start	end	text
4760	9300	Of course, there's going to be this delay of me watching the screen, seeing if it wakes up.
10320	11660	Yeah, there it is.
12220	13180	I can see you, yeah.
16690	19190	Alright, the swapping around works.
25030	30110	So, welcome everybody. We'll get started here in about a minute. I don't want to rush anybody.
35310	36690	We can see everything now.
37690	40610	Good, the stream seems to be live.
42430	50030	So, for those of you asking where the live QA schedule is, you should be able to see that on the DEF CON website.
50210	64850	For those of you who are ready to ask questions of our amazing speakers, one of whom is standing on a roof and the other is in a yellow room, we will proceed right now, actually.
64850	69330	So, hello everyone. I'm Fallible, I'm going to be one of your goons.
69330	77570	Syged's over here. And we have Shah and Hadrian or Hadrian, he didn't correct me earlier when I think I said both.
77890	79030	Any is fine.
79030	88570	Any is fine, alright. Go ahead and give us a moment, actually tell us the name of your presentation and we'll just get into asking some questions.
90330	93250	So, the presentation is DNS section.
95730	98690	And that's already quite good.
98690	106670	Yeah, it's a really good name, I gotta say. I love it when there's a nice pun in a presentation name.
106730	111490	So, thank you both very much for joining us for the Q&A portion.
113070	119950	For any of you looking for the presentation, you should be able to find that on the DEF CON YouTube page.
121130	129170	Let's get started with a pre-arranged question that you sent me because you were really, really nice to us.
129170	134090	Which equipment slash tools do I need to perform this attack?
137040	139420	Well, I guess I can answer this one.
140940	146940	Basically, you only need your computer and a few tools we have presented in the talk.
146940	151660	So, one to get hashes and one to break hashes.
151660	156860	So, just an nsect-free worker plus hashcat is much enough to perform this attack.
156860	159340	Obviously, if you have a big GPU, it's much easier.
159340	166160	But even on a CPU, you can use John the Ripper to actually get quite a lot of DNS records.
166260	168640	So, you can really do this at home.
168720	175460	In fact, we've made a little challenge on the website, on the last slide.
175460	185160	And if you want to try the tools specifically on our website, you can send us the hashes you've broken.
185200	193280	And we will put up some scores and see who's the best at it.
193560	198200	So, anyone can try it easily at home, but it's much better with a big GPU.
198200	200680	Oh, it's on now. That's excellent.
200680	209840	We'll make sure that we put that in the track one chat here, so people can access that without having to guess.
210640	211980	So, good.
212600	218000	And I love that what you've come up with here is something that's very accessible for folks.
218000	224840	And it looks to me like it's a good place for people to enter into doing this type of work.
224840	233120	There's a lot of presentations that go way over folks' heads if they're beginners or having to set up a bunch of extra tools.
233120	239000	And it looks to me like you folks have done one that's going to be very accessible. So, thank you for that.
240660	243980	So, what did you do with all the data that you got?
244320	251700	How much did you get to pay by insert evil company for the whole data set?
252060	253800	So, what did you do with all this data?
254840	257060	Perhaps I can answer this one.
259380	263020	Surprisingly, perhaps, we have not done anything with it.
263220	268560	We have the data and we didn't even exploit it to its fullest potential.
269000	271340	So, we've been very nice and very kind.
271880	275960	That is very nice. You could have done so much interesting stuff.
276720	277500	Yes.
277500	283500	Extend that a little bit then and help me understand if you wanted to be...
284280	293280	What would be the next step that somebody could take with it and not get ourselves in trouble with the lawyers?
294920	300160	Well, you have already a lot you can do just by looking at the data itself.
300320	307140	That's part of what we've been doing and we've provided statistics about it in the talk.
307500	310600	But really, you can do much more than that.
310600	316260	You can compare the data that you got from this with data you've got from somewhere else.
316260	324400	Either from, I don't know, some other recon tool or from knowledge you've got from research or whatever.
324920	331820	So, really, it's just one tool in the whole toolbox you can get to extract information.
332520	336140	I wouldn't say that all the other tools are completely legal.
336140	341940	I wouldn't say that you wouldn't get into trouble by using the information you get that way.
341940	345420	So, use at your own risk and be very careful with it.
345840	352860	But it's public information. It's publicly displayed. It's just that the information itself is meant to be private.
352860	356280	It's meant to be hidden, but it's on public display.
357260	361080	So, I think that's one way to answer your question.
361080	377300	You can really do a lot if you use that data and collate it with other sources of data and actually input whatever you got from, I don't know, email addresses into a database of broken passwords.
