start	end	text
0	5140	Hi everyone, my name is Chloe Mostagi and I'm happy to be on the disclosure panel with you
5140	11740	for this wonderful biohacking village. And so before I get started, I just wanted to let you
11740	16320	know who I am so you have a better idea of basically what the content I'm going to share
16320	21480	with you. So I am the VP of Strategy over at Point3Security and when I'm not that, I'm an
21480	26980	ethical hacker advocate. And if you're wondering what is an ethical hacker advocate, basically I'm
26980	32760	trying to fight for rights for hackers and also to change the imagery and the wording that the
32760	37300	press tends to use about us in a very negative light. But when I'm not doing that, I also am
37300	42020	trying to push for diverse inclusion within the community. I am the president and co-founder of
42020	47140	WOSEC and when I'm not that, I'm also the founder of WeAreHackers, which used to be formally called
47140	54960	as LoneHackers, but WeAreHackers is a private online community of hackers who are underrepresented
54960	61000	genders. And yes, we hack at all different levels and have workshops and all that fun stuff. And
61000	68140	yes, I am a parent. If you're wondering what's a parent, it's basically a parent of any dogs, cats,
68140	72460	and hamsters, I guess, and bunnies or any of those kind of things. Anyway,
72460	77980	Shirlika and Luna, which are both some sheebs. And also I am the Hacker Book Club organizer and
77980	84660	what we do is one of those things where we read a new book every month written by someone in the
84660	89780	about the hacker community and the author and the people that are mentioned in the book do attend
89780	96800	our weekly meetups on Tuesday at 5 p.m pacific time. Anyway, enough about me. If you want to
96800	100600	follow me, feel free to. I'm on Twitter and Instagram. Let's go into the good stuff though.
101460	107180	So what usually when we see the word hacker or when we type in hacker in Google or whatnot,
107180	113060	we get like this these type of images, this dark hooded figure, but also we see these ones that
113060	119700	have whole cutout and you know. Anyway, let's just be honest with each other. This is really
119700	125700	annoying at this point because what's happening is that people are seeing us in this way.
125740	130900	Something that looks like a criminal. And it's not just that, but even if you type in
130900	136940	ethical hacker or criminal hacker, if you see on both sides of this, you get the exact same
136940	143560	imagery. So which is even more annoying because it looks like we're still having this situation
143560	150160	ongoing. And it's not the imagery either. It's also the words being used. The media, which is
150160	157020	press and marketing organizations, keep using the term hacker in a negative way when they should
157020	164320	be saying malicious actors or cyber criminals. But if you're wondering how does this imagery
164320	171120	impact us, I'm glad that you're asking because I'm one of those people that's obsessed with brains.
171300	175160	So we're going to talk about them. All right, so first things first that you should know about
175160	180420	when it comes to your brain is we're going to have to dive into the amygdala, which is an almond
180420	187240	shaped part of your brain within the temporal lobe. Now the thing to know about the amygdala,
187240	191900	it sorts who's like us, who's not like us. And because of that, it's the fear versus flight
191900	197340	mechanism. So if the person somehow has a connection like us or looks like us, we're like,
197340	203020	this is a friend versus if the person doesn't look like us or we have no association, never
203020	209360	had any conversation with someone that is that type of person, we see them as an enemy. And
209360	215180	because of that, that is how we have these things called socially constructed beliefs.
