to help us, give us pointers
1151630	1153070	early days.
1153070	1157070	So we're glad that now we're back.
1158470	1163610	Great, so we have a question from the audience. Apart from approving the emulation,
1163610	1167430	what do you see as the next step in this field of side-channel detection?
1170970	1171490	Detection...
1174470	1176230	That's a great question.
1177950	1179370	I think there are
1179370	1179870	...
1183230	1185750	I think it goes hand-to-hand with
1187050	1191270	better attack. Again, we can only explain what we can attack.
1191270	1195470	I think we have a few working streams on
1195470	1198870	public key, and a few working streams on other algorithms.
1198870	1203210	I think that will be interesting to do. We're always looking for people
1203210	1207370	who are willing to work with us, because it's a very, very big...
1208950	1211690	I won't say difficult, but it's a lot of grind
1211690	1215710	to create the data, and to do the machine learning, and that sort of thing.
1215710	1219350	So if people are interested to collaborate, we're always up for it, because
1219350	1223290	it's a little bit like, figure out what to do, it's hard. Last year,
1223290	1226730	when I come, I go, it's so hard to do the IAF model. This year, after a year of
1226730	1231190	refining the machine learning model and our process, we can basically do it in 10 minutes.
1231190	1234090	So we went from 5 hours to 15 minutes
1235310	1238230	by getting just mechanically better at it.
1238230	1241210	I think it's going to be the same for the other algorithms.
1241490	1246030	So I really view that. I think we're also going to view, I hope,
1246030	1250290	people being creative for it. I don't know.
1250630	1253930	I would imagine you can do that timing attack. Some people mentioned
1253930	1257450	cache line as an idea. I found that quite interesting.
1257670	1262030	There is a holy grail of Intel HDX.
1262030	1266230	I mean, Enclave is also using crypto. It is crazy
1266230	1270330	hard to attack, because it's literally baked into the Intel CPU.
1270850	1273990	However, no one knows if machine learning can do it or not.
1273990	1278590	Some people we talked to say yes, it's probably doable. I don't know. I never do it.
1278910	1282230	We don't have necessarily the time to do it by ourselves. We're happy to
1282230	1286170	contribute, but that's something which is interesting line of research. I think Enclave is
1286250	1290130	a big deal. Other algorithms are a big deal. But also
1290130	1293590	we can think of crazy things. Everything which is timing sounds a bit bad.
1294370	1298130	I would not be surprised if someone even came up with a crazy idea of how to do it
1298130	1302030	for Bitcoin wallet transactions, or even
1303790	1306430	what would be another interesting step. SQL injection.
1306530	1309410	We have a lot of blind SQL injection. Maybe we can
1310210	1314390	get more out of the timing. We can make more out of the timing that we think we can.
1315570	1318290	It's unclear. I mean, most of them should have been fixed,
1319110	1322670	but yeah, I don't know. That's a lot of room,
1322870	1326090	a lot of creativity. It depends on people's taste.
1327350	1328310	I'm not sure.
1329590	1334330	So you mentioned a paper is coming out. Do you have an estimate on when you're going to be
1334330	1338330	done with that? I'm not going to jinx it, Matt. I'm not going
1338330	1342390	to do that. Last year I said it's going to be soon. The draft is still on my
1342390	1345730	desk. And for the schedule paper, I'm going to be completely
1345730	1349450	honest. I told you we rushed to do it for DEF CON. We really wanted to show you
1349450	1353590	Building Edge. Literally the paper is not ready yet. The next step for us is
1353590	1357750	to put everything on GitHub. I'll post the link on Twitter
1358390	1359690	hopefully next week.
1361510	1365490	And then we're going to want people to play with it. We'd rather provide
1365490	1369690	incomplete stuff to people to play, because last year we did
1369690	1373650	the reverse. We thought we were going to hold, hold, hold, and get everything at once
1373650	1376970	and it didn't work out. So this year, we're switching the strategy.
1377370	1382010	I'm going to release early. Imperfect, but early. And then the paper will come later.
1383210	1385450	Completely what? But yes, the AES datasets
1385450	1389210	we promised last year are still there. We just haven't got the chance to
1390290	1394110	release them. And then the schedule paper, you'll be able to play with the code.
1394130	1397110	Run the code I showed you. Get the verb I showed you. And then
1398110	1402150	that will be incomplete, because you'll be like, oh, where are the other attack points?
1402150	1405710	Not there yet. Where are the other models? Not there yet. They're going to get there
1406310	1410030	when they can. And I make no promises. Because I can't
1410030	1413810	I don't know what I can keep or not. So I try to be a little bit more
1414450	1417470	realistic this year than last year. I want to achieve
1417470	1422270	good people. I was going to ask the same thing, so it's definitely on folks' minds.
