WEBVTT 00:44.380 --> 00:45.420 Hi there! 00:45.420 --> 00:52.880 So we are live with the speakers who presented on practical VoIP hacking using Mr. 00:52.880 --> 00:53.640 Sip. 00:53.640 --> 00:56.640 And welcome, welcome to DEF CON Safe Mode. 00:56.640 --> 01:00.540 Not quite what you would normally have expected probably for coming to Vegas, right? 01:00.540 --> 01:05.880 But glad that you're able to join us and share some information with us. 01:06.060 --> 01:09.860 I understand though that you are both first-time speakers at DEF CON. 01:09.860 --> 01:10.860 Is that correct? 01:11.520 --> 01:13.040 Yes, that's correct. 01:13.040 --> 01:13.520 Thank you. 01:13.520 --> 01:14.920 Thank you for the opportunity. 01:15.340 --> 01:16.620 Yeah, that's great. 01:16.620 --> 01:28.040 Yeah, so we have a tradition here at DEF CON for first-time speakers where really it's a historical tradition of where we kind of do a shot or a drink with someone on stage to kind of welcome them to DEF CON. 01:28.040 --> 01:36.420 So as your first-time speakers, I'd like to, you know, hold up a cup and have a drink here with you both and say cheers and say welcome to DEF CON. 01:37.160 --> 01:38.160 Okay. 01:38.160 --> 01:39.480 Yep, cheers. 01:48.960 --> 01:50.760 That was strong. 01:51.120 --> 01:53.100 A little early where you are. 01:53.100 --> 01:54.280 Strong coffee. 01:55.440 --> 01:57.040 Awesome, awesome. 01:57.320 --> 01:58.380 Yeah, so that's great. 01:58.380 --> 02:01.840 So let's get into a couple of the questions and everything. 02:02.060 --> 02:05.820 First off, right, so we recorded the talk a little bit ago. 02:06.080 --> 02:09.600 Really, right, like since you recorded and kind of presented on Mr. 02:09.600 --> 02:15.000 Sip here at DEF CON, are there any major changes or updates you kind of want to share with the audience? 02:17.180 --> 02:26.580 So first of all, so inside this presentation, DEF CON, we actually show most of the new updates. 02:26.580 --> 02:28.360 So they were not published before. 02:28.360 --> 02:33.440 So exclusively we presented many other modules and all these demos. 02:33.440 --> 02:38.120 They're all new and we first time showed them in DEF CON. 02:38.120 --> 02:54.040 Since the video published, like in a week's time, we are still updating the documentation and the YouTube channel we have, Twitter page we have, people can follow, and the GitLab page we use to host the website for the pro version. 02:54.040 --> 02:56.540 So these are the recent updates we can say. 02:56.540 --> 03:00.360 But other than that, the whole DEF CON experience is the new update. 03:00.360 --> 03:05.180 So everything we show is the new content, all these pro features, the new modules. 03:05.180 --> 03:11.320 They were not published before and then right now we just introduced them. 03:12.380 --> 03:13.620 Awesome, awesome. 03:14.120 --> 03:23.200 Yeah, so kind of, I guess also to kick things off here, so kind of what drew you to like VoIP research and SIP security and like kind of the origin for Mr. 03:23.200 --> 03:23.920 SIP? 03:24.860 --> 03:27.760 Okay, that's a big question, I think. 03:28.660 --> 03:34.160 Millie, I would like to answer that and if you would like to add something after that, you're welcome. 03:34.460 --> 03:35.200 So Mr. 03:35.200 --> 03:57.600 SIP goes back to 2011 and one of our meetings with Millie also goes back to one of like 2012 or 2013 interviews because like once I had a job application in Millie's company and he was interviewing me, but there was no SIP at that time, but that is just once we came to meet each other. 03:57.980 --> 04:07.560 And around that time, so Millie was working for a big telecom company, one of the biggest in the world, and they had the SIP team and security team there. 04:07.560 --> 04:29.080 They were developing one internal tool and with that internal tool, they were also hiring somebody like a research supporter and then in 2012, I think they didn't have NDA and one of that guy who was not hired forked the project and also published some open source modules, 04:29.080 --> 04:35.700 but I think the project didn't go too deep because it doesn't have any like... also that's a comparison, I think. 