215180	221380	One in the media when they share hackers and imagery of this hooded figure or using the term
221380	226880	hacker, what is happening is socially constructed beliefs are now being implanted in other people's
226880	234920	minds that hackers are criminals and that all of us are criminals, we're bad people. And because
234920	243320	of that, it has created this fear in the public. Now to know about is that when the amygdala sees,
243320	249400	for example, let's put it this way, you know when we always tell someone that we're a hacker,
250260	255820	and usually the person takes a step back and kind of goes, or they're like the mouth drops,
255820	260520	or their eyes get a little big. They're nervous, but they don't want to come off that they are,
260520	264720	but they totally are. And you know it. And you're like, dang it, I should have gone the security
264720	270160	researcher term, but you did it. It's okay. Anyway, what happens is at that point,
270160	275860	what's happening is that person knows that now you're a hacker. And they've seen the images,
275860	279480	they've heard the words in the press and whatnot of hacker. And when they see you,
279480	282940	and you tell them you're a hacker, they're taking the step back because they're trying
282940	290800	to figure out something. If you are a friend or a foe. Now the thing to note about the amygdala
290800	295100	is that even though it sends that signal, it's completely subconscious. So you don't even know
295100	299720	that you have a fear of it. The only time when you know that it's a fear is if it comes in the
300340	305340	prefrontal cortex of your brain, which is right here. Anyway, so what it does is that it sends
305460	311740	a message that are saying warning, warning, there's a hacker near you. Be careful. It's a
311740	319720	criminal. They do bad, terrible things. Now the thing is, is that that person now has a choice
319720	327460	to react or to ignore it. Now the only way that you can question socially constructed beliefs and
327460	333700	biases is through stories and from meeting people within that community. The thing is,
333700	338100	when we're inside our bubble, we're protected from these things. We have our own beliefs and it's
338100	343140	constantly being verified that you are correct always. When we go outside our bubble, that's
343140	348040	when we realize you're not actually, you don't know everything. And to be comfortable with the
348040	354760	uncomfortable is always a hard thing. So what's the main takeaway if you're wondering, Chloe,
354760	358840	why are we still talking about the brain and the amygdala? The thing you need to understand is that
359480	365820	it's not permanent. These socially constructed ideas are never permanent. You have a choice
366280	371620	to learn about another perspective, but they have to hear the other perspective. And right now
371620	377560	in the press, we're not seeing that yet. And because of that, we're still being seen as
377560	385920	criminals. So, and because of this fear and the public perception, we still have a situation where
385920	391680	93% of the Forbes Global 2000 don't have a vulnerability disclosure program. And 60% of
391680	398940	hackers do not report vulnerabilities out of fear of being prosecuted. And laws that are preventing
399600	408820	like good hacking are such as the CFA and DMCA. And because of this stigma associated with being
409060	414920	a hacker and how the public sees us, it also increases the chances of having more malicious
415560	421120	attackers, not hackers, attackers. But I try to catch you there in that slide and see if you caught
421120	427420	it or not. But overall, what we need to know about is that there are legislation out there that is
427420	433560	hurting us still to this day. And what we need right now are some amendments. So, for example,
433560	439560	the anti-hacking laws, the Computer Fraud Abuse Act was actually created in 1984 because Ronald
439560	444460	Reagan watched this movie called War Games and panicked. As you can tell, many of the rules and
444460	450380	laws that have been created are usually stemmed from panic and fear based and not through empathy.
450380	455020	They never really had a conversation with the hacker community to say, hey, is this right or
455020	460800	wrong what we're doing here? And the thing is, is that we need to push more than ever some amendments
460800	466800	for this. Yes, we do believe that, you know, malicious actors should have to deal with prosecution.
467020	472800	But if we are going, you know, within scope, then we shouldn't be having to worry about being
472800	478700	prosecuted. If we go out of scope by accident, we shouldn't have to worry about being prosecuted.
478700	484280	However, if we go out of scope and we exploit, okay, yes, we did something bad with a malicious
484280	491400	intent. And anti-circumvention laws are the copyright acts. And basically seeing reverse
491400	498300	engineering is seen as a breach. Not a breach, but it's just wrong. It's not legal. So these are
498300	503380	things to consider and remember of. And of course, we have an acceptable use policy, which is every
503380	509100	time that you are on your iPhone or any of those things, it's like, please check this terms and
509100	513660	conditions. I know some of us try to read it, but it's really hard to understand because we're not
513660	521180	attorneys. So it makes it even harder for us to understand what we're reading. And also many of us,
521180	526320	English is not our first language. And so that's the other issue, is that there's all these things
526320	534480	that are set up for hackers ourselves to fall into a situation of being prosecuted. And it's scary.
535660	540680	But if you want to start changing things, there's one step that you can do right now, which is if
540680	547840	you go to change.org, there's this petition that was created, which basically tries to get all of
547840	553600	us to sign it. So then we can bring it and push for changes to happen. We need organizations to
553600	558440	start trusting us and have bilateral trust that they will not prosecute us if we report a vulnerability
558440	565700	and we don't exploit it. We're also asking for politicians to update. Update the laws that we have.
565700	571000	Creating amendments is one of those because it's the laws that they've created are preventing good
571000	576940	hacking. And also for the media to let them know that please, if you're reporting about the hacker
576940	582560	community, please keep us in a good light. But if it is someone who did something malicious, don't call
582560	588260	them a hacker. Call them a malicious actor or cyber criminal. And that's one of those important things.