377300	382240	And then you get access to that email address, for instance.
382380	386840	And I think Adrien may have other ideas as well, what to do with it.
388500	394440	Actually, legally, other ideas, I think you've pretty much said everything.
395120	399420	I like the restraint there. That makes a lot of sense.
400040	408340	So, okay, that's useful to know. So, how much did it cost for you to run this GPU attack?
410140	416540	Well, in practice, it did cost us absolutely nothing, except basically some time to set up the thing.
416840	421800	Because we got access to some free GPU time.
421980	431640	But I did try to estimate how much it would have cost us if we had, for example, just rented an AWS GPU instance.
431640	436600	And I do estimate the cost of the attack between $1,000 and $2,000.
438880	457620	However, if I did only use maybe a tenth of the time we were able to use, I think maybe I found at least 80% of the number of hashes we were able to find with 10 times more power.
457620	472300	So, even without a GPU and only a simple laptop CPU, I think you can get easily maybe two-thirds of the hashes we were able to crack with our big GPU.
472480	476280	Illustrating that classic 80-20 rule, then.
477160	478780	Yes, basically that.
478820	480060	Pretty much.
480740	485080	We do have a couple of questions from the chat, if you'd like to...
485080	491320	So, one is, what are some additional examples of confidential information that are being stored in DNS?
493460	497260	So, the question is whether there were confidential information.
498720	509260	I think they're asking, other than the emails that you were able to pull out, was there other examples of information that people would expect to be confidential that you were able to pull out?
510500	514200	Adrien, perhaps you can say more about the kind of things we found.
516220	526480	Specifically, on OVH, there was nothing else we were able to find, and we did not really look much for other kinds of data.
526480	529540	We were quite happy with what we found there.
529540	534540	But there are some other examples of such private info.
534540	541300	For example, if you take domain key records, some people might know about this.
541300	548000	It's one of the various DNS records you put up to avoid email spam and things like that.
548000	564260	There's a very recent article, or blog post, I forgot, about someone mining for all these domain key records and finding out which mailer different companies use, and which is their email partner.
564540	570800	It was able to dig quite a lot of valuable information, also for the use of DNS records.
570800	578860	And I'm pretty sure there are many other uses of private info in DNS data, but it's not so easy to find it.
579100	594340	And if I may add to this, although the email addresses may seem like it's a small thing, it actually is the basis on top of which we could explore further, find the names of people, find new hosts to target.
594540	602180	And even some private information about these people, because the email addresses show that they were working at the same company, for instance.
602560	607200	So it's an email address, but even then you can say a lot from this.
607720	616500	So there was a follow-up question of whether you meant domain key as DKIM, is that what you're referring to?
616500	627980	I think DKIM and domain key is something different. I forgot exactly, but it's kind of the same thing. And if it's not the same, it's another protection for email.
627980	643780	Clearly in the DNS, it shows up at something.__domainkey.yourdomain, and bad people use easily guessable something, and good people use a long hash for something.
643780	651160	And people who do use a long hash for something make it very difficult to find their domain key.
654080	658280	I would need to check out for the domain key versus DKIM thing.
659960	668180	I love this other question that came in as well from Angel Rain. What is the impact to me, the general internet user?
668240	677180	Which is always a nice thing to be able to encompass. How is this going to affect somebody who is just out there trying to do their job?
679480	685780	Well, if you are an OVH customer, then you might have quite some issues.
685880	700280	If you do have some private email redirection, then I would suggest you to use one of the mitigation we talked about in the talk.
700280	713020	If you are not an OVH customer, well, I guess I would just log on to my cloud provider and watch my DNS zone and see if there are some records. I was not expecting that.
713020	717140	And if there are, well, do submit a talk for DEF CON next year.
719040	720980	Now that's good advice.
722460	733460	Okay. Well, let's move on with one of the other questions that you've posted for us here. Why does DNSSEC only use old crypto?
734700	746700	Perhaps I can take this one. Old crypto is not nice, but it is a lot of the things you would see some years ago on the internet.
746700	757440	And now most of the internet, I mean, the browsers and servers have moved on to other algorithms that are faster and some of them are even considered more secure.
757440	767540	But DNS, you have to understand DNSSEC works under a lot of constraints. It has to be very, very fast because it's used at scale.
767700	772180	So you cannot use all the algorithms you'd like. You have to use the fastest ones.
772180	782960	And that's actually been a reason why cryptography took a long time to get inside of DNSSEC to the extent that it is now.
