1 00:00:00,000 --> 00:00:08,660 Hi everyone, my name is Chloe Mostagi and I'm happy to be on the disclosure panel with you for this wonderful biohacking village. 2 00:00:08,760 --> 00:00:17,140 And so before I get started, I just wanted to let you know who I am so you have a better idea of basically what the content I'm going to share with you. 3 00:00:17,280 --> 00:00:22,820 So I am the VP of Strategy over at Point3Security and when I'm not that, I'm an ethical hacker advocate. 4 00:00:22,820 --> 00:00:36,100 And if you're wondering what is an ethical hacker advocate, basically I'm trying to fight for rights for hackers and also to change the imagery and the wording that the press tends to use about us in a very negative light. 5 00:00:36,100 --> 00:00:40,220 But when I'm not doing that, I also am trying to push for diverse inclusion within the community. 6 00:00:40,620 --> 00:00:55,980 I am the president and co-founder of WOSEC and when I'm not that, I'm also the founder of WeAreHackers, which used to be formally called as LoneHackers, but WeAreHackers is a private online community of hackers who are underrepresented genders. 7 00:00:56,260 --> 00:01:00,460 And yes, we hack at all different levels and have workshops and all that fun stuff. 8 00:01:00,900 --> 00:01:02,380 And yes, I am a parent. 9 00:01:02,380 --> 00:01:11,080 If you're wondering what's a parent, it's basically a parent of any dogs, cats, and hamsters, I guess, and bunnies or any of those kind of things. 10 00:01:11,080 --> 00:01:15,140 Anyway, Shirlika and Luna, which are both some sheebs. 11 00:01:15,280 --> 00:01:34,480 And also I am the Hacker Book Club organizer and what we do is one of those things where we read a new book every month written by someone in the about the hacker community and the author and the people that are mentioned in the book do attend our weekly meetups on Tuesday at 5 p.m pacific time. 12 00:01:34,700 --> 00:01:36,360 Anyway, enough about me. 13 00:01:36,360 --> 00:01:37,820 If you want to follow me, feel free to. 14 00:01:37,820 --> 00:01:38,940 I'm on Twitter and Instagram. 15 00:01:38,940 --> 00:01:40,600 Let's go into the good stuff though. 16 00:01:41,460 --> 00:01:56,140 So what usually when we see the word hacker or when we type in hacker in Google or whatnot, we get like this these type of images, this dark hooded figure, but also we see these ones that have whole cutout and you know. 17 00:01:56,540 --> 00:01:59,000 Anyway, let's just be honest with each other. 18 00:01:59,000 --> 00:02:05,700 This is really annoying at this point because what's happening is that people are seeing us in this way. 19 00:02:05,740 --> 00:02:08,040 Something that looks like a criminal. 20 00:02:08,800 --> 00:02:17,820 And it's not just that, but even if you type in ethical hacker or criminal hacker, if you see on both sides of this, you get the exact same imagery. 21 00:02:17,820 --> 00:02:24,800 So which is even more annoying because it looks like we're still having this situation ongoing. 22 00:02:24,940 --> 00:02:26,680 And it's not the imagery either. 23 00:02:26,680 --> 00:02:29,220 It's also the words being used. 24 00:02:29,220 --> 00:02:40,700 The media, which is press and marketing organizations, keep using the term hacker in a negative way when they should be saying malicious actors or cyber criminals. 25 00:02:41,640 --> 00:02:51,120 But if you're wondering how does this imagery impact us, I'm glad that you're asking because I'm one of those people that's obsessed with brains. 26 00:02:51,300 --> 00:02:52,840 So we're going to talk about them. 27 00:02:52,840 --> 00:03:05,100 All right, so first things first that you should know about when it comes to your brain is we're going to have to dive into the amygdala, which is an almond shaped part of your brain within the temporal lobe. 28 00:03:05,220 --> 00:03:09,520 Now the thing to know about the amygdala, it sorts who's like us, who's not like us. 29 00:03:09,520 --> 00:03:12,940 And because of that, it's the fear versus flight mechanism. 30 00:03:12,940 --> 00:03:29,100 So if the person somehow has a connection like us or looks like us, we're like, this is a friend versus if the person doesn't look like us or we have no association, never had any conversation with someone that is that type of person, we see them as an enemy. 31 00:03:29,240 --> 00:03:35,180 And because of that, that is how we have these things called socially constructed beliefs. 32 00:03:35,180 --> 00:03:52,800 One in the media when they share hackers and imagery of this hooded figure or using the term hacker, what is happening is socially constructed beliefs are now being implanted in other people's minds that hackers are criminals and that all of us are criminals, 33 00:03:52,800 --> 00:03:54,540 we're bad people. 34 00:03:54,540 --> 00:03:59,280 And because of that, it has created this fear in the public. 35 00:04:00,100 --> 00:04:17,580 Now to know about is that when the amygdala sees, for example, let's put it this way, you know when we always tell someone that we're a hacker, and usually the person takes a step back and kind of goes, or they're like the mouth drops, or their eyes get a little big. 36 00:04:17,740 --> 00:04:21,460 They're nervous, but they don't want to come off that they are, but they totally are. 37 00:04:21,460 --> 00:04:22,240 And you know it. 38 00:04:22,240 --> 00:04:26,800 And you're like, dang it, I should have gone the security researcher term, but you did it. 39 00:04:26,800 --> 00:04:27,640 It's okay. 40 00:04:27,640 --> 00:04:33,860 Anyway, what happens is at that point, what's happening is that person knows that now you're a hacker. 41 00:04:34,200 --> 00:04:38,500 And they've seen the images, they've heard the words in the press and whatnot of hacker. 42 00:04:38,500 --> 00:04:44,040 And when they see you, and you tell them you're a hacker, they're taking the step back because they're trying to figure out something. 43 00:04:44,620 --> 00:04:48,700 If you are a friend or a foe. 44 00:04:48,700 --> 00:04:54,340 Now the thing to note about the amygdala is that even though it sends that signal, it's completely subconscious. 45 00:04:54,340 --> 00:04:57,080 So you don't even know that you have a fear of it. 46 00:04:57,080 --> 00:05:03,040 The only time when you know that it's a fear is if it comes in the prefrontal cortex of your brain, which is right here. 47 00:05:03,560 --> 00:05:10,020 Anyway, so what it does is that it sends a message that are saying warning, warning, there's a hacker near you. 48 00:05:10,020 --> 00:05:10,940 Be careful. 49 00:05:10,940 --> 00:05:12,060 It's a criminal . 50 00:05:12,060 --> 00:05:14,720 They do bad, terrible things. 51 00:05:14,720 --> 00:05:23,540 Now the thing is, is that that person now has a choice to react or to ignore it. 52 00:05:23,540 --> 00:05:32,860 Now the only way that you can question socially constructed beliefs and biases is through stories and from meeting people within that community. 53 00:05:32,860 --> 00:05:36,740 The thing is, when we're inside our bubble, we're protected from these things. 54 00:05:36,740 --> 00:05:41,480 We have our own beliefs and it's constantly being verified that you are correct always. 55 00:05:41,480 --> 00:05:46,700 When we go outside our bubble, that's when we realize you're not actually, you don't know everything. 56 00:05:46,700 --> 00:05:50,620 And to be comfortable with the uncomfortable is always a hard thing. 57 00:05:51,080 --> 00:05:57,260 So what's the main takeaway if you're wondering, Chloe, why are we still talking about the brain and the amygdala? 58 00:05:57,260 --> 00:06:01,500 The thing you need to understand is that it's not permanent. 59 00:06:01,560 --> 00:06:04,440 These socially constructed ideas are never permanent. 60 00:06:04,440 --> 00:06:10,900 You have a choice to learn about another perspective, but they have to hear the other perspective. 