588260	593740	But us as a community, we have to try to do our best to stay within scope and not exploit because
593740	601060	when one of us breaks that, it takes us 10 steps backwards. And I'm looking forward to the other
601060	607720	panelists sharing more about what on their side and what they're seeing when it comes to disclosure.
608280	612940	So let's start out by kind of getting a little bit more into the weeds here.
612940	619160	My focus in this area is going to be more on hospitals and the vulnerabilities involved with
619160	625060	hospitals. To start off with, here's a little bit about me. I don't really want to spend too much
625060	631580	time on this particular page other than to say I've got a lot of experience across a lot of
631580	637780	hospitals. It gives me a unique perspective to see some interesting patterns. And unfortunately,
637780	643600	I'm here to scare the crap out of you a little bit about how insecure hospitals really are.
643600	647900	And then hopefully I'll be able to motivate you guys to do something about that.
648060	652560	Let's first talk about the most important thing here, and that's inventory.
653840	660200	When I'm dealing with hospitals, particularly the ones that come into my environment where
660200	664860	we start supporting them for the first time, they never have an inventory. If we're lucky,
664860	672100	they've got a spreadsheet similar to one that St. Ellis here has. If you get a chance,
672100	679080	please participate in the CTF. That's actually the inventory list for the CTF that we used just
679080	684640	recently. And it's pretty accurate. It covers pretty much the same thing that I see at hospitals.
685540	689900	Now, there are some tools that kind of help us figure out inventories.
690520	695300	Lansweeper is my favorite, but there's also Case, SCCM, Configuration Manager,
695300	700500	and then you can get real manual with Nmap, Mascan. Those will kind of get you about 80%
700500	707880	of the inventory, but it's still going to be mostly accurate. And the reasons for some of that is
709620	713420	because there are things that are getting added and removed to the environment all the time,
713420	719020	and the spreadsheets never get updated. And there's always the fun one where there's
720340	727620	a grant that comes along, and the vendor comes in and installs the devices in the environment
727620	735360	and doesn't tell IT or IS, and all of a sudden IT and IS have to support these tools, and it's
735360	741780	kind of a mess. So starting out from the very basics, inventories is one of those vulnerabilities
741780	745160	that we kind of have to deal with and start figuring out how to get a better inventory
745160	750700	for hospitals. The next one we're going to move into is actually discovering vulnerabilities.
750700	756560	Now, I like to start out with an external scan to figure out all of the stuff that a hospital
756560	762800	has put out on the internet that they use to communicate over the internet. Generally speaking,
762800	769340	when those first hospitals come into our support area, they are very, very vulnerable,
769340	775100	and we have to start narrowing that down. You can see the little spreadsheet to the left there.
775120	780240	That's about a year ago, and I'm proud to say that most of those in the critical areas have
780240	786120	at least moved off. But when, like I said, when a new hospital comes in, they're very,
786120	790620	very vulnerable. Nobody knows what they've got out on the internet. It's always a fun
790620	797580	little situation. And there are a lot of tools that can be used to do this. I use Tenable.io
797580	800740	and the reference page. You'll get to see a whole bunch of different other ones.
800740	810100	But I also like to bring out Shodan.io and Census.io. Shodan.io is a website that you can
810100	815320	go to, Shodan.io, and you can search for medical devices on it and see how many are actually
815320	819780	published on the internet that you have access to. In the particular case here,
819780	825060	I put PAX in there, and there's about 700 plus medical devices published on the internet that
825060	829820	you have access to that you can see about. And if you click on the IP of that particular device,
829820	833780	you'll be able to see the CVs and all the things that are vulnerable for that device.
833780	841560	Kind of a scary little thing. Now, as bad as the external scan is, scannable IPs on the internet,
841560	846000	the internals are always much, much worse. Because hospitals usually design systems where
846000	850600	they have this nice, hard firewall that is supposed to protect them from all the different
850600	857000	types of things. And then once you get inside, it's not much security whatsoever. So it's like
857000	863220	that nice little M&M hard candy shell, soft inside. Nice and scary stuff. So how does this
863220	870700	kind of come about? Well, I kind of blame it a lot of it on availability. And then we're talking
870700	876260	about the CIA availability, confidentiality, integrity, and then availability. Availability
876260	882820	is king when it comes to hospitals. If you've ever seen a physician get upset about not being
882820	888740	able to access what they need right then and there, it's quite a terrifying experience.