04:35.700 --> 04:40.940 We can't say it doesn't have any noble or unique exploits vulnerabilities inside, but Mr. 04:40.940 --> 04:46.200 SIP stands out that it is both scientific and practical. 04:47.000 --> 04:50.600 It is very interdisciplinary, I would say. 04:53.300 --> 05:08.140 It has full automatic modules that does all the vulnerability search, but then in the real world attacks, it is utilizing novel exploits, CVEs that is even just not published before Mr. 05:08.140 --> 05:12.500 SIP, so it contains a lot if you compare with other things. 05:12.880 --> 05:21.620 But if we go back again 2012 to 2015, Melih worked on a closed source project, different version of Mr. 05:21.620 --> 05:26.340 SIP that was kept always private and closed under the company. 05:26.700 --> 05:34.720 And by 2015, Melih left the company and he was thinking and by coincidence, we met in Black Hat London 2016. 05:34.980 --> 05:38.920 We said, oh, hi, you interviewed me four years ago and I said, oh, how's it going? 05:38.920 --> 05:41.340 He said, oh, I quit that company, et cetera. 05:41.480 --> 05:42.920 And then this was the story. 05:42.920 --> 05:44.560 We said, okay, what is happening, Mr. 05:44.560 --> 05:44.860 SIP? 05:45.040 --> 05:51.140 He said, I want to program it from scratch, make it bigger, make it like Perp Suite. 05:51.140 --> 05:59.840 We had the idea that we could make it just like a real application that every penetration tester is using. 06:00.240 --> 06:02.660 That was a dream in 2016. 06:02.800 --> 06:06.420 Nowadays, after four years, we have about 10 modules. 06:06.420 --> 06:08.500 It is becoming a reality. 06:09.080 --> 06:14.540 So we work hard on those programming, software engineering, because it is a big project. 06:14.540 --> 06:19.060 It is not one time published application, but it's evolving all the time. 06:19.060 --> 06:21.820 And we have lots and lots in the roadmap. 06:22.380 --> 06:32.840 First, it appeared many times in arsenals, Black Hat arsenals and some other technical conferences, practitioners conferences. 06:32.980 --> 06:38.500 And also many published several research articles during his PhD. 06:38.840 --> 06:39.380 So Mr. 06:39.380 --> 06:45.280 SIP actually gave him both, I would say, almost like a startup company and a PhD. 06:45.280 --> 06:54.520 So there are a lot of, I think, events happened through the history of Mr. 06:54.520 --> 06:54.800 SIP. 06:54.800 --> 06:56.480 It is a small application. 06:57.400 --> 07:02.860 It has several journals behind a PhD work, like a four years of PhD work. 07:03.100 --> 07:06.000 Plus, it is becoming almost like a startup. 07:06.000 --> 07:19.040 But the main idea is that we keep it open source and we want community to use it and see that how SIP is important, VoIP attacks are important, and how they can just have a reliable tool. 07:19.860 --> 07:20.080 Cool. 07:20.080 --> 07:20.660 That's awesome. 07:20.660 --> 07:24.640 Yeah, there actually is a question in the chat about why does the website for Mr. 07:24.640 --> 07:26.820 SIP Pro require signing into GitLab? 07:26.820 --> 07:28.920 Is that maybe one of the other ones? 07:29.440 --> 07:31.240 Oh, it is, I think, not ready. 07:31.240 --> 07:31.760 That's why. 07:31.760 --> 07:41.040 So we didn't want Google to index something that is like a demo content because we have the template now imported in GitLab and it is getting updated. 07:41.040 --> 07:41.940 We are keeping it. 07:41.940 --> 07:44.720 But we didn't want to show it half missing. 07:44.720 --> 07:46.020 So it is just ongoing. 07:46.020 --> 07:47.060 It's very new. 07:47.060 --> 07:57.160 And we wanted to include the link because the DEF CON video will remain online and maybe next week it will be open, the website, the Mr. 07:57.160 --> 07:58.480 SIP Pro website. 07:58.560 --> 08:02.640 But right now, it is still ongoing. 08:02.640 --> 08:05.100 That's why it requires sign-in. 08:05.100 --> 08:07.780 Even if you sign in, it will say you're not authorized. 08:07.960 --> 08:11.200 But I think I'm happy if people go and sign up to GitLab. 