782960	793040	Because even today we're deploying security extensions and we have to account for cryptographic operations taking time and latency.
793040	804620	You also have to account for compliance because some technologies are constrained by laws in the different countries that you would be in.
804620	816240	And therefore, if you want to use DNS, which of course you do worldwide, you have to account for the fact that some technologies are not considered legal or accepted in some places.
816240	828400	So you have to deal with a very small subset of the possible algorithms and you have to have all the DNS resolvers and all the DNS servers supporting these algorithms.
828480	841680	And you have to be fast. So you are playing at a lot of different constraints and that reduces the set of possible algorithms you can use to essentially two of them or three of them.
841680	852300	One is not usable at all. It's RSA. It's not really usable at all at scale. And the other is ECDSA, which you can use to sign very fast.
852300	868480	But it's on a fixed curve, which from a cryptographic standpoint is not ideal. It means you cannot build on all the innovations of the 21st century to try and get the best performance and the best security out of this.
868480	875920	So really that's the reason you need to do things fast at scale while keeping governance happy.
876200	887120	That's a rough combination of things to deal with if you're trying to future-proof your technology. It has to be fast, so some of the methods that we have aren't going to immediately work there.
887120	893680	And you have to have compatibility with the old stuff. So, interesting.
893680	905360	Alright, so another side question on this one. How did you find yourselves doing the testing on DNSSEC in the first place?
905960	908400	I think Adrien should answer this one.
908400	923040	Well, actually I think we explained that in the talk. Sorry, it was nice. It happens that I am an OVH customer for many, many years.
923180	930000	And one day I just did a redirect on my domain just to test what it would do.
930000	942100	And then I did realize that, well, something could transport in the DNS zone. And from there I just thought that maybe I'm not the only one to have such a behavior.
942160	949500	So I did try on a client domain first, and same issue, and then you guess what happened.
951950	954990	And then we see what happened. Yeah.
954990	955870	Yes.
958790	965130	Saga, you mentioned you might have another couple of questions. You're welcome to drop those in whenever you might like to.
965890	967880	So, other things that you've...
970970	979870	Can you give me any idea of where you would have gone with this research had you more time or had you more...
982150	988170	Let's go with more permissions, if you had been told by somebody that you were allowed to.
988170	994010	Is there some space that you would have liked to have gone with this presentation?
995750	1006090	Well, one thing, assuming I had all permission, would have been to actually send an email to people we were able to find data about.
1006090	1011930	And ask them first if they didn't know that their redirections were almost perfect.
1012070	1017790	And other thing would be to ask them to tell us which redirect we did not find.
1017790	1025510	So we get a better idea of what kind of plaintext we were not able to recover from our hashers.
1025710	1034270	So, two ideas which I consider are not evil. It would be some research thing, but would have required more permission.
1035370	1037130	Remy, any other idea?
1037550	1041210	Well, in the more evil kind of things we could do, of course.
1042470	1047630	As I mentioned earlier, we could collect this information with other information we have.
1047790	1052210	For instance, all the hosts that people use to receive their emails.
1052210	1056670	Well, most of them were Gmail, so it's not necessarily the most interesting things.
1056930	1060130	But some of them are not, and we could look into these.
1060130	1069010	And we could try and see the proportion of email addresses that are self-hosted or that are hosted in known-to-be-vulnerable domains.
1069010	1071330	That would also be extremely interesting.
1071330	1080790	As I also think we say in the talk, we could look at the pwned email databases or pwned addresses database
1080790	1090870	to see how much of these redirects are actually directly usable by people in the know to get an account and to use.
1090870	1097650	So these are two things that we'd be curious to know about, which are perhaps a bit less nice, of course.
1101140	1103880	Good answers. All right, I like where you're heading on that one.
1104040	1108060	There was a follow-up question in the chat over here from Overdrive.
1108200	1115660	Although there is an RFC to add EDSA to DNSSEC, why isn't it used more widely, even though it...
1115660	1117820	Maya, I'm talking here.
1117820	1122400	Even if it answers all the caveats, performance and security you talked about.
1122400	1129140	So why isn't it used more widely, EDSA?
1129160	1133120	ECDSA. I think I can answer this one.
1133120	1141280	ECDSA is being deployed. So it is at the time that we're talking, it's widely deployed, it's getting almost there.
1141280	1143360	It wasn't true a few years ago.
1144360	1153060	So really, the question is more about what took so long before we started implementing ECDSA at scale.
1153340	1156700	And perhaps, I mean, I don't have the full answer to that.