888740	893060	They usually take it out on everybody. And rightfully so, because we're talking about life
893060	900640	and death here. So that tends to be one of the challenges that we have to deal with for patch
900640	905080	Tuesday that comes out, everything getting patched. How do you reboot something when it has to be up
905080	908320	for that surgery that's going to take place at six o'clock in the morning
908320	914840	the next day? And we could also talk about maybe N plus one and having server farms,
914840	920280	but hospitals are kind of cheap. And that leads to my next one where fast and cheap is far, far
920280	927280	more important than good or having it built accurate or done with quality. So the fast and
927280	933020	cheap is always going to win. Nobody really cares how good it is or the quality of it is.
933020	937340	They just want it set up and running and they don't worry about anything else.
938600	942980	Now, of course, that leads to all kinds of fun little problems because Microsoft is a
942980	948360	wonderful company that gets everything to work fairly well. That's kind of one of their goals.
948360	953120	Everything's got to work, but they turn on all the services by default.
953120	956920	And when you're pushing something out fast and cheap, you push it out with the default settings.
956920	961020	So here we are set up with all these services that we don't need that are running and they're
961020	966160	now vulnerable because they haven't been patched in at least six months or so.
967560	974180	The next one is kind of a more challenging one and probably the most important one,
974180	980040	both IT and IES. Really, we kind of suck at talking to humans. We're great at talking about
980040	986480	technology and working with computers and communicating along those routes. And the
986480	992420	staff, they don't talk tech at all. They talk human. They're worried about emotions and they're
992420	997940	worried about being able to understand people's needs and wants and desires and they don't care
997940	1001680	about the technology. That's just the thing that's there that kind of gets in their way
1001680	1007140	and hopefully will help them out just a little bit. And then the last one I want to talk about
1007140	1013820	is there's really no accountability. There's also no incentive to do better or to fix all
1013820	1020600	these types of things. So it kind of to Chloe's point earlier there in her talk,
1020600	1026580	she mentions that there's all these different laws out there, but there's no laws about making sure
1026580	1035770	that medical devices or hospital devices are secure and not going to cause us problems.
1037020	1040460	And there's also no incentive. There are a few nice little things, hopefully Casey will
1040460	1046600	cover some of that stuff in his talk. So next I'm going to talk about my solution for this.
1046600	1053280	And the key word is communication. Now we as IT, information security, IS, we've got to do much,
1053280	1058740	much better at communication. We've got to figure out how to communicate with our target audience.
1058800	1063280	We've got to figure out how to deliver our message to our target audience. We've got to be able to
1063280	1069700	read our target audience and get better at understanding when our target audience understands
1069700	1076120	our message. And we may have to modify our message to get that across. Once we're able to effectively
1076120	1080420	communicate, you know, those horrible soft skills that nobody ever wants to work on because it's
1080420	1085620	boring and challenging and difficult. Once those are down, then we can start talking about ensuring
1085620	1093020	that integrity and confidentiality of data is maintained. And it's just as important, if not
1093020	1099200	more important than the availability of the data. And we'll be able to talk about how quality
1099200	1105880	is just as important, maybe more so, and even cheaper in the long run than getting something
1105880	1111920	out as fast as possible, as cheap as possible. And then we can also start convincing those
1111920	1118980	politicians to hold people accountable and people, meaning the CEO boards, all those people that
1119840	1125380	build corporations in order to avoid being accountable to different things. And we'll be
1125380	1132680	able to start building out some incentives to help us have reasons to do things rather than
1132680	1140440	reasons not to do things. Next, I want to talk about something that kind of scares me. Last year
1141010	1146320	at the Biohacking Village, there was a conversation going on, and I believe Beau had said this,
1146320	1153880	and it was about how physicians don't really care about security because there's no body
1153880	1160820	count associated with security. There's no direct correlation of a medical device killing people.
1161200	1164320	And to be honest, I think medical devices are being used to kill people.
1165820	1171240	And there's really no way to tell if they have or they haven't been used to kill people because
1171240	1178440	we don't have the technology in place to detect that. There's no SOCs, there's no SIMs, there's
1178440	1185640	no IPS, there's no logs, there's none of that good stuff. Not at least at hospitals. At hospitals,
1185640	1192660	they have a firewall and they have anti-virus type situations. And at hospitals, technology
1192660	1199840	is very, very far behind everybody else. Pagers are still being used, fax machines in multifunction
1199840	1207160	printers are being used to fax between floors. Just this morning, I had a fun conversation about
1207160	1213900	how a CD was being sent from one hospital to another hospital and how it's important to
1213900	1220300	verify the data on that CD, how it's important to make sure that there's no viruses on that CD,
1220300	1225720	and if they're going to be communicating through CDs, they should probably encrypt the data,
1225720	1228520	all of which I don't think any of that has been done.