61 00:06:10,900 --> 00:06:14,660 And right now in the press, we're not seeing that yet. 62 00:06:14,660 --> 00:06:18,980 And because of that, we're still being seen as criminals. 63 00:06:19,920 --> 00:06:30,800 So, and because of this fear and the public perception, we still have a situation where 93% of the Forbes Global 2000 don't have a vulnerability disclosure program. 64 00:06:30,820 --> 00:06:37,380 And 60% of hackers do not report vulnerabilities out of fear of being prosecuted. 65 00:06:37,460 --> 00:06:44,420 And laws that are preventing like good hacking are such as the CFA and DMCA. 66 00:06:44,640 --> 00:06:58,520 And because of this stigma associated with being a hacker and how the public sees us, it also increases the chances of having more malicious attackers, not hackers, attackers. 67 00:06:58,520 --> 00:07:02,140 But I try to catch you there in that slide and see if you caught it or not. 68 00:07:02,840 --> 00:07:09,340 But overall, what we need to know about is that there are legislation out there that is hurting us still to this day. 69 00:07:09,340 --> 00:07:12,060 And what we need right now are some amendments. 70 00:07:12,480 --> 00:07:22,500 So, for example, the anti-hacking laws, the Computer Fraud Abuse Act was actually created in 1984 because Ronald Reagan watched this movie called War Games and panicked. 71 00:07:22,500 --> 00:07:30,380 As you can tell, many of the rules and laws that have been created are usually stemmed from panic and fear based and not through empathy. 72 00:07:30,380 --> 00:07:36,900 They never really had a conversation with the hacker community to say, hey, is this right or wrong what we're doing here? 73 00:07:36,900 --> 00:07:42,340 And the thing is, is that we need to push more than ever some amendments for this. 74 00:07:42,380 --> 00:07:46,800 Yes, we do believe that, you know, malicious actors should have to deal with prosecution. 75 00:07:47,020 --> 00:07:53,620 But if we are going, you know, within scope, then we shouldn't be having to worry about being prosecuted. 76 00:07:53,620 --> 00:07:58,700 If we go out of scope by accident, we shouldn't have to worry about being prosecuted. 77 00:07:58,700 --> 00:08:05,280 However, if we go out of scope and we exploit, okay, yes, we did something bad with a malicious intent. 78 00:08:06,260 --> 00:08:09,980 And anti-circumvention laws are the copyright acts. 79 00:08:10,060 --> 00:08:13,760 And basically seeing reverse engineering is seen as a breach. 80 00:08:13,860 --> 00:08:16,080 Not a breach, but it's just wrong. 81 00:08:16,080 --> 00:08:17,240 It's not legal. 82 00:08:17,520 --> 00:08:21,140 So these are things to consider and remember of. 83 00:08:21,240 --> 00:08:30,100 And of course, we have an acceptable use policy, which is every time that you are on your iPhone or any of those things, it's like, please check this terms and conditions. 84 00:08:30,260 --> 00:08:34,780 I know some of us try to read it, but it's really hard to understand because we're not attorneys. 85 00:08:34,940 --> 00:08:38,700 So it makes it even harder for us to understand what we're reading. 86 00:08:38,940 --> 00:08:42,700 And also many of us, English is not our first language. 87 00:08:42,700 --> 00:08:53,240 And so that's the other issue, is that there's all these things that are set up for hackers ourselves to fall into a situation of being prosecuted. 88 00:08:53,240 --> 00:08:54,480 And it's scary. 89 00:08:55,660 --> 00:09:08,680 But if you want to start changing things, there's one step that you can do right now, which is if you go to change.org, there's this petition that was created, which basically tries to get all of us to sign it. 90 00:09:08,680 --> 00:09:12,140 So then we can bring it and push for changes to happen. 91 00:09:12,160 --> 00:09:20,240 We need organizations to start trusting us and have bilateral trust that they will not prosecute us if we report a vulnerability and we don't exploit it. 92 00:09:20,240 --> 00:09:23,540 We're also asking for politicians to update. 93 00:09:23,580 --> 00:09:25,700 Update the laws that we have. 94 00:09:25,700 --> 00:09:31,900 Creating amendments is one of those because it's the laws that they've created are preventing good hacking. 95 00:09:32,380 --> 00:09:39,560 And also for the media to let them know that please, if you're reporting about the hacker community, please keep us in a good light. 96 00:09:39,560 --> 00:09:43,380 But if it is someone who did something malicious, don't call them a hacker. 97 00:09:43,380 --> 00:09:46,160 Call them a malicious actor or cyber criminal. 98 00:09:46,700 --> 00:09:48,260 And that's one of those important things. 99 00:09:48,260 --> 00:09:58,680 But us as a community, we have to try to do our best to stay within scope and not exploit because when one of us breaks that, it takes us 10 steps backwards. 100 00:09:59,520 --> 00:10:07,720 And I'm looking forward to the other panelists sharing more about what on their side and what they're seeing when it comes to disclosure. 101 00:10:08,280 --> 00:10:12,940 So let's start out by kind of getting a little bit more into the weeds here. 102 00:10:12,940 --> 00:10:20,160 My focus in this area is going to be more on hospitals and the vulnerabilities involved with hospitals. 103 00:10:20,460 --> 00:10:23,440 To start off with, here's a little bit about me. 104 00:10:23,440 --> 00:10:32,160 I don't really want to spend too much time on this particular page other than to say I've got a lot of experience across a lot of hospitals. 105 00:10:32,160 --> 00:10:36,280 It gives me a unique perspective to see some interesting patterns. 106 00:10:36,880 --> 00:10:43,600 And unfortunately, I'm here to scare the crap out of you a little bit about how insecure hospitals really are. 107 00:10:43,600 --> 00:10:47,900 And then hopefully I'll be able to motivate you guys to do something about that. 108 00:10:48,060 --> 00:10:52,560 Let's first talk about the most important thing here, and that's inventory. 109 00:10:53,840 --> 00:11:03,620 When I'm dealing with hospitals, particularly the ones that come into my environment where we start supporting them for the first time, they never have an inventory. 110 00:11:03,980 --> 00:11:08,720 If we're lucky, they've got a spreadsheet similar to one that St. 111 00:11:08,720 --> 00:11:10,320 Ellis here has. 112 00:11:10,780 --> 00:11:14,220 If you get a chance, please participate in the CTF. 113 00:11:14,220 --> 00:11:19,960 That's actually the inventory list for the CTF that we used just recently. 114 00:11:20,000 --> 00:11:21,780 And it's pretty accurate. 115 00:11:21,780 --> 00:11:24,640 It covers pretty much the same thing that I see at hospitals. 116 00:11:25,540 --> 00:11:29,900 Now, there are some tools that kind of help us figure out inventories. 117 00:11:30,520 --> 00:11:38,800 Lansweeper is my favorite, but there's also Case, SCCM, Configuration Manager, and then you can get real manual with Nmap, Mascan. 118 00:11:38,920 --> 00:11:45,740 Those will kind of get you about 80% of the inventory, but it's still going to be mostly accurate. 119 00:11:45,740 --> 00:11:55,560 And the reasons for some of that is because there are things that are getting added and removed to the environment all the time, and the spreadsheets never get updated. 120 00:11:56,400 --> 00:12:16,340 And there's always the fun one where there's a grant that comes along, and the vendor comes in and installs the devices in the environment and doesn't tell IT or IS, and all of a sudden IT and IS have to support these tools, and it's kind of a mess. 121 00:12:16,340 --> 00:12:26,400 So starting out from the very basics, inventories is one of those vulnerabilities that we kind of have to deal with and start figuring out how to get a better inventory for hospitals. 122 00:12:27,240 --> 00:12:30,700 The next one we're going to move into is actually discovering vulnerabilities. 123 00:12:30,700 --> 00:12:40,720 Now, I like to start out with an external scan to figure out all of the stuff that a hospital has put out on the internet that they use to communicate over the internet. 