08:11.200 --> 08:12.400 GitLab is cool. 08:13.340 --> 08:15.920 It's free and it allows a lot of things. 08:15.920 --> 08:17.560 Awesome, awesome. 08:17.560 --> 08:19.240 Yeah, so we'll move on to... 08:20.060 --> 08:21.060 Yep, so... 08:21.060 --> 08:26.300 Sorry, I was just saying sorry for those users who are trying to get into the website. 08:26.300 --> 08:30.100 I'm sorry that we are struggling because of this. 08:30.100 --> 08:31.540 Sorry, I interrupted you. 08:31.540 --> 08:32.940 You're good. 08:32.940 --> 08:34.380 No, that shows interest, right? 08:34.380 --> 08:34.780 It's good. 08:34.780 --> 08:35.960 Everyone's excited. 08:36.820 --> 08:39.280 Yeah, so another question from the chat. 08:39.480 --> 08:43.360 So if you're aware that someone's going to use an attack using Mr. 08:43.360 --> 08:45.300 SIP, so imagine you're on a blue team, right? 08:45.300 --> 08:51.200 Or in the SOC, what would you suggest as the first line of defense to protect yourself or your company? 08:54.860 --> 08:59.040 I think... Okay, I will say something maybe, but feel free. 08:59.040 --> 09:03.040 I take the first sentence and feel free to add after me. 09:03.420 --> 09:10.920 I think when they do penetration testing inside the company, let's say they are using Mr. 09:10.920 --> 09:24.420 SIP and they are trying to find vulnerabilities and all tests, one of the defense they could do is, like we also mentioned in the presentation, that awareness, the password policy awareness. 09:24.420 --> 09:30.680 So usually it is the lowest priority in the companies and security policies. 09:30.740 --> 09:34.340 And a strong password policy is really necessary. 09:34.340 --> 09:38.060 But when we look at SIP itself, it is vulnerable. 09:38.060 --> 09:49.220 So there are some of the aspects that are unavoidable, like there will be VoIP attacks and there will be almost no defense if you deploy a sophisticated attack. 09:49.220 --> 10:03.880 So there is not much to do, but they could do the standards like monitoring and actively having some security researchers looking at things and lots of awareness, I think, inside the company, strong policy for passwords. 10:04.180 --> 10:08.520 All these things are, I think, good for defense, but I'm not sure. 10:08.520 --> 10:10.640 Maybe you want to add something, maybe? 10:10.760 --> 10:24.820 Yeah, using VoIP specific security parameters like VoIP application firewall or VoIP IPS should be beneficial. 10:25.820 --> 10:26.620 Yeah. 10:28.800 --> 10:30.200 Cool, cool. 10:30.280 --> 10:31.200 Appreciate that. 10:31.200 --> 10:31.480 Yeah. 10:31.480 --> 10:34.400 So we'll go one other question here. 10:34.940 --> 10:35.440 Right. 10:35.440 --> 10:47.980 So if you have a lot of experience, obviously looking at kind of SIP and VoIP attacks and everything, would you say that there's any device or companies out there you'd recommend over another to kind of do a better job of protecting against like the attacks that are in Mr. 10:47.980 --> 10:48.760 SIP? 10:49.620 --> 10:50.460 Okay. 10:50.460 --> 10:56.120 I think I will give this question to Mili by adding some on that. 10:56.120 --> 11:03.320 So maybe when we recommend or think about the company, it is the client applications and the server applications we can talk about. 11:03.400 --> 11:14.060 I would think they're mostly similar, but Mili, what do you think about the companies like SIP servers or other companies deploying SIP products? 11:14.060 --> 11:15.480 What do you think about them? 11:17.260 --> 11:23.040 I couldn't get the exact question, but could you put a summary? 11:23.700 --> 11:24.740 Yeah. 11:24.940 --> 11:31.800 Like I think, what I think is, so at the end, our attacks are against the SIP protocol. 11:31.800 --> 11:33.380 It is not for products. 11:33.380 --> 11:35.980 And I think every product is vulnerable over there. 11:35.980 --> 11:37.700 So it is not product based thing. 11:38.680 --> 11:42.560 Also because I think inside the clients or servers, they don't have any 11:46.800 --> 11:48.940 defense mechanisms deployed in the server. 11:48.940 --> 11:53.480 So they have to get additional defense mechanism. 