1230460	1235060	Now, kind of to bring it back around, I posted a little image here. It's from 2004
1235060	1239820	about the arrest rates and percentage of crimes cleared. And as you can see,
1239820	1244740	murders are solved about 62% of the time. So even if
1246920	1251840	a murder is committed, then there's a pretty good chance, 40% chance that
1253240	1257100	whoever commits the murder is also going to be able to get away with it. And that's
1257100	1263160	just the way it is with all the legal and law enforcement areas. As I mentioned, it was 2004
1263160	1268220	when this particular one came out. If you do a search and check, that hasn't changed. It's still
1268220	1277340	right around 60%. So we need to do better. We need to start using a communication like I talked
1277340	1283760	about to start holding people accountable and just start providing incentives to ensure that
1283760	1287740	these medical devices aren't actually killing people. Got to figure it out.
1287740	1293420	Now here's a little scary thought for everybody. If hospitals have to invest in
1295160	1299500	these monitoring site solutions, then the hospitals are also going to have to invest
1299500	1306960	in ways to prevent that from happening. All of this is a huge cost effort and hospitals
1306960	1313140	don't make very much money. A lot of it is spent on administration and they would much
1313140	1318820	rather buy an MRI machine than they would spend the money on securing something. So I'm going to
1318820	1324280	drive home that we've got to set up some incentives. All right, let's pull up this
1324280	1328500	last slide because I don't want to end on too scary or say out of a note. Everybody's trying
1328500	1332840	their absolute best in everything that they're kind of doing. Hopefully we'll all keep trying
1334640	1341440	and hopefully we'll get better and learn more and just kind of do the best we can.
1342000	1346500	I'll also throw this up. Here's the references. I'm sure that at a certain point the slides will
1346500	1353200	become available and you will be able to click on the links and utilize the information in these.
1353540	1358000	Thanks for hearing me. I believe Casey's up next and we'll hear from him next.
1358320	1363980	All right, greetings DEF CON. Thank you for joining this talk and thanks to Eric and Chloe
1363980	1370180	leading into my section now. Who the heck is this guy? I am the founder, chairman, and CTO of
1370180	1374760	BugCrowd. My name is Casey Ellis. I've been in information security for about 20 years.
1375720	1380620	From a BugCrowd standpoint, and especially as it relates to vulnerability disclosure,
1380620	1385880	BugCrowd actually pioneered the crowdsource security as a service space. So, you know,
1385880	1389860	vulnerable disclosure and bug bounty predates us by a long way, which I'll get to in the talk.
1389860	1393780	We were the first to actually get in the middle and try to make it work better. So, you know,
1393780	1398920	pretty proud of that, but it means we've learned a lot about how that works from a process standpoint.
1398920	1404460	From a journey standpoint, for me, you know, I started life as a hacker. I got into Pentest as
1404600	1410220	a career, moved across into the dark side of security solutions and sales, and then broke
1410220	1415780	bad and became an entrepreneur, which eventually led to starting BugCrowd in 2012. And yeah,
1415780	1420540	you can see the, you know, the hack persona and the hustle persona on the side that pretty much
1420540	1425620	sums up who I am and how I do what I do. So now you know me. That's where to find me as well.
1426540	1432180	So yeah, with respect to the talk, you know, when we started BugCrowd, it was really all about,
1432180	1436980	like, how do we do this? Well, there's this enormous community of white hats from all around
1436980	1442720	the world, which Eric's talked about, and some of the things that they can do. And, you know,
1442720	1448620	this incredible need for security feedback in all sorts of areas of cybersecurity. Like,
1448620	1454740	how do we make this easy to do it well? How can you connect that latent potential with the unmet
1454740	1461060	demands of security itself? And, you know, on this, like, if you look at it simplistically,
1461060	1465520	it's a fairly easy problem to solve. You just invite a conversation to happen and everything's
1465520	1470740	great. But it turns out there's a lot of devil in the detail, which is, you know, we did anticipate
1470740	1474500	that when we started off, but it's a lot of what we've been continuing to work on over the last
1474500	1479880	eight years. And Disclose.io, which is what I'm going to talk about today, is a product actually
1479880	1487540	of the policy and really the adoption of vulnerability disclosure component of that.