124 00:12:41,520 --> 00:12:52,140 Generally speaking, when those first hospitals come into our support area, they are very, very vulnerable, and we have to start narrowing that down. 125 00:12:52,300 --> 00:12:55,100 You can see the little spreadsheet to the left there. 126 00:12:55,120 --> 00:13:01,800 That's about a year ago, and I'm proud to say that most of those in the critical areas have at least moved off. 127 00:13:03,380 --> 00:13:07,080 But when, like I said, when a new hospital comes in, they're very, very vulnerable. 128 00:13:07,240 --> 00:13:09,560 Nobody knows what they've got out on the internet. 129 00:13:09,560 --> 00:13:12,200 It's always a fun little situation. 130 00:13:12,740 --> 00:13:15,820 And there are a lot of tools that can be used to do this. 131 00:13:15,820 --> 00:13:19,100 I use Tenable.io and the reference page. 132 00:13:19,100 --> 00:13:20,740 You'll get to see a whole bunch of different other ones. 133 00:13:20,740 --> 00:13:26,000 But I also like to bring out Shodan.io and Census.io. 134 00:13:26,720 --> 00:13:38,440 Shodan.io is a website that you can go to, Shodan.io, and you can search for medical devices on it and see how many are actually published on the internet that you have access to. 135 00:13:38,460 --> 00:13:47,220 In the particular case here, I put PAX in there, and there's about 700 plus medical devices published on the internet that you have access to that you can see about. 136 00:13:47,220 --> 00:13:53,780 And if you click on the IP of that particular device, you'll be able to see the CVs and all the things that are vulnerable for that device. 137 00:13:53,780 --> 00:13:55,280 Kind of a scary little thing. 138 00:13:56,280 --> 00:14:03,820 Now, as bad as the external scan is, scannable IPs on the internet, the internals are always much, much worse. 139 00:14:03,820 --> 00:14:11,800 Because hospitals usually design systems where they have this nice, hard firewall that is supposed to protect them from all the different types of things. 140 00:14:12,020 --> 00:14:16,140 And then once you get inside, it's not much security whatsoever. 141 00:14:16,220 --> 00:14:20,080 So it's like that nice little M&M hard candy shell, soft inside. 142 00:14:20,760 --> 00:14:22,360 Nice and scary stuff. 143 00:14:22,360 --> 00:14:24,440 So how does this kind of come about? 144 00:14:25,100 --> 00:14:28,560 Well, I kind of blame it a lot of it on availability. 145 00:14:29,620 --> 00:14:35,760 And then we're talking about the CIA availability, confidentiality, integrity, and then availability. 146 00:14:35,780 --> 00:14:38,760 Availability is king when it comes to hospitals. 147 00:14:38,760 --> 00:14:48,740 If you've ever seen a physician get upset about not being able to access what they need right then and there, it's quite a terrifying experience. 148 00:14:48,740 --> 00:14:50,960 They usually take it out on everybody. 149 00:14:50,960 --> 00:14:54,160 And rightfully so, because we're talking about life and death here. 150 00:14:54,900 --> 00:15:03,140 So that tends to be one of the challenges that we have to deal with for patch Tuesday that comes out, everything getting patched. 151 00:15:03,140 --> 00:15:10,040 How do you reboot something when it has to be up for that surgery that's going to take place at six o'clock in the morning the next day? 152 00:15:10,120 --> 00:15:16,300 And we could also talk about maybe N plus one and having server farms, but hospitals are kind of cheap. 153 00:15:16,300 --> 00:15:26,220 And that leads to my next one where fast and cheap is far, far more important than good or having it built accurate or done with quality. 154 00:15:26,220 --> 00:15:28,620 So the fast and cheap is always going to win. 155 00:15:28,620 --> 00:15:33,020 Nobody really cares how good it is or the quality of it is. 156 00:15:33,020 --> 00:15:37,340 They just want it set up and running and they don't worry about anything else. 157 00:15:38,600 --> 00:15:46,680 Now, of course, that leads to all kinds of fun little problems because Microsoft is a wonderful company that gets everything to work fairly well. 158 00:15:46,680 --> 00:15:47,980 That's kind of one of their goals. 159 00:15:47,980 --> 00:15:51,740 Everything's got to work, but they turn on all the services by default. 160 00:15:52,340 --> 00:15:56,600 And when you're pushing something out fast and cheap, you push it out with the default settings. 161 00:15:56,600 --> 00:16:06,160 So here we are set up with all these services that we don't need that are running and they're now vulnerable because they haven't been patched in at least six months or so. 162 00:16:07,560 --> 00:16:16,860 The next one is kind of a more challenging one and probably the most important one, both IT and IES. 163 00:16:16,860 --> 00:16:18,840 Really, we kind of suck at talking to humans. 164 00:16:18,840 --> 00:16:25,340 We're great at talking about technology and working with computers and communicating along those routes. 165 00:16:25,860 --> 00:16:29,220 And the staff, they don't talk tech at all. 166 00:16:29,220 --> 00:16:30,200 They talk human. 167 00:16:30,200 --> 00:16:39,220 They're worried about emotions and they're worried about being able to understand people's needs and wants and desires and they don't care about the technology. 168 00:16:39,220 --> 00:16:44,300 That's just the thing that's there that kind of gets in their way and hopefully will help them out just a little bit. 169 00:16:45,140 --> 00:16:50,140 And then the last one I want to talk about is there's really no accountability. 170 00:16:50,460 --> 00:16:55,020 There's also no incentive to do better or to fix all these types of things. 171 00:16:55,260 --> 00:17:15,770 So it kind of to Chloe's point earlier there in her talk, she mentions that there's all these different laws out there, but there's no laws about making sure that medical devices or hospital devices are secure and not going to cause us problems. 172 00:17:17,020 --> 00:17:18,300 And there's also no incentive. 173 00:17:18,300 --> 00:17:22,220 There are a few nice little things, hopefully Casey will cover some of that stuff in his talk. 174 00:17:22,220 --> 00:17:26,600 So next I'm going to talk about my solution for this. 175 00:17:26,600 --> 00:17:28,700 And the key word is communication. 176 00:17:28,700 --> 00:17:34,860 Now we as IT, information security, IS, we've got to do much, much better at communication. 177 00:17:35,140 --> 00:17:38,740 We've got to figure out how to communicate with our target audience. 178 00:17:38,800 --> 00:17:42,280 We've got to figure out how to deliver our message to our target audience. 179 00:17:42,520 --> 00:17:50,820 We've got to be able to read our target audience and get better at understanding when our target audience understands our message. 180 00:17:50,820 --> 00:17:54,760 And we may have to modify our message to get that across. 181 00:17:54,800 --> 00:18:02,620 Once we're able to effectively communicate, you know, those horrible soft skills that nobody ever wants to work on because it's boring and challenging and difficult. 182 00:18:02,620 --> 00:18:10,380 Once those are down, then we can start talking about ensuring that integrity and confidentiality of data is maintained. 183 00:18:10,560 --> 00:18:15,660 And it's just as important, if not more important than the availability of the data. 184 00:18:16,220 --> 00:18:29,080 And we'll be able to talk about how quality is just as important, maybe more so, and even cheaper in the long run than getting something out as fast as possible, as cheap as possible. 185 00:18:29,620 --> 00:18:44,540 And then we can also start convincing those politicians to hold people accountable and people, meaning the CEO boards, all those people that build corporations in order to avoid being accountable to different things. 186 00:18:44,540 --> 00:18:54,800 And we'll be able to start building out some incentives to help us have reasons to do things rather than reasons not to do things. 