1156700	1164620	But perhaps part of the reason is that it wasn't clear which solution to zone walking should be implemented.
1164740	1172860	As we mentioned in the talk, the issue of zone walking has been identified fairly early on on NSEC.
1172860	1180280	And so NSEC2 and NSEC3 have been proposed, NSEC4 has been proposed as well, NSEC5 has been proposed.
1180280	1190720	And the problem is, and most of them, NSEC2 and NSEC4 didn't see the light, NSEC4 has not been finalized, NSEC5 has not been finalized.
1190720	1197060	So people were waiting, perhaps, on a solution to emerge, to be stable, to support.
1197060	1203560	Because again, when you're doing DNS, when you're doing backbone of the internet kind of things, you want to support things very long term.
1203560	1213600	So there was an expectation that some of the candidates would happen to be the right one, and that did not happen for a very long time.
1213600	1222340	And in fact, ECDSA is not the best candidate, it's just the best available candidate using existing technology.
1224600	1232680	It accomplishes enough of the pieces and there's no better idea right now, huh? Interesting.
1232680	1237380	You gave me one final question over here, which seems like it's a little more fun.
1237380	1242660	So there was a slide with a locksmith on the DNSSEC rollover session slides.
1242720	1246860	What is the story behind the slide with the locksmith?
1249720	1259500	Okay, well, so it's during a DNSSEC rollover key session.
1259500	1263320	So something that happens, if I remember correctly, maybe every three months.
1263680	1273680	And it's like a very scripted ceremony with many steps and everyone getting things out of the safe, signing the keys, putting them back, auditing everything.
1273680	1285440	And it happens, and maybe one day before the ceremony, during a rehearsal, they saw that one of the safes containing one of the HSMs was jammed.
1285560	1293660	So what do you do? Well, you do have to crack the safe open, and so they had to hire a locksmith to open it.
1293660	1297900	I think it took 28 hours to open it, so a lot of work.
1297900	1303440	And so they had to pay everyone two more hotel nights because they had to delay the ceremony.
1303680	1310340	So even with cryptography, you sometimes have to get back to your old locksmith and crack safes open.
1311140	1315940	Ah, physical security is never out of style, is it?
1316020	1328400	No, but at least since it took the locksmith like 28 hours to open it, I'm hoping that any bad people would have been detected before they were able to actually open the safe.
1329640	1336520	That is kind of the thing with the safe cracking, right? You're always going to be able to get in, you just hope it takes long enough to be noticed.
1339460	1340260	Fantastic.
1345020	1351840	I think I already asked part of this, but we'll hit it again just to make sure we cover our bases.
1353140	1366420	Where would you want somebody else who has a different set of skills or a different amount of time or a different background to do their own research on this subject?
1366420	1374120	Is there something that you would point someone towards if they were looking for a research topic of their own?
1375880	1391380	I have a ton of that. Adrien may have others as well. Perhaps I can start by saying that, as I hinted to, DNS is something that has to be understood at a global scale.
1391380	1406840	And something that should be understood is that, although it's all virtual and it's all the internet, it really is made of servers that have a physical implementation somewhere, that are under some jurisdiction somewhere.
1406840	1423560	And something I would like people to look into is the geopolitics of how these whole agreements and choice of algorithms and choice of position where you put the servers, the latency as a function of geography.
1423560	1444500	All the interconnections between the backbone of the internet and the way most people use it, make it transparent, but really it matters, and the geopolitics, so the influence of international agreements, discussions, not only economical but also political.
1444500	1447320	That would be one thing I'd like people to look into.
1447320	1457780	Ah, do you hear that? All of you folks who are into international politics and where the lines get drawn, you have somebody who would like to work on you from the technical side.
1459040	1461940	Absolutely. Adrien, I think, has many ideas as well.
1463360	1475560	On this very specific subject, not so much, actually. The best idea I had was actually about the domain key thing I just told before, but someone already did it like two months ago.
1475560	1481500	Very good. It shows that we're not the only ones looking at DNS records.
1483480	1492580	And then, a more general thing, you could consider this leakage almost like some kind of side-channel attack.
1492900	1504760	It's some kind of very low-tech side-channel attacks, and I'm pretty sure there are many other areas where you could find public data where you're not expecting it at all, just where it's a little hidden.
1504760	1526860	So, there's a little of luck you need, because you need to find the first record, but if one day you do find some public info that you were not supposed to find, well, try to dig up behind it and find out if it is just one, or if there are thousands of such info in the same place.
1528240	1533600	I also have a suggestion for the more cryptography-oriented people.