1487540	1494100	Like, at this point, we're a ways along from where we were even back in 2012. I think nowadays
1494100	1499980	vuln disclosure is becoming this normalized phenomena, and it's starting to become a lot
1499980	1505160	of social pressure around it, which I think is a really good thing. It's still the company,
1505160	1511200	the kind of thing, rather, that you're a bit special if you do, as opposed to being,
1511200	1516140	you know, abnormal or unusual if you don't do it. And really, Disclose.io is about flipping that,
1516140	1522500	but I'll not preempt myself anymore, and we'll get into a bit of backstory. So, in 95, Netscape
1522500	1528960	launched the Bugs bounty program. They've since dropped the S because it's cleaner, and that is
1529040	1535900	a Silicon Valley joke for anyone who missed it. There's lockpick bounty programs. There's all
1535900	1540180	sorts of other things that go back centuries, even, around getting security feedback through
1540360	1548040	a reward model. But Netscape's broadly accepted as the first kind of high-tech bug bounty program.
1548040	1554460	And really, with that, kind of almost the instantiation of being proactive around
1554460	1558940	vulnerability disclosure and actually inviting and engaging it as a part of your security process.
1558940	1564000	So, bug bounties and vulnerability disclosure, they're not the same thing. Don't let anyone tell you that they are.
1564700	1569620	But they look enough, they look similar enough in terms of how they operate that, you know, we put
1569620	1574980	that back down to kind of where this whole idea started to really gain momentum. You know, Bug
1574980	1579920	Crowd started in 2012, and in 2013, I've got these flipped around, but you get it. One of the
1579920	1586460	things that we noticed was, you know, legal teams don't seem to really understand how to write a
1587300	1592200	policy that is almost the opposite of everything they've written before it. So, you've traditionally
1592200	1598360	gone out saying, hey, if you're a hacker, go away, you're bad, and here's all of the legal stuff to,
1598360	1603220	you know, create a legal framework for us to say that to you. Now, we're starting to try to get our
1603220	1607840	heads around the idea that, you know, there's locksmiths as well as burglars out there, and we
1607840	1612620	actually want the help of the locksmiths. Legal teams don't know how to do that. It's still, I
1612620	1619080	believe, a net new kind of idea in the space of law. And the challenge is with legal teams, you
1619080	1622480	know, when they don't, when they're uncertain about what they're doing, they tend to write
1622480	1628300	war and peace. Like, they'll err on the side of verbosity. So, you end up with these great big,
1628300	1633000	long, confusing briefs, and that's the first part of the problem. The second part is that hackers
1633000	1638120	don't read those things in the first place. They should, but it's the yielder problem. You know,
1638120	1642340	I think you get a subset of the community who actually really do dig in, and we're very grateful
1642340	1646220	for them. But you've got to expect the behavior from the internet that people are just going to
1646220	1651680	click through, look for the thing to do next, and go, which is certainly true also in this space.
1651960	1656840	And the challenge is that when you talk about, you know, the anti-hacking laws and some of the
1656840	1661960	provisions that have been invoked to chill security research that Chloe was talking about earlier,
1661960	1667360	you know, the CFIA makes screwing this up as a hacker potentially a felony crime. And the same
1667360	1672960	is true for similar laws in other countries. So in 2014, we thought, all right, let's try to
1673580	1679680	untangle this one and solve it. So we released the Open Source Vulnerability Disclosure Framework
1679680	1686720	in partnership with Jim Dinaro and the folk over at Cypher Law out of DC. And that was awesome.
1686720	1691380	It was basically this idea of, like, how do we, you know, kind of compress down the really
1691380	1695600	important things that need to be in a brief like this to the point where people can theoretically
1695600	1702760	just copy paste and get it right like 90% of the time. At the same time, Katie, Art, a bunch of
1702760	1707120	others in InDisclosure were working on the ISO standards. They got released to paying customers.