187 00:18:56,400 --> 00:18:59,300 Next, I want to talk about something that kind of scares me. 188 00:18:59,540 --> 00:19:16,060 Last year at the Biohacking Village, there was a conversation going on, and I believe Beau had said this, and it was about how physicians don't really care about security because there's no body count associated with security. 189 00:19:16,080 --> 00:19:20,820 There's no direct correlation of a medical device killing people. 190 00:19:21,200 --> 00:19:24,320 And to be honest, I think medical devices are being used to kill people. 191 00:19:25,820 --> 00:19:36,200 And there's really no way to tell if they have or they haven't been used to kill people because we don't have the technology in place to detect that. 192 00:19:36,200 --> 00:19:43,040 There's no SOCs, there's no SIMs, there's no IPS, there's no logs, there's none of that good stuff. 193 00:19:43,220 --> 00:19:45,020 Not at least at hospitals. 194 00:19:45,020 --> 00:19:50,160 At hospitals, they have a firewall and they have anti-virus type situations. 195 00:19:50,700 --> 00:19:55,900 And at hospitals, technology is very, very far behind everybody else. 196 00:19:55,900 --> 00:20:03,440 Pagers are still being used, fax machines in multifunction printers are being used to fax between floors. 197 00:20:03,900 --> 00:20:24,340 Just this morning, I had a fun conversation about how a CD was being sent from one hospital to another hospital and how it's important to verify the data on that CD, how it's important to make sure that there's no viruses on that CD, and if they're going to be communicating through CDs, 198 00:20:24,340 --> 00:20:28,520 they should probably encrypt the data, all of which I don't think any of that has been done. 199 00:20:30,460 --> 00:20:34,100 Now, kind of to bring it back around, I posted a little image here. 200 00:20:34,100 --> 00:20:38,840 It's from 2004 about the arrest rates and percentage of crimes cleared. 201 00:20:38,840 --> 00:20:42,840 And as you can see, murders are solved about 62% of the time. 202 00:20:43,340 --> 00:20:56,260 So even if a murder is committed, then there's a pretty good chance, 40% chance that whoever commits the murder is also going to be able to get away with it. 203 00:20:56,260 --> 00:21:01,460 And that's just the way it is with all the legal and law enforcement areas. 204 00:21:01,560 --> 00:21:04,900 As I mentioned, it was 2004 when this particular one came out. 205 00:21:04,900 --> 00:21:07,760 If you do a search and check, that hasn't changed. 206 00:21:07,760 --> 00:21:09,500 It's still right around 60%. 207 00:21:09,500 --> 00:21:13,620 So we need to do better. 208 00:21:13,620 --> 00:21:26,300 We need to start using a communication like I talked about to start holding people accountable and just start providing incentives to ensure that these medical devices aren't actually killing people. 209 00:21:26,300 --> 00:21:27,740 Got to figure it out. 210 00:21:27,740 --> 00:21:30,400 Now here's a little scary thought for everybody. 211 00:21:30,660 --> 00:21:43,560 If hospitals have to invest in these monitoring site solutions, then the hospitals are also going to have to invest in ways to prevent that from happening. 212 00:21:43,560 --> 00:21:49,180 All of this is a huge cost effort and hospitals don't make very much money. 213 00:21:49,440 --> 00:21:58,360 A lot of it is spent on administration and they would much rather buy an MRI machine than they would spend the money on securing something. 214 00:21:58,480 --> 00:22:01,540 So I'm going to drive home that we've got to set up some incentives. 215 00:22:03,020 --> 00:22:07,640 All right, let's pull up this last slide because I don't want to end on too scary or say out of a note. 216 00:22:07,820 --> 00:22:11,640 Everybody's trying their absolute best in everything that they're kind of doing. 217 00:22:11,660 --> 00:22:21,440 Hopefully we'll all keep trying and hopefully we'll get better and learn more and just kind of do the best we can. 218 00:22:22,000 --> 00:22:23,260 I'll also throw this up. 219 00:22:23,260 --> 00:22:24,320 Here's the references. 220 00:22:24,680 --> 00:22:33,200 I'm sure that at a certain point the slides will become available and you will be able to click on the links and utilize the information in these. 221 00:22:33,540 --> 00:22:34,300 Thanks for hearing me. 222 00:22:34,300 --> 00:22:38,000 I believe Casey's up next and we'll hear from him next. 223 00:22:38,320 --> 00:22:39,820 All right, greetings DEF CON. 224 00:22:39,820 --> 00:22:46,160 Thank you for joining this talk and thanks to Eric and Chloe leading into my section now. 225 00:22:46,560 --> 00:22:48,100 Who the heck is this guy? 226 00:22:48,100 --> 00:22:50,600 I am the founder, chairman, and CTO of BugCrowd. 227 00:22:50,600 --> 00:22:51,880 My name is Casey Ellis. 228 00:22:51,880 --> 00:22:54,760 I've been in information security for about 20 years. 229 00:22:55,720 --> 00:23:05,300 From a BugCrowd standpoint, and especially as it relates to vulnerability disclosure, BugCrowd actually pioneered the crowdsource security as a service space. 230 00:23:05,300 --> 00:23:09,860 So, you know, vulnerable disclosure and bug bounty predates us by a long way, which I'll get to in the talk. 231 00:23:09,860 --> 00:23:13,300 We were the first to actually get in the middle and try to make it work better. 232 00:23:13,300 --> 00:23:18,920 So, you know, pretty proud of that, but it means we've learned a lot about how that works from a process standpoint. 233 00:23:18,920 --> 00:23:23,100 From a journey standpoint, for me, you know, I started life as a hacker. 234 00:23:23,100 --> 00:23:34,640 I got into Pentest as a career, moved across into the dark side of security solutions and sales, and then broke bad and became an entrepreneur, which eventually led to starting BugCrowd in 2012. 235 00:23:35,260 --> 00:23:42,940 And yeah, you can see the, you know, the hack persona and the hustle persona on the side that pretty much sums up who I am and how I do what I do. 236 00:23:42,940 --> 00:23:43,860 So now you know me. 237 00:23:43,860 --> 00:23:45,620 That's where to find me as well. 238 00:23:46,540 --> 00:23:53,020 So yeah, with respect to the talk, you know, when we started BugCrowd, it was really all about, like, how do we do this? 239 00:23:53,020 --> 00:24:01,880 Well, there's this enormous community of white hats from all around the world, which Eric's talked about, and some of the things that they can do. 240 00:24:01,880 --> 00:24:08,200 And, you know, this incredible need for security feedback in all sorts of areas of cybersecurity. 241 00:24:08,200 --> 00:24:10,620 Like, how do we make this easy to do it well? 242 00:24:10,660 --> 00:24:16,800 How can you connect that latent potential with the unmet demands of security itself? 243 00:24:17,760 --> 00:24:22,440 And, you know, on this, like, if you look at it simplistically, it's a fairly easy problem to solve. 244 00:24:22,440 --> 00:24:25,760 You just invite a conversation to happen and everything's great. 245 00:24:26,260 --> 00:24:35,040 But it turns out there's a lot of devil in the detail, which is, you know, we did anticipate that when we started off, but it's a lot of what we've been continuing to work on over the last eight years. 246 00:24:35,460 --> 00:24:47,540 And Disclose.io, which is what I'm going to talk about today, is a product actually of the policy and really the adoption of vulnerability disclosure component of that. 247 00:24:47,540 --> 00:24:52,220 Like, at this point, we're a ways along from where we were even back in 2012. 248 00:24:52,220 --> 00:25:03,760 I think nowadays vuln disclosure is becoming this normalized phenomena, and it's starting to become a lot of social pressure around it, which I think is a really good thing. 