11:53.800 --> 11:58.040 But Mili, what I'm thinking is, do you have more experience on that? 11:58.040 --> 12:05.040 What do you think if any SIP servers, some brands or products are better than other ones? 12:05.040 --> 12:07.020 Do you recommend any of them? 12:11.490 --> 12:18.150 It's not appropriate to say to bring some vendors. 12:19.990 --> 12:20.770 Yep. 12:20.770 --> 12:20.970 Yeah. 12:20.970 --> 12:21.490 No worries. 12:21.490 --> 12:21.810 No worries. 12:21.810 --> 12:22.670 That's fine. 12:22.850 --> 12:23.730 Yeah. 12:24.130 --> 12:36.550 So for someone who's kind of, let's say, isn't as familiar with the SIP space or VoIP attacks, maybe they're more used to using some standard things against Windows or Linux. 12:36.550 --> 12:46.710 I guess, how would you recommend someone start to learn and kind of experiment or come into, what kind of resources would you recommend for someone starting to look at SIP or VoIP style of attacks? 12:47.550 --> 12:53.290 Other than just saying, use Mr. 12:53.290 --> 12:53.990 SIP. 12:54.910 --> 12:55.450 Oh, okay. 12:55.450 --> 12:55.910 Yeah. 12:55.910 --> 13:06.650 I think one of the things they can definitely deploy the environment, the lab environment, where they can simulate or emulate the SIP servers and the client. 13:06.810 --> 13:13.070 So they can have, because nobody has this all SIP deployment at home, but every company has it. 13:13.070 --> 13:23.210 So my university at Oxford, we have this SIP servers, clients, and it would be really easy, I think, to hijack the professor's phone and then do these things. 13:23.210 --> 13:31.750 But at the end, for a new starter to experiment, it is not going to be possible to deploy or have a SIP deployment at home. 13:31.750 --> 13:37.450 Nobody does that, but they can definitely emulate something on their computer. 13:37.630 --> 13:45.770 And there are many tools for that, that they can start generating SIP messages on their local server and they can run virtual machines. 13:45.970 --> 13:52.810 So you take some virtual box, few instances, one of them is server, it has an IP address, other one is few clients, et cetera. 13:52.810 --> 13:56.070 And then imagine one virtual box is calling another one. 13:56.070 --> 14:00.070 And while doing so, you have another virtual box, which is Kali Linux. 14:00.070 --> 14:04.690 And then this one is that hacker machine, gets access to network and they can play with it. 14:04.690 --> 14:09.550 So they can watch the start, watching the network messages and play with it. 14:09.550 --> 14:14.310 I think new beginners could do that and that would be fun. 14:14.810 --> 14:15.190 Yeah. 14:15.330 --> 14:21.450 Also reading the first SIP RFC is very beneficial. 14:22.970 --> 14:33.110 As a virtual SIP PBX, they can use any kind of Asterix-based SIP PBX, such as Trixbox or FreePBX, et cetera. 14:35.390 --> 14:36.590 Awesome. 14:38.050 --> 14:38.550 Yeah. 14:38.550 --> 14:43.830 So there's a question in the chat from RPTK2015. 14:44.130 --> 14:55.890 Can you expand a little bit about Wholesale VoIP, Carrier Voice, and Call Shop, the attacks that were mentioned in the talk in context of registration hijacking? 14:56.150 --> 14:57.470 Yeah. 14:57.510 --> 15:05.210 So I would like to give some quick summary on that because it is a real incident, first of all. 15:05.210 --> 15:15.790 And Millie was also one of the investigators and an expert preparing technical reports on it, like in a real million dollar hijacking. 15:15.790 --> 15:18.330 So they found out how the hackers did it. 15:18.330 --> 15:21.330 And now also in DEF CON, we show how they did it. 15:21.330 --> 15:24.810 So what happens is the steps are simple, I think. 15:25.830 --> 15:28.730 So the hackers should get into the company network. 15:28.730 --> 15:30.970 That is, I think, one of the preconditions. 15:31.630 --> 15:44.910 And then with using MrSIP, they can enumerate the users, break the passwords, get into or collect all the user's credentials. 15:44.910 --> 15:45.850 That is the step. 15:45.850 --> 15:48.230 And that is not difficult by using MrSIP. 15:48.230 --> 15:49.630 Everything is automatic. 