1707120	1712360	So there was this kind of convergence on trying to solve this problem of standardization. Fast
1712360	1719280	forward to 2018, what we did was basically take some of the, well, actually kind of capitalized
1719280	1725400	on some of the attention that was around this concept of legal safe harbor. Thank you to Amit
1725960	1731980	for really pushing that forward and her legal bug bounty initiative. And then Dropbox and a couple
1731980	1737840	of other folks that were going on took the OSVDF and legal bug bounty, merged them, and put them
1737840	1743320	all under Disclose.io. Bug crowd added it as default and off we went from there. So that's
1743320	1747840	the backstory. And I think with respect to CFAA, you know, it's important to keep in mind that it
1747840	1754680	is in active use. I personally believe that there should be laws in place that address
1755220	1760880	computers as a vector to commit a crime. But, you know, as Chloe called out, if it's not clear
1761920	1765900	what side of the law you're on, especially when you're trying to help, then there's a chilling
1765900	1770620	effect that means that security feedback doesn't pass from A to B. And that's always bad. So we're
1770620	1775560	trying to solve that problem. So really what Disclose.io is about is like, how do we make
1775560	1781380	this idea of vuln disclosure, how do we make the adoption of a vulnerability disclosure program go
1781380	1787200	viral? And doing it with best practice. How do we make that into something that is not this huge
1787200	1793460	push from companies like Bug Crowd and people in the researcher community? Not this like reactive,
1793460	1798820	oh crap, I got tweeted at, what do I do now experience for folk on the vendor side? Something
1798820	1804640	that, you know, the internet collectively is leaning into and doing well. And that really is
1804640	1810860	the mission of Disclose.io. It's a healthy and ubiquitous internet immune system and props to
1810860	1817380	Karen Elazari, Amit's sister, for I think making that concept of hackers operating as the immune
1817380	1823620	system of the internet popular in her TED talk. Feels like a billion years ago at this point, but
1823620	1829780	it was a little while back. You know, I think that's true. I think, you know, the healthcare
1829780	1836320	sector and the internet in general's rejection of security input or its inability to identify
1837040	1842720	that input as important and good, but then its rejection of that input is kind of like an auto
1842720	1846920	immune deficiency in a lot of ways. And, you know, this is what we're trying to solve. Like,
1846920	1850600	how do we get it to the point where hackers are functioning as the, like the T-cells of the
1850600	1856600	internet and the internet as an organism, as a body is able to cooperate with that and actually
1856600	1861300	have, you know, everything grow up and be big and strong as a byproduct.
1862380	1867320	The mission of Disclose.io is to drive vulnerability disclosure adoption,
1867320	1872380	as I probably made clear at this point, but doing that through safety, simplicity,
1872380	1876700	and standardization. So if that's what you remember about this project, that's going to be
1876700	1882920	kind of the key takeaway because it does involve everyone. It is open source. You know, I'm
1882920	1887580	known for bug crowds, sitting in front of a big bug crowd logo, and this is kind of the commercial
1887580	1892480	concept construct for starting this project. But at this point, we have basically spun it out
1892480	1897400	into its own thing. It's very much something that we want everyone to participate in,
1897400	1901700	regardless of whether they're a customer of my company or not. So that's kind of the goal here.
1902460	1910160	So what is it? How are we doing it? How do you unscrew a 30-year-old problem on the internet?
1910180	1915420	Glad you asked. So there's three main components to it. There's the terms,
1915420	1919980	the purpose of the terms is to make it easy. How do we eliminate the friction of understanding
1919980	1927060	and adopting B2B language in a way that benefits hackers and companies? And the overall outcome of
1927060	1932460	that is ideally standardization of what those terms should look like. Eventually, ideally,
1932460	1939860	to the point where things like CFAA, DMCA, and others start to come under the right kind of
1939860	1944800	pressure to be reformed, to actually accommodate for good faith in our space. I think that's the
1944800	1949260	utopian goal. We're a ways off from that. And there's a lot of other things for the legal folk
1949260	1954500	to be occupying themselves with right now. But in the meantime, we can do our part.
1954640	1961340	The second piece is the list, which is to aggregate adoption and really to drive adoption as well.
1961660	1965420	The whole idea there is network effect, which is that kind of virality piece I was talking about
1965420	1972240	before. How do we get it all into the one spot in a way that basically creates this critical mass of
1972240	1977640	best practice that people are actually drawn to? And the third piece is the logo, which is
1977640	1982640	really normalization. I'll go into these in a second because I'm kind of getting ahead of it.