249 00:25:03,760 --> 00:25:14,040 It's still the company, the kind of thing, rather, that you're a bit special if you do, as opposed to being, you know, abnormal or unusual if you don't do it. 250 00:25:14,040 --> 00:25:20,340 And really, Disclose.io is about flipping that, but I'll not preempt myself anymore, and we'll get into a bit of backstory. 251 00:25:20,900 --> 00:25:25,260 So, in 95, Netscape launched the Bugs bounty program. 252 00:25:25,800 --> 00:25:31,940 They've since dropped the S because it's cleaner, and that is a Silicon Valley joke for anyone who missed it. 253 00:25:32,760 --> 00:25:35,720 There's lockpick bounty programs. 254 00:25:35,720 --> 00:25:41,660 There's all sorts of other things that go back centuries, even, around getting security feedback through a reward model. 255 00:25:41,820 --> 00:25:48,040 But Netscape's broadly accepted as the first kind of high-tech bug bounty program. 256 00:25:48,040 --> 00:25:58,940 And really, with that, kind of almost the instantiation of being proactive around vulnerability disclosure and actually inviting and engaging it as a part of your security process. 257 00:25:58,940 --> 00:26:02,080 So, bug bounties and vulnerability disclosure, they're not the same thing. 258 00:26:02,160 --> 00:26:04,000 Don't let anyone tell you that they are. 259 00:26:04,700 --> 00:26:13,980 But they look enough, they look similar enough in terms of how they operate that, you know, we put that back down to kind of where this whole idea started to really gain momentum. 260 00:26:14,320 --> 00:26:19,300 You know, Bug Crowd started in 2012, and in 2013, I've got these flipped around, but you get it. 261 00:26:19,360 --> 00:26:31,220 One of the things that we noticed was, you know, legal teams don't seem to really understand how to write a policy that is almost the opposite of everything they've written before it. 262 00:26:31,220 --> 00:26:41,360 So, you've traditionally gone out saying, hey, if you're a hacker, go away, you're bad, and here's all of the legal stuff to, you know, create a legal framework for us to say that to you. 263 00:26:41,560 --> 00:26:50,060 Now, we're starting to try to get our heads around the idea that, you know, there's locksmiths as well as burglars out there, and we actually want the help of the locksmiths. 264 00:26:50,120 --> 00:26:51,660 Legal teams don't know how to do that. 265 00:26:51,660 --> 00:26:56,080 It's still, I believe, a net new kind of idea in the space of law. 266 00:26:56,460 --> 00:27:03,280 And the challenge is with legal teams, you know, when they don't, when they're uncertain about what they're doing, they tend to write war and peace. 267 00:27:03,540 --> 00:27:06,380 Like, they'll err on the side of verbosity. 268 00:27:06,620 --> 00:27:12,000 So, you end up with these great big, long, confusing briefs, and that's the first part of the problem. 269 00:27:12,000 --> 00:27:15,080 The second part is that hackers don't read those things in the first place. 270 00:27:15,080 --> 00:27:17,840 They should, but it's the yielder problem. 271 00:27:17,960 --> 00:27:23,180 You know, I think you get a subset of the community who actually really do dig in, and we're very grateful for them. 272 00:27:23,300 --> 00:27:31,680 But you've got to expect the behavior from the internet that people are just going to click through, look for the thing to do next, and go, which is certainly true also in this space. 273 00:27:31,960 --> 00:27:46,080 And the challenge is that when you talk about, you know, the anti-hacking laws and some of the provisions that have been invoked to chill security research that Chloe was talking about earlier, you know, the CFIA makes screwing this up as a hacker potentially a felony crime. 274 00:27:46,620 --> 00:27:49,980 And the same is true for similar laws in other countries. 275 00:27:49,980 --> 00:27:56,020 So in 2014, we thought, all right, let's try to untangle this one and solve it. 276 00:27:56,420 --> 00:28:03,740 So we released the Open Source Vulnerability Disclosure Framework in partnership with Jim Dinaro and the folk over at Cypher Law out of DC. 277 00:28:05,240 --> 00:28:06,720 And that was awesome. 278 00:28:06,720 --> 00:28:19,620 It was basically this idea of, like, how do we, you know, kind of compress down the really important things that need to be in a brief like this to the point where people can theoretically just copy paste and get it right like 90% of the time. 279 00:28:20,000 --> 00:28:25,580 At the same time, Katie, Art, a bunch of others in InDisclosure were working on the ISO standards. 280 00:28:25,580 --> 00:28:27,120 They got released to paying customers. 281 00:28:27,120 --> 00:28:31,280 So there was this kind of convergence on trying to solve this problem of standardization. 282 00:28:31,880 --> 00:28:43,980 Fast forward to 2018, what we did was basically take some of the, well, actually kind of capitalized on some of the attention that was around this concept of legal safe harbor. 283 00:28:44,240 --> 00:28:50,300 Thank you to Amit for really pushing that forward and her legal bug bounty initiative. 284 00:28:50,440 --> 00:28:59,300 And then Dropbox and a couple of other folks that were going on took the OSVDF and legal bug bounty, merged them, and put them all under Disclose.io. 285 00:28:59,700 --> 00:29:02,800 Bug crowd added it as default and off we went from there. 286 00:29:03,060 --> 00:29:04,060 So that's the backstory. 287 00:29:04,060 --> 00:29:09,260 And I think with respect to CFAA, you know, it's important to keep in mind that it is in active use. 288 00:29:09,400 --> 00:29:17,760 I personally believe that there should be laws in place that address computers as a vector to commit a crime. 289 00:29:18,320 --> 00:29:29,380 But, you know, as Chloe called out, if it's not clear what side of the law you're on, especially when you're trying to help, then there's a chilling effect that means that security feedback doesn't pass from A to B. 290 00:29:29,380 --> 00:29:30,460 And that's always bad. 291 00:29:30,460 --> 00:29:31,820 So we're trying to solve that problem. 292 00:29:32,800 --> 00:29:42,400 So really what Disclose.io is about is like, how do we make this idea of vuln disclosure, how do we make the adoption of a vulnerability disclosure program go viral? 293 00:29:42,600 --> 00:29:44,280 And doing it with best practice. 294 00:29:44,280 --> 00:29:50,660 How do we make that into something that is not this huge push from companies like Bug Crowd and people in the researcher community? 295 00:29:51,220 --> 00:29:58,620 Not this like reactive, oh crap, I got tweeted at, what do I do now experience for folk on the vendor side? 296 00:29:58,620 --> 00:30:03,580 Something that, you know, the internet collectively is leaning into and doing well. 297 00:30:03,660 --> 00:30:06,400 And that really is the mission of Disclose.io. 298 00:30:06,400 --> 00:30:20,400 It's a healthy and ubiquitous internet immune system and props to Karen Elazari, Amit's sister, for I think making that concept of hackers operating as the immune system of the internet popular in her TED talk. 299 00:30:21,300 --> 00:30:24,840 Feels like a billion years ago at this point, but it was a little while back. 300 00:30:25,740 --> 00:30:27,340 You know, I think that's true. 301 00:30:27,340 --> 00:30:44,820 I think, you know, the healthcare sector and the internet in general's rejection of security input or its inability to identify that input as important and good, but then its rejection of that input is kind of like an auto immune deficiency in a lot of ways. 302 00:30:44,820 --> 00:30:46,820 And, you know, this is what we're trying to solve. 303 00:30:46,820 --> 00:31:01,300 Like, how do we get it to the point where hackers are functioning as the, like the T-cells of the internet and the internet as an organism, as a body is able to cooperate with that and actually have, you know, everything grow up and be big and strong as a byproduct. 304 00:31:02,380 --> 00:31:13,760 The mission of Disclose.io is to drive vulnerability disclosure adoption, as I probably made clear at this point, but doing that through safety, simplicity, and standardization. 