1422390	1426370	We do have a question from the chat. So, you know, are you aware of
1426370	1430050	any side-channel attacks that are found in the wild, right, where attackers are
1430050	1433810	using them? Or is this more of where we're thinking about how to defend against these attacks
1433810	1436330	before, you know, we see them active?
1436750	1442070	Oh, side-channel are everywhere. Side-channel are everywhere. They're like the
1442070	1444550	most prevalent form of attack for hardware.
1445610	1450030	Let me try to figure out which one I can tell you which are pretty interesting. So again,
1450030	1453930	it's not singular. To put one company like this company is bad,
1453930	1457910	because I'm going to use all of them. So I start with one of my
1457910	1461790	favorite companies, which I really like, Ledger.
1461950	1465790	Two years ago, they had away someone from a timing attack on
1465790	1470130	the IoT curve. This was the example I gave at the beginning of the talk.
1470170	1473210	And they were able to recover all the Ledger treasure
1474210	1477730	by Bitcoin private key. So that's a pretty big deal.
1478990	1481910	There was a timing attack on a game console.
1482350	1485830	I think it was streaming on Twitch. I'm not going to give too much
1485830	1490890	detail, but many, many game consoles
1490890	1493850	are protected by crypto.
1494370	1497650	And there was a timing attack to recover some of those secret keys.
1497990	1500650	That was earlier generation. I'm not talking
1502150	1506350	5 or 4 or Xbox One.
1506350	1508990	I'm talking previous generation, but there was a timing attack
1508990	1512750	who were used to recover crypto keys.
1512750	1517170	There was many of them. There was an AES one a very long time ago
1517170	1521090	used by... I believe
1521090	1524890	it was Dan Bernstein on remote AES. There was one
1524890	1529050	on cache line attacks on CPUs.
1529050	1532070	There are so many of them everywhere. Session attacks are
1532730	1536670	so powerful. The most powerful form of SQL injection
1536670	1540770	is binary SQL injection. Sorry, session attack. Binary SQL injection
1540770	1544750	is when you have a SQL injection, but you can't see the output
1544750	1548930	when you trigger. You do it one character at a time
1548930	1552690	and you just look at whether the server responds or not. That's a form of session attack.
1552910	1556870	They are everywhere. It's a super, super practical attack
1556870	1560850	and usually people are really annoyed and say it's not a good attack because it's a known technique.
1560850	1563870	It's not a known technique. It's a known technique. It just happens that it works
1565230	1568770	super, super efficiently on many, many things.
1569770	1570970	Yep.
1572550	1574370	And we have it on
1575950	1580830	physical stuff like electronic locks and things like that.
1586150	1587830	Oh, I forgot.
1587930	1592810	I thought that was the most important one. I'm sorry.
1593630	1597030	Spectre and Meltdown. Right.
1597030	1600750	Spectre and Meltdown. There you go. The thing which completely destroys your CPU.
1600750	1604010	They are a form of session attack. So here you go.
1604190	1608950	As I said, some of the most powerful concrete attacks
1608950	1612870	we've seen in the last few years are session attacks because they are so hard to
1612870	1615770	debug, so hard to pull off, to defend against.
1615770	1619690	Yeah, I think I read something about those.
1620390	1622150	They were kind of big, right?
1622590	1625750	Yeah, I pinned in the chat the
1626830	1630030	article. There's a weird article who can outline that.
1630030	1633610	It would be good to just read up if you guys are interested.
1636030	1638410	I think it's QA. There you go. Thank you.
1638870	1642090	Yep. Yeah, so we've got a couple minutes
1642090	1645430	left. If we have any more questions, let's get them in here.
1645710	1648610	Otherwise, we're going to thank
1649910	1650690	Ellie and
1652870	1654630	let you guys get back to the con.
1655530	1660270	One last one for me. Oh, wait, we actually do have one more.
1661530	1664110	Yeah, so someone who is mainly focused in InfoSec.
1664830	1668490	What kind of background do you think people kind of lend themselves to
1668490	1671950	going towards looking at side-channel attacks and thinking about the research you're doing
1671950	1675450	with being able to detect that in different ways?
1677270	1678690	What kind of background?
1680590	1681910	It varies.
1684510	1686930	We have some people who come from
1689050	1689930	radio.
1691230	1694290	For those who don't know, the first initial side-channel attack was actually
1695910	1699250	in the 1940s or something like that, where they had a typewriter
1699250	1703490	and the guy was having an oscilloscope, and then he sort of blinked on the oscilloscope
1703490	1707490	and realized that there was something. And then the Russians put a
1708670	1711470	user to spy onto people
1711470	1716070	by looking at vibrations. So that's super old stuff. So that's the radio guys.
1716070	1719950	The radio guys know a lot about all these electromagnetic things
1720730	1723830	and spycraft there. So a lot of spycraft comes from that.