15:49.630 --> 16:04.910 Once the hackers collect enough information about the users, what they do is that they can start selling whenever the users are sleeping or not using their lines or the accounts, let's say. 16:04.910 --> 16:14.050 The hackers can start selling their accounts and just charge all these things into the company because the company has the infrastructure that is running. 16:14.050 --> 16:28.490 And if they allow calls to, let's say, other countries, the hackers can just, without running any infrastructure, telecom infrastructure, they can just charge them and make calls on behalf of all these stolen users. 16:29.110 --> 16:35.410 And at the end, maybe three months later, the company will realize, okay, there were all these frauds going on. 16:35.410 --> 16:47.910 They will detect, but it will be too late because the guys, the hackers, already make, I think, millions easily by selling a few months of utilizing this telecom infrastructure for a few months. 16:47.910 --> 16:53.530 So what they can do, they can, for example, run a local phone call shop. 16:53.530 --> 16:58.390 Imagine one of the corner shops that says, okay, you can make international calls. 16:58.390 --> 17:06.730 And they might be using actually one of the other big company infrastructure and underground, like maybe stolen credentials. 17:06.730 --> 17:09.450 And you still go and pay them and make the call. 17:09.450 --> 17:12.930 And it is maybe long distance call, super expensive thing. 17:12.930 --> 17:18.150 And they charge small money, but because they don't pay anything for the infrastructure. 17:18.590 --> 17:26.930 And because everything is free and quickly, as much as they can, they start selling those services and many other things. 17:26.930 --> 17:28.750 They are very creative, right? 17:28.750 --> 17:30.190 Creative people. 17:31.290 --> 17:33.090 So that's basically it. 17:33.090 --> 17:42.510 So a few months, I think it will take until a company realizes, okay, why our bills are much higher than usual or the traffic going on too much. 17:42.510 --> 17:44.430 And then that will happen. 17:44.430 --> 17:45.650 I think that is the story. 17:45.650 --> 17:46.450 Like that is how... 17:47.570 --> 17:56.530 Also, even if they understand that they need to pinpoint the problem, exact problem, because they still don't know about the fact. 17:56.730 --> 18:01.910 This is also a very common hacking story in the real life. 18:01.970 --> 18:03.890 So I experienced a lot. 18:06.830 --> 18:08.830 Melih, can I ask you a quick question? 18:08.830 --> 18:17.190 So do you think not only the telecom companies, I think the banks can have this or what other type of companies can have this type of call fraud? 18:17.190 --> 18:28.690 Because if a bank has the infrastructure for their own use, and if they allow with the tip trunks, external calls, so they can also be the victim of this type of fraud, right? 18:28.750 --> 18:29.750 Yes, exactly. 18:29.750 --> 18:31.030 Banks and other companies. 18:31.030 --> 18:34.490 It's not only the telecom companies, so many other companies can suffer. 18:34.610 --> 18:45.610 Many companies, any enterprises running voice over IP and making outbound calls to internet can be vulnerable for that kind of attack. 18:46.390 --> 18:47.790 Mm hmm. 18:47.790 --> 18:49.270 Cool, cool. 18:49.270 --> 18:52.650 Yes, we have another question from the chat from ThoughtSeeker. 18:52.650 --> 18:53.710 Oh, great. 18:53.710 --> 18:58.810 Do you recommend using session border controls in front of critical SIP infrastructure? 19:01.770 --> 19:05.770 Well, I can reply to this question. 19:05.770 --> 19:06.490 Yeah. 19:07.170 --> 19:18.290 SPCs, the session border controllers are very common in internet service provider level companies, not for enterprises, maybe. 19:18.450 --> 19:23.310 They are expensive as far as I know, but it's very beneficial. 19:23.310 --> 19:26.710 It's working like a SIP firewall, SIP application firewall. 19:26.710 --> 19:37.150 So it's one of the best SIP security firewall type, I can say. 19:38.470 --> 19:39.790 Cool. 19:39.790 --> 19:40.870 Awesome. 