305 00:31:13,760 --> 00:31:20,140 So if that's what you remember about this project, that's going to be kind of the key takeaway because it does involve everyone. 306 00:31:20,140 --> 00:31:21,180 It is open source. 307 00:31:21,880 --> 00:31:30,120 You know, I'm known for bug crowds, sitting in front of a big bug crowd logo, and this is kind of the commercial concept construct for starting this project. 308 00:31:30,120 --> 00:31:33,940 But at this point, we have basically spun it out into its own thing. 309 00:31:33,940 --> 00:31:39,840 It's very much something that we want everyone to participate in, regardless of whether they're a customer of my company or not. 310 00:31:39,840 --> 00:31:41,700 So that's kind of the goal here. 311 00:31:42,460 --> 00:31:43,620 So what is it? 312 00:31:43,620 --> 00:31:44,720 How are we doing it? 313 00:31:44,760 --> 00:31:50,160 How do you unscrew a 30-year-old problem on the internet? 314 00:31:50,180 --> 00:31:51,300 Glad you asked. 315 00:31:51,300 --> 00:31:53,640 So there's three main components to it. 316 00:31:53,640 --> 00:31:57,380 There's the terms, the purpose of the terms is to make it easy. 317 00:31:57,480 --> 00:32:05,420 How do we eliminate the friction of understanding and adopting B2B language in a way that benefits hackers and companies? 318 00:32:05,620 --> 00:32:10,900 And the overall outcome of that is ideally standardization of what those terms should look like. 319 00:32:11,260 --> 00:32:24,180 Eventually, ideally, to the point where things like CFAA, DMCA, and others start to come under the right kind of pressure to be reformed, to actually accommodate for good faith in our space. 320 00:32:24,180 --> 00:32:25,800 I think that's the utopian goal. 321 00:32:25,800 --> 00:32:26,760 We're a ways off from that. 322 00:32:26,760 --> 00:32:31,580 And there's a lot of other things for the legal folk to be occupying themselves with right now. 323 00:32:31,580 --> 00:32:34,500 But in the meantime, we can do our part. 324 00:32:34,640 --> 00:32:41,340 The second piece is the list, which is to aggregate adoption and really to drive adoption as well. 325 00:32:41,660 --> 00:32:45,960 The whole idea there is network effect, which is that kind of virality piece I was talking about before. 326 00:32:45,960 --> 00:32:55,060 How do we get it all into the one spot in a way that basically creates this critical mass of best practice that people are actually drawn to? 327 00:32:55,260 --> 00:32:58,900 And the third piece is the logo, which is really normalization. 328 00:32:59,520 --> 00:33:02,640 I'll go into these in a second because I'm kind of getting ahead of it. 329 00:33:02,640 --> 00:33:05,460 But how do we promote best practice? 330 00:33:05,460 --> 00:33:15,940 I think VDP is a little bit unique in terms of security things that a company can do because a non-technical user can understand it. 331 00:33:15,940 --> 00:33:22,360 They might not get blockchain-enabled, AI-powered, next-gen endpoint something, something. 332 00:33:22,400 --> 00:33:30,820 But the idea of neighborhood watch for the internet, especially when you're talking about a safety-critical space like medical, anyone can get that. 333 00:33:30,820 --> 00:33:38,760 And we're at a point in time where I think the average human is more concerned about the risk that they have when they're buying a product than ever before. 334 00:33:38,760 --> 00:33:45,440 So this becomes something that's actually a benefit aside from the security benefit and the fact that it's just the right thing to do. 335 00:33:45,680 --> 00:33:51,140 The goal with this is for it to almost become like the green padlock for SSL. 336 00:33:51,540 --> 00:33:56,780 And I say that fully mindful that people started to remove the green padlock because it has been normalized. 337 00:33:56,840 --> 00:34:03,420 If this whole idea of VDP adoption can go through that same arc, I would be incredibly happy. 338 00:34:03,420 --> 00:34:08,260 And I think pretty much everyone in this space would benefit from it as well as the internet itself. 339 00:34:08,800 --> 00:34:10,440 So, all right, the terms. 340 00:34:10,580 --> 00:34:14,460 It is a collection of boilerplate, full disclosure templates. 341 00:34:14,560 --> 00:34:16,320 Some folks just copy-paste it. 342 00:34:16,320 --> 00:34:22,620 With the OSVDF, the initial incarnation of this, we noticed the language popping up everywhere. 343 00:34:22,620 --> 00:34:25,180 It was getting translated into different languages. 344 00:34:26,440 --> 00:34:31,160 That document has grandfathered into policies all over the internet at this point. 345 00:34:31,160 --> 00:34:33,020 And that's just the thing that people do. 346 00:34:33,080 --> 00:34:34,340 So, okay, you can do that. 347 00:34:34,460 --> 00:34:40,880 Or you can use it as a foundational framework or a starting point for new versions, which is one of the reasons that it's open source. 348 00:34:40,880 --> 00:34:50,300 We've actually taken input from programs who've looked at the policy, said, hang on, here's an edge that a lot of people have that you probably haven't considered that we're going to write in. 349 00:34:50,300 --> 00:34:56,320 You should consider it, issued a pull request, and we've actually merged that into the language over time. 350 00:34:56,620 --> 00:34:59,760 It's open source, as I keep saying, because I want to really stress that point. 351 00:34:59,760 --> 00:35:03,280 It's licensed under CCA 4.0, so anyone can use it. 352 00:35:03,360 --> 00:35:10,260 And some of the represented in the NASCAR section here are the kind of people that are helping out. 353 00:35:10,740 --> 00:35:20,020 This isn't an endorsement from them of the project itself, but it's the kind of folks that are participating on an individual level to making that language better and driving this forward. 354 00:35:20,020 --> 00:35:22,580 These are the kind of folks that are actually rocking up and assisting. 355 00:35:22,580 --> 00:35:25,480 So that's the other benefit of open source. 356 00:35:25,480 --> 00:35:30,380 It's not just, you know, Casey the Bush lawyer from Australia's opinion on how to do this as well. 357 00:35:31,100 --> 00:35:36,520 It's all sorts of different folks that are actually coming in and making the whole thing more and more effective over time. 358 00:35:37,920 --> 00:35:43,440 And honestly, like, this is the interesting part, I find, is that it's actually kind of hard to do. 359 00:35:43,640 --> 00:35:53,140 You know, one of the things that's a challenge, frankly, that needs to be overcome, because it's a function of how it works, is that not every hacker is a lawyer. 360 00:35:53,300 --> 00:35:55,440 In fact, most aren't, I would say. 361 00:35:56,080 --> 00:35:59,920 And many of them, I would say most, are English as a second language. 362 00:35:59,920 --> 00:36:07,920 So you've got to be able to actually articulate what the hell you're trying to do in this brief in a way that if they do read it, they can understand what's okay and what's not. 363 00:36:07,920 --> 00:36:11,820 So you've got to balance this readability and brevity with legal completeness. 364 00:36:11,820 --> 00:36:21,460 Obviously, you want to provide safety to whatever degree you can without going overboard and having it turn into this 12-page read-fest. 365 00:36:22,040 --> 00:36:26,580 And the safety that's provided by the clauses in this type of thing need to be bilateral. 366 00:36:26,580 --> 00:36:30,680 They need to protect the company that's putting it up on their policy. 367 00:36:30,680 --> 00:36:36,160 And it needs to, more importantly, I think in context of this talk, protect that hacker as they're doing research. 368 00:36:36,520 --> 00:36:46,400 Or even, you know, the concerned citizen who's found a bug, not as a product of security research, that just wants to send it across and doesn't know if that'll get them sent to jail or not. 369 00:36:46,520 --> 00:36:50,620 So at the moment, it's covering US, Canada, the Netherlands, and Belgium. 