1533600	1540520	The way that zone-walking is mitigated is by using white lies.
1540600	1546900	So, you would sign a lot of information, and so you can force the server to produce a lot of signatures.
1546900	1565460	ECDSA is famously a brittle algorithm, and so if the implementation on the server is not absolutely perfect, it's quite likely that by collecting millions, billions of signatures, you can actually obtain the private key with known techniques.
1565460	1589680	So, one thing that we didn't look into, but you may want to check, is, okay, can I find DNS servers that have not the latest OpenSSL library, say, use known attacks against ECDSA and forcing the white lies mechanism to obtain the necessary signatures, and then perform a DNS spoof?
1590040	1592520	Something like this might be interesting.
1592520	1598160	That is a nice sequence of events there. I like where you're going, so it'll be neat to see if somebody...
1598160	1613140	Just to add on this, I have already tried a few millions to get a few million records and try non-3Us on it, so the most basic ECDSA attack, and it was not successful, but maybe some more advanced attacks would actually work.
1614840	1629420	We will make sure that we have your contact information in the track one channel over here at the end of this, so that people can ping you if they would like to talk about this further.
1629420	1639600	In fact, now is probably a good time to make sure that, is there a place that you would like for people to reach out to you if they have more questions or thoughts about the work that you've been doing?
1641920	1650260	dnssection.ovh, and you have all the contact info on this website. So, that's the website to put on the chat.
1650520	1654300	Perfect. We'll get somebody to drop that in there for us.
1655740	1666500	So, Sajed, I don't want to just bulldoze you here. If you have another thought for us right now, then if you have a question, drop us with that before I do our closeout.
1669400	1682160	So, we do have one more question from the audience. It was asking about geopolitically, where do you see CA providers fitting in, say, borders of countries that are apt to be taken over?
1682200	1688460	Would you personally prefer a CA provider being further away from those borders, or do you think it matters at all?
1689280	1695580	That's an excellent question for which I think there is no easy answer, but that's what makes a good question.
1695580	1714940	I think the borders are a huge, huge issue. It does matter. As you know, CAs are generated usually using machines, dedicated machines, and whoever seizes them has the possibility to do whatever they want with it.
1714940	1729080	So, yes, indeed, if you have CAs, if you want to have any kind of guarantee about the physical security of something, put it as far away as you can from moving borders. Absolutely.
1731840	1756720	Great. All right. So, my last question that I like to hit people with is what would be your call to action? Not just something that you want people to research further, but what would be the core of what you're attempting to get people to understand or to get interested in about the work that you're doing and give people that leg up on moving forward?
1763000	1782700	That's a complicated question. I think Adrien already put forward the notion that look around yourself, look around the technology that we use every day. The more we use it, the less we ask about it, the less we wonder about how it works and why it works and why it doesn't work.
1782700	1805440	And we tend to be focused on getting work done. What we do is exactly the opposite. We're trying to stop and think about, okay, it doesn't work. It's interesting. It's like bugs. You know, people try to kill bugs whenever they see a bug. And we like more collecting them and say, oh, well, that's nice. This one has wings and this one is eating some stuff.
1805440	1830400	So we really try to do that and to call for people to focus on issues, not to try and solve them, but to try and look at issues for themselves as something that's interesting. And that brings not only solutions, but brings more intelligence, more ideas into the game. But that's my take on it. Adrien perhaps might have something more less poetic to say.
1830400	1848780	No, actually, I do agree with you. And even like in my other life, I am a software engineer. And when I do find a bug, even something which is just strange, but never happens again in other circumstances, I always put it for a rainy Friday and try to look at exactly what happened.
1848780	1873620	And often, more than just this bug, often shows some hidden secrets that we are happy to fix before it actually goes for real. So as a matter of fact, yes, do look around you and try as much as possible to get to the bottom of strange things to find out if it is only building or if there is a long story behind it.
1875020	1889000	I appreciate those answers. And I appreciate the two of you very much for coming to join us for this. I also am very much entertained by the light mode, dark mode thing we have going on with the outside and in the dark. So this is cool.
1889000	1911260	Thank you so much for your presentation and for spending your time with us. If anybody has any additional questions, they have posted, Oblivia posted the dnssection.ovh in the TrackOneLive QA, so you can find that there. Otherwise, have a great rest of the convention and we hope to see more from you folks soon.
1912720	1920900	Well, thank you very much to all DEF CON goons to be able to make this session happen this year. So thanks a lot to you too.
1921400	1923140	Cheers. Thank you. Bye everyone.