19:40.870 --> 19:41.250 Yeah. 19:41.250 --> 19:42.670 So something else. 19:42.670 --> 19:50.910 So just kind of pondering, what do you think is probably the most significant attack someone could kind of do using SIP VoIP traffic? 19:50.910 --> 19:55.950 What do you think that maybe would be the most impactful or significant thing you could see someone trying to do? 19:56.750 --> 19:57.710 Right. 19:58.810 --> 20:01.210 Mehdi, do you want to answer that? 20:01.210 --> 20:06.150 I have some stories, I think, but we can both, I think, elaborate on this. 20:06.270 --> 20:07.590 What do you think? 20:08.050 --> 20:28.850 In the service provider level, there are many fraud type attacks, but for enterprises, telephony DOS is one of the most powerful attack, most impactful attack. 20:28.910 --> 20:39.790 So there are many different kinds of telephony DOS attacks you can run using VoIP systems. 20:40.510 --> 20:41.450 Mm-hmm. 20:41.450 --> 20:48.590 Yeah, I think, so in the DOS denial of service attacks, Mr. 20:48.590 --> 20:57.050 SIP is very skilled because we have so many protocol level vulnerabilities being published and getting also published. 20:57.050 --> 20:59.410 And that is one of the area that Mr. 20:59.410 --> 21:00.990 SIP is very powerful. 21:00.990 --> 21:05.330 It has very unique novel attacks, built-in modules. 21:05.490 --> 21:14.870 And by doing so, I would say, DOS is definitely one of the impactful, but at the same time, inside Mr. 21:14.870 --> 21:28.670 SIP, we have the advanced scenarios that where you want to make an impact without knowing anything, full automatic scenario that you want to attack to an infrastructure, all these advanced custom scenarios. 21:28.670 --> 21:33.570 We have a mechanism to write and prepare your attack. 21:33.590 --> 21:34.490 And then Mr. 21:34.490 --> 21:38.170 SIP will automatically follow all the attack and you will not do anything. 21:38.170 --> 21:43.270 But let's say put a Raspberry Pi into the company network, leave it there. 21:43.670 --> 21:49.310 Maybe a month later, nobody is there, but it will begin an attack, deploy the full automatic attack. 21:49.310 --> 22:01.030 And any of those, imagine the fraud infrastructure running, maybe you can build a VPN server inside, make a tunnel outside and play a lot with this. 22:01.030 --> 22:08.690 And then anytime you want to distract people, you can place a DOS attack and any other stuff. 22:09.630 --> 22:20.210 We couldn't have a chance to make demonstration for our attack scenario player, but it's the module of Mr. 22:20.210 --> 22:21.330 SIP, new module of Mr. 22:21.330 --> 22:21.870 SIP. 22:21.870 --> 22:29.150 And we have added some predefined attack scenarios, including D-DOS, telephony D-DOS type of attacks. 22:29.150 --> 22:38.510 And one of them is like, just by sending one SIP invite message, we can occupy the SIP server for 64 seconds. 22:38.570 --> 22:50.270 I just gave theoretical information about that kind of attack, which was a novel attack and we have published it in our academic research papers. 22:52.130 --> 22:52.950 Yeah. 22:53.370 --> 22:54.510 Cool. 22:54.510 --> 22:54.830 Yeah. 22:54.830 --> 22:58.370 So we're coming near the end, but yeah. 22:58.370 --> 23:03.190 Is there anything in particular you really wanted to add that you kind of ran out of time to cover in the talk? 23:03.190 --> 23:05.810 Anything you really want to make sure you share with everyone here? 23:07.130 --> 23:13.390 I think I would recommend everybody and all the SIP community to support and give us the feedback. 23:13.390 --> 23:16.710 That is one of the important things, because Mr. 23:16.710 --> 23:19.090 SIP is not a one-time tool, it's evolving. 23:19.250 --> 23:22.530 And last four years, I think we showed the good progress. 23:22.590 --> 23:31.790 And in the next few years, there will be a lot of new modules and novel attacks coming up, because our roadmap is huge. 23:31.790 --> 23:39.050 Even though we still say some of the parts, I know what Melih has, and we discuss all the night. 23:39.490 --> 23:42.390 We have huge abilities. 