1723830	1727690	We have people who do side-channel attacks who come from hardware. Hardware people
1727690	1730330	who like to build CPUs and look into
1731570	1734230	meldons, vectors, cache lines. So those guys
1734230	1737830	also do side-channel attacks in a different way. We have cryptographers,
1737830	1742290	people who are from a crypto background like me, who are more into that.
1743050	1745970	So it really depends on your use case. You have people who do web security with
1745970	1750590	side-channel attacks and side-channel attacks means more SQL injection.
1750770	1754370	So I think everyone can touch it by
1754370	1758190	the band. It's fairly easy to get into it. I think
1758190	1762190	there is this apprehension sometimes. The first time I read
1762310	1765910	a paper about it, I probably didn't get the best paper to read as an intro.
1765910	1770470	It felt very bizarre to me. I didn't really understand what they were going for.
1770870	1772550	I was a little bit like... it took me
1773950	1778290	three to four months to get used to the mindset of it.
1778290	1782270	I think it's a very powerful mindset. I think it's a very fun experience to do.
1783190	1785730	If you are interested in side-channel attacks,
1785730	1789630	specifically on hardware, and you want to start without
1789630	1793510	machine learning, like more simple stuff like SSTC code,
1793510	1797410	CheapWhisper, which is a thing that is very affordable
1797410	1801730	and even you don't need the whole thing, you can just run out of existing traces,
1801730	1805590	has a super cool tutorial. I think Corning from CheapWhisper has put
1806630	1810030	a tremendous amount of Jupyter, Python code.
1810030	1813830	You can get to it, you can play with it, understand how it works, and you're going to
1813830	1817170	recover an ASP. And then you'll be super happy.
1817250	1821590	You'll have this super intense satisfaction that you're going to work
1821590	1824730	not necessarily on everything, but it's going to start to make sense.
1825350	1830630	As I said, it's for everyone who is interested in pen testing, one way or another,
1830630	1831990	or have fun.
1832450	1838490	You want to break into a lock. Maybe there's a timing attack.
1838670	1841850	There was some petitions that some of the
1842410	1845690	super high security locks, the Kaban
1846230	1849310	one where you have rotation and things, might have a timing attack.
1849710	1851930	There are secretaries that may be there.
1852470	1857130	For me, it's for everyone.
1858750	1861910	I love that you went to radio first and then math
1861910	1864810	and crypts came later. That's good, right?
1865950	1869470	It's not a deep mathematical background, to be clear.
1869470	1871930	It's literally observing a signal.
1872050	1876530	If I do A, the signal looks like this. If I do B, the signal looks like this.
1876530	1880230	If I can see differences, then I can construct something.
1880410	1884450	Of course, you can do more and more complicated stuff to do more hypotheses.
1884610	1888150	That becomes complicated at some point.
1888570	1892190	The basic stuff is really like, I look at something.
1892190	1895590	It's a very experimental, very hacking thing.
1895590	1900770	It's for doers. For people who like to tinker with stuff.
1900850	1903850	Basically, if you're here, you're on the chat, you are the right person.
1903850	1907710	Let's put it that way. If you are a DevCon person, you are the right audience for the
1907710	1909750	citation attack, because it's all about doing.
1911030	1916010	Math is here to help you and maybe to push it further, but that's not the core of it.
1916010	1920050	The core of it is... matter.
1920110	1923190	Things. The world is made of stuff which
1923190	1927450	does not behave the way people want. It has a secret, hidden property
1927450	1931170	you'd like to uncover. That's what citation attack is. I hope I said it
1931170	1933850	and I get you excited to try it. I hope so.
1935670	1938850	We're at the top of the hour. We appreciate the
1939630	1941930	generosity with your time in answering these questions.
1943070	1947530	Pretty excited to look at the follow-on work coming out of this.
1948110	1951690	Thank you for everything you've done. We'll see you next year, right?
1951690	1955310	Yeah, I hope so. Next year. I hope actually next year
1955310	1959530	is this year's talk. I'm not going to tell you what it is.
1959530	1963910	It's a surprise. As I said, I'll post on Twitter when the GitHub is up.
1964310	1967110	I'm at Eli on Twitter.
1967490	1970710	The slides are online as well.
1972330	1975470	I'll post it on the chat. I can't post a link, right?
1975470	1976490	I'm not going to get that.
1977650	1979470	You can, and I just did.
1979810	1984350	I promise I'll post as early as I can.
1985090	1988530	Thank you so much for watching the talk. Hopefully next year we're all
1988530	1992610	in person. As usual, I'm always happy
1992610	1996430	to answer any questions. Just hit me with a DM or on Discord
1996430	1999190	or whatever you guys want, and I'll try to do my best to answer questions.
1999630	2001950	Thank you so much, Eli. I hope you have a nice DEF CON.
2001950	2005670	There's always a cool talk to watch. I'm super excited to watch
2006050	2008390	a few more. Thank you so much.