370 00:36:50,620 --> 00:36:54,340 And we wrote one for the 2020 US presidential elections. 371 00:36:55,540 --> 00:36:59,680 That was tough because there's obviously a lot to consider there. 372 00:36:59,680 --> 00:37:06,240 That's the sort of problem sets that we're trying to tackle with these terms and with the goal of making it easy and standardized. 373 00:37:07,460 --> 00:37:14,540 The list itself is this true community-powered vendor-agnostic directory of all known BDPs and bug-banning programs. 374 00:37:15,280 --> 00:37:21,240 At the moment, we've got, you know, what kind of legal protections afforded by the program, what kind of rewards does it offer. 375 00:37:21,240 --> 00:37:25,260 We're about to integrate support with security.txt. 376 00:37:26,120 --> 00:37:33,400 And I think calling it at the disclosure models and timelines, if it's a coordinated vulnerability disclosure model, that's going to be different for every organization. 377 00:37:34,120 --> 00:37:37,120 So we've accommodated that in there as well. 378 00:37:37,220 --> 00:37:39,800 Again, open source licensed under CCA. 379 00:37:39,920 --> 00:37:41,180 So that brings us to the seal. 380 00:37:41,180 --> 00:37:44,760 This is like the green padlock part that I was talking about at the front. 381 00:37:44,800 --> 00:37:56,260 What we've done at this stage, this will continue to evolve, but where it's up to at this point is dividing out what we're referring to as safe harbor, or as popularly, I think at this point, referred to as safe harbor. 382 00:37:56,660 --> 00:38:05,780 What that's really talking about is what kind of legal protections are available to the researcher that have been proactively included by the program owner into the program. 383 00:38:05,780 --> 00:38:14,940 And we've broken it into partial safe harbor and partial, like a partial compliance statement and a full safe harbor or a full compliance statement. 384 00:38:14,940 --> 00:38:17,560 The difference between those two things, I think is quite important. 385 00:38:18,720 --> 00:38:24,260 For partial, what we're referring to as partial safe harbor, essentially, it's a good faith statement. 386 00:38:24,260 --> 00:38:35,020 So it's this idea that, hey, we agree not to lower up and cause you a hard time if you play by these rules, which is better than there being nothing there, right? 387 00:38:35,080 --> 00:38:38,960 Because that's when, you know, there's, I think the risk can be quite high. 388 00:38:38,960 --> 00:38:42,540 And there's even recently examples of where that sort of thing's gone wrong. 389 00:38:43,180 --> 00:38:45,360 That statement in of itself is a good start. 390 00:38:45,360 --> 00:38:51,460 The problem is that you're still potentially technically committing a crime as you conduct security research. 391 00:38:52,620 --> 00:38:56,500 And that's the part where there's still, I think, a decent amount of exposure. 392 00:38:56,500 --> 00:39:06,140 I liken it to, you know, in California, on the highways, the speed limits 60 miles an hour, but everyone drives at 80 and you don't get pulled over, right? 393 00:39:06,140 --> 00:39:09,320 And that's because there's this sort of social contract. 394 00:39:09,320 --> 00:39:14,880 It's not quite, that would be no safe harbor because it's not written down anywhere, but kind of everyone knows. 395 00:39:15,660 --> 00:39:17,060 It's sort of the same thing. 396 00:39:17,060 --> 00:39:20,460 You could get pulled over for that, but you just don't. 397 00:39:20,460 --> 00:39:28,560 Full safe harbor would be the analog to actually increasing the speed limit to what people will drive at and putting it on the speed sign. 398 00:39:28,560 --> 00:39:35,160 So at that point, there's no recourse for you to be, you know, issued a speeding ticket in that context. 399 00:39:35,160 --> 00:39:39,000 I'm doubling down on this driving metaphor, but I think it's a neat way to explain it. 400 00:39:39,620 --> 00:39:47,420 And to basically get full compliance in context of Disclose.io, there needs to be provision against anti-hacking laws. 401 00:39:47,480 --> 00:39:50,220 So authorization is typically the hinge term. 402 00:39:50,220 --> 00:39:53,860 It certainly is with CFAA and the same is broadly true around the world. 403 00:39:54,620 --> 00:40:00,240 Exemption against any circumvention laws like DMCA, which is very relevant to medical device research. 404 00:40:00,640 --> 00:40:09,480 Exemption against acceptable use or TOS violation because you're breaking the thing and that shouldn't mean that you're breaking the law if you're doing security research. 405 00:40:09,840 --> 00:40:12,400 And a general acknowledgement of good faith as well. 406 00:40:12,940 --> 00:40:20,980 And this is the part where, you know, we'll get to how this all works because ideally, and we've started to see this happen, but this is where everyone can help. 407 00:40:21,760 --> 00:40:24,320 An organization initiates a Vulnerable Disclosure Program. 408 00:40:24,620 --> 00:40:26,400 It gets added to the list. 409 00:40:26,420 --> 00:40:33,300 People see that and look at it, then say, oh, well, where are you at with these safe harbor clauses? 410 00:40:33,300 --> 00:40:39,240 Where are you at with the legal protections that you're giving researchers to actually try to help you out here? 411 00:40:39,480 --> 00:40:44,340 The organization's like, oh, I didn't even really think of that because oftentimes that's true. 412 00:40:44,560 --> 00:40:50,660 They go back, look through the boilerplate stuff, you know, work out what they're going to include or how they're going to adapt their policies. 413 00:40:50,660 --> 00:40:52,500 It gets updated in the list. 414 00:40:52,500 --> 00:40:55,200 And at that point, they're issued with the logo. 415 00:40:56,160 --> 00:41:04,740 Should an organization actually take that logo and use it to promote the fact that they've got a VDP or promote the fact that this is part of their cybersecurity process? 416 00:41:05,100 --> 00:41:08,780 At that point, hackers see it and they start to help out, which is good. 417 00:41:09,200 --> 00:41:11,540 Customers see it and they trust them more, which is good. 418 00:41:12,320 --> 00:41:19,460 The part I like best is that their peers from a vertical standpoint see it and ask themselves, why am I doing that? 419 00:41:19,800 --> 00:41:21,200 I should probably do that too. 420 00:41:21,200 --> 00:41:31,120 Like if, you know, we're in a vertical with five players in it, four are doing it, one's left out, that one looks like a schmuck and no one wants to be that company. 421 00:41:31,120 --> 00:41:38,940 So it's basically increasing lateral social pressure to adopt vulnerability disclosure and actually do this well. 422 00:41:39,220 --> 00:41:51,120 And, you know, it feels too soon to be talking about... I was actually talking about this in context of virality and network effect before COVID broke out. 423 00:41:51,120 --> 00:41:58,860 But, you know, without disrespecting, I think the pain that that's causing a lot of people right now, I think it actually illustrates the idea pretty effectively. 424 00:41:58,880 --> 00:42:11,100 Like how do we take this concept of doing the right thing, making people more secure, doing the right thing by hackers, and just generally improving the security of the internet and actually make that viral? 425 00:42:11,500 --> 00:42:13,680 That's really the goal that we've got here. 426 00:42:14,360 --> 00:42:16,680 So how does it relate to medical security? 427 00:42:16,680 --> 00:42:18,400 What can we achieve in 2020? 428 00:42:18,640 --> 00:42:25,520 The first, and this is a call for help, is to adapt the terms to the medical device sector in particular. 