23:42.390 --> 23:45.510 We will keep integrating into Mr. 23:45.510 --> 23:46.330 SIP. 23:46.330 --> 23:55.010 And we would like to tell the community that they should definitely follow and tell us how we can cooperate, how they can join. 23:55.010 --> 23:57.590 They are most welcome to help Mr. 23:57.590 --> 24:03.430 SIP and take a part, active role, so that we can make it better. 24:03.430 --> 24:12.370 But the point that we should not miss is definitely follow and communicate, because there are a lot coming. 24:14.070 --> 24:15.650 Awesome, awesome. 24:15.810 --> 24:19.210 Yeah, I guess the last kind of question, I guess, to wrap things up. 24:19.210 --> 24:26.430 So if folks want to learn more, right, or want to contribute, like you were saying, what's the best way for them to kind of reach out? 24:26.430 --> 24:32.570 What's the best contact, like through the GitHub or Twitter, or what's your preferred means of communication? 24:32.570 --> 24:35.610 We can share links as well in the chat. 24:41.800 --> 24:51.520 So definitely GitHub is our first point of contact that we have the public version, open source version. 24:51.520 --> 24:55.200 The pro version is right now private. 24:55.200 --> 25:00.440 We are also open sourcing gradually the pro version modules. 25:00.440 --> 25:03.840 They will get into the public domain at some point. 25:03.840 --> 25:05.720 But GitHub is definitely useful. 25:05.720 --> 25:07.520 We have the links in the slide. 25:07.520 --> 25:09.810 Twitter is definitely a good contact. 25:10.140 --> 25:16.820 Private mail address or Meli's personal accounts, they are definitely good contact points. 25:16.820 --> 25:26.380 We are very active, and we will likely not miss anything that anybody uses any of the point of contact in social media. 25:26.380 --> 25:26.640 Mr. 25:26.640 --> 25:32.100 Sip account, our personal details, personal accounts, most welcome. 25:32.100 --> 25:33.680 I think we don't mind. 25:33.680 --> 25:40.940 There is no official or crazy strict rules on how to reach, it's just code, like easy. 25:42.340 --> 25:43.080 Awesome. 25:43.080 --> 25:45.020 Meli, do you want to add something on? 25:47.020 --> 25:49.360 I can add one more thing. 25:49.840 --> 26:02.280 People just asking about demo, and we will share new demo videos on our YouTube channel most probably next week. 26:03.280 --> 26:08.100 Yeah, I think that is very important that we should tell, yeah. 26:08.780 --> 26:14.880 Because in the Defcon video, I think the fonts were small, that was not very readable. 26:14.880 --> 26:23.920 It's HD and high definition, if they actually watch HD quality, they will see, they will be able to read everything. 26:23.920 --> 26:32.880 But we will also publish the videos of all the modules and all these attacks, bigger fonts, maybe slowly in a better quality. 26:33.100 --> 26:36.100 They will come and we recommend that, I think. 26:36.100 --> 26:38.440 Definitely, they should be watching the YouTube channel. 26:39.240 --> 26:39.980 Awesome, awesome. 26:39.980 --> 26:41.480 Yeah, I definitely think that'd be helpful. 26:43.320 --> 26:44.280 Cool. 26:44.300 --> 26:51.420 Well, if there's no last minute thoughts from either of you, I would really just say thank you for joining us for Defcon. 26:51.420 --> 26:56.260 Thank you for participating from remote places, again, not in Vegas. 26:56.360 --> 27:01.920 And yeah, and look forward to running into you in a future Defcon, hopefully in Vegas in person. 27:02.020 --> 27:06.680 And otherwise, just really want to thank you and stay safe out there. 27:07.440 --> 27:08.680 Thank you, guys. 27:08.680 --> 27:11.360 Yeah, we would like to thank everybody there. 27:11.360 --> 27:12.000 Yeah. 27:12.280 --> 27:21.940 I think the Defcon team helped a lot through this online experience, Pardus and Nikita and everybody taking role there. 27:21.940 --> 27:31.760 And thank you guys for helping and arranging all these things, even in last minute that in all these difficult times. 27:32.520 --> 27:33.540 Awesome. 27:33.540 --> 27:34.380 Well, thanks. 27:34.380 --> 27:36.500 And again, everyone stay safe out there. 27:36.500 --> 27:37.500 Cheers. 27:37.500 --> 27:38.180 Thank you. 27:38.180 --> 27:38.720 Thank you.