429 00:42:25,520 --> 00:42:30,160 I think the medical sector in general would be great too. 430 00:42:30,840 --> 00:42:46,320 You know, I think the election security revision that we did, it took a lot of work and a lot of thoughtfulness from people that are involved in that space because there's a lot of edge cases that are specific that needed to be considered and factored in and then you needed to simplify that. 431 00:42:46,320 --> 00:42:52,340 So you can't just add crap on because that violates the simplicity design goal of the terms. 432 00:42:52,340 --> 00:42:55,200 So lawyers that are up for that, please do reach out. 433 00:42:55,360 --> 00:43:02,360 As people adopt full disclosure in medical security, we want to see at least 30% of them with this full authorization statement. 434 00:43:02,480 --> 00:43:09,700 Ideally higher, like I'd love to see it get to 100% at some point in the future, but 30% seems like a great place to start. 435 00:43:09,780 --> 00:43:15,620 Across the thousand-odd programs that we're tracking at the moment, compliance is about at about 13%. 436 00:43:15,620 --> 00:43:17,440 I think last time I checked. 437 00:43:17,440 --> 00:43:20,780 So, you know, there's a gap there, but it's a bridgeable gap. 438 00:43:20,780 --> 00:43:21,860 So I think that's a good goal. 439 00:43:22,640 --> 00:43:31,800 And I think specific to COVID, you know, this is something that we've been pushing on commercially as bug crowd, but also just in general at a policy level. 440 00:43:32,340 --> 00:43:43,980 You know, how can we use this to basically unscrew the problem of COVID contact tracing, both from a security and privacy standpoint, but then also from an adoption standpoint? 441 00:43:44,080 --> 00:43:55,200 You know, one of the things that's preventing people from adopting rightly or wrongly, or perhaps rightly and wrongly from adopting contact tracing applications is they don't trust the security implication. 442 00:43:55,200 --> 00:43:57,220 They don't trust the privacy implication. 443 00:43:57,220 --> 00:44:04,200 They don't trust the government, the folks that wrote it, like whatever the individual excuse or reason might be. 444 00:44:05,240 --> 00:44:13,260 It's sort of similar to, you know, the conversation before around like, this is Neighborhood Watch for the internet. 445 00:44:13,260 --> 00:44:29,340 If there's transparency, if there's like this known kind of group of people that are constantly working to help improve this stuff for their own safety as hackers and as members of this community, all of a sudden, you know, we solve all of those problems with really the one shot, 446 00:44:29,340 --> 00:44:34,240 you know, obviously providing the issues are getting fixed, which we're not addressing in this. 447 00:44:34,240 --> 00:44:36,640 We are just talking about vulnerability intake and policy. 448 00:44:36,640 --> 00:44:42,760 That whole vulnerability management pieces is very much a separate but adjacent subject. 449 00:44:42,760 --> 00:44:45,860 I don't want to confuse the two there, but you can sort of see the model here. 450 00:44:45,860 --> 00:44:51,080 If all of a sudden a government or an agency is turning around saying, cool, this is our solution. 451 00:44:51,240 --> 00:44:53,520 These are the concerns that we know you have. 452 00:44:53,520 --> 00:44:54,640 This is how we're addressing them. 453 00:44:54,640 --> 00:44:58,700 And by the way, the should make you more confident. 454 00:44:59,000 --> 00:45:12,380 If that drives up adoption rates of safe and privacy conscious contact tracing applications, I think that's part of what makes that particular model of pandemic management work, which is something we need to be thinking about right now. 455 00:45:12,380 --> 00:45:17,120 I personally hate that type of solution in any time other than this. 456 00:45:17,460 --> 00:45:27,400 I got asked a lot of questions about it and said, yeah, in any other time I'd run screaming from something like contact tracing, I'd recommend that absolutely everyone else do the same thing. 457 00:45:27,440 --> 00:45:34,460 But we haven't really dealt with the kind of things that we're dealing with before with technology available as a potential solution. 458 00:45:34,460 --> 00:45:37,440 So I think this is a really practical application of it. 459 00:45:37,800 --> 00:45:39,300 So help wanted. 460 00:45:40,180 --> 00:45:42,500 Lawyers, help us translate the terms. 461 00:45:42,500 --> 00:45:53,840 If you want to translate it into a language that you speak in and a jurisdiction where you can be considerate of the particular anti-hacking and anti-circumvention laws that apply, that would be fantastic. 462 00:45:53,840 --> 00:45:54,700 We'd appreciate that. 463 00:45:54,700 --> 00:45:56,720 We want to see as much of that happen as possible. 464 00:45:57,240 --> 00:45:59,080 For hackers, contribute to the list. 465 00:45:59,080 --> 00:46:04,900 If there's something missing or if there's a detail that's incorrect, submit a pull request and actually use that list. 466 00:46:04,900 --> 00:46:17,620 The idea of it is to help you guys and girls and everyone else who's involved in hacking to be able to look at the target space that's out there that's actually wanting your help and giving you an opportunity to do that. 467 00:46:17,620 --> 00:46:19,940 If you want to work on paid programs, go for it. 468 00:46:19,940 --> 00:46:24,520 If you want to work on BDPs and verticals that you're passionate about, do it. 469 00:46:24,620 --> 00:46:33,460 The goal of the list is to get all of that information in the one spot and make it easy and shareable to everyone and contributions power that. 470 00:46:33,880 --> 00:46:53,140 For organizations that might be watching, start talking to your security team, start talking to organizations like Bugcrowd, start talking to hackers about what you need to do to take steps towards being proactive about launching a vulnerability disclosure program and actually engaging the feedback of the hacker community. 471 00:46:53,300 --> 00:46:56,400 I think a thing to call out here is you're probably going to get it anyway. 472 00:46:57,500 --> 00:46:59,920 And I think that's sort of where this is all going. 473 00:47:00,440 --> 00:47:05,780 This idea of the internet being a feedback loop is very quickly becoming normalized. 474 00:47:06,580 --> 00:47:09,780 So you can either be reactive to this trend or you can be proactive. 475 00:47:09,820 --> 00:47:12,380 And I think being proactive is a better bet. 476 00:47:12,760 --> 00:47:14,420 And then include Safe Harbor. 477 00:47:14,740 --> 00:47:17,480 And for everyone in the mix, spread the word. 478 00:47:17,560 --> 00:47:20,600 Again, this is the reason that we open sourced it. 479 00:47:20,600 --> 00:47:26,920 This is the reason that we created this particular brand and this particular logo around the idea. 480 00:47:26,920 --> 00:47:30,760 We didn't want this to be purely tied to a commercial initiative. 481 00:47:30,760 --> 00:47:32,780 We think this is something that should happen anyway. 482 00:47:32,780 --> 00:47:34,720 And I'm speaking as Bugcrowd right now. 483 00:47:35,820 --> 00:47:44,440 This is the kind of thing where I think the more input we get, the more it gets spread around, the more people get involved, and the more people adopt it, the better off we all become. 484 00:47:44,560 --> 00:47:46,920 And I think that's something that we can all be a part of. 485 00:47:46,940 --> 00:47:50,260 That is my spiel on Disclosure. 486 00:47:50,260 --> 00:47:54,060 I really appreciate everyone for attending this talk. 487 00:47:54,060 --> 00:47:58,980 Thank you to Chloe and to Eric for their sections in the talk. 488 00:47:58,980 --> 00:48:14,140 And tying it all together, I think this whole ecosystem of the relationship between the hacker community and hacker feedback loops and the current and future state of security overall and safety as a byproduct of that in the medical sector. 489 00:48:14,600 --> 00:48:17,540 Hopefully, we've given you all something to think about today. 490 00:48:18,120 --> 00:48:19,560 And now we're going to do some Q&A.