1982640	1991340	But how do we promote best practice? I think VDP is a little bit unique in terms of security things
1991340	1996820	that a company can do because a non-technical user can understand it. They might not get
1996820	2003780	blockchain-enabled, AI-powered, next-gen endpoint something, something. But the idea of neighborhood
2003780	2007620	watch for the internet, especially when you're talking about a safety-critical space like
2007620	2014140	medical, anyone can get that. And we're at a point in time where I think the average human is more
2014140	2019120	concerned about the risk that they have when they're buying a product than ever before. So this
2019120	2023720	becomes something that's actually a benefit aside from the security benefit and the fact that
2023720	2028280	it's just the right thing to do. The goal with this is for it to almost become like the green
2028280	2035460	padlock for SSL. And I say that fully mindful that people started to remove the green padlock
2035460	2041640	because it has been normalized. If this whole idea of VDP adoption can go through that same arc,
2041640	2046340	I would be incredibly happy. And I think pretty much everyone in this space would benefit from
2046340	2052620	it as well as the internet itself. So, all right, the terms. It is a collection of boilerplate,
2052620	2058980	full disclosure templates. Some folks just copy-paste it. With the OSVDF, the initial
2058980	2063680	incarnation of this, we noticed the language popping up everywhere. It was getting translated
2063680	2070440	into different languages. That document has grandfathered into policies all over the internet
2070440	2075160	at this point. And that's just the thing that people do. So, okay, you can do that. Or you can
2075160	2079700	use it as a foundational framework or a starting point for new versions, which is one of the reasons
2079700	2084760	that it's open source. We've actually taken input from programs who've looked at the policy,
2084760	2089040	said, hang on, here's an edge that a lot of people have that you probably haven't considered
2089040	2093520	that we're going to write in. You should consider it, issued a pull request, and we've actually
2093520	2098620	merged that into the language over time. It's open source, as I keep saying, because I want
2098620	2104420	to really stress that point. It's licensed under CCA 4.0, so anyone can use it. And some of the
2104940	2110260	represented in the NASCAR section here are the kind of people that are helping out.
2110740	2114620	This isn't an endorsement from them of the project itself, but it's the kind of folks that are
2114620	2120020	participating on an individual level to making that language better and driving this forward.
2120020	2124020	These are the kind of folks that are actually rocking up and assisting. So that's the other
2124020	2129040	benefit of open source. It's not just, you know, Casey the Bush lawyer from Australia's opinion
2129040	2133360	on how to do this as well. It's all sorts of different folks that are actually coming in and
2133360	2139780	making the whole thing more and more effective over time. And honestly, like, this is the
2139780	2144840	interesting part, I find, is that it's actually kind of hard to do. You know, one of the things
2146800	2150680	that's a challenge, frankly, that needs to be overcome, because it's a function of how it works,
2150680	2157200	is that not every hacker is a lawyer. In fact, most aren't, I would say. And many of them,
2157200	2161560	I would say most, are English as a second language. So you've got to be able to actually
2161560	2165660	articulate what the hell you're trying to do in this brief in a way that if they do read it,
2165660	2170060	they can understand what's okay and what's not. So you've got to balance this readability and brevity
2170600	2175660	with legal completeness. Obviously, you want to provide safety to whatever degree you can
2176340	2183480	without going overboard and having it turn into this 12-page read-fest. And the safety that's
2183480	2188200	provided by the clauses in this type of thing need to be bilateral. They need to protect the
2188200	2192840	company that's putting it up on their policy. And it needs to, more importantly, I think in
2192840	2198160	context of this talk, protect that hacker as they're doing research. Or even, you know, the
2198160	2202940	concerned citizen who's found a bug, not as a product of security research, that just wants
2202940	2207300	to send it across and doesn't know if that'll get them sent to jail or not. So at the moment,
2207300	2212860	it's covering US, Canada, the Netherlands, and Belgium. And we wrote one for the 2020 US
2212860	2219920	presidential elections. That was tough because there's obviously a lot to consider there. That's
2219920	2224560	the sort of problem sets that we're trying to tackle with these terms and with the goal of
2224560	2231220	making it easy and standardized. The list itself is this true community-powered vendor-agnostic
2231220	2236860	directory of all known BDPs and bug-banning programs. At the moment, we've got, you know,
2236860	2241240	what kind of legal protections afforded by the program, what kind of rewards does it offer.
2241240	2247940	We're about to integrate support with security.txt. And I think calling it at the disclosure models
2247940	2252800	and timelines, if it's a coordinated vulnerability disclosure model, that's going to be different for
2252800	2258800	every organization. So we've accommodated that in there as well. Again, open source licensed under
2258800	2264020	CCA. So that brings us to the seal. This is like the green padlock part that I was talking about
2264020	2268080	at the front. What we've done at this stage, this will continue to evolve, but where it's up to at
2268080	2274340	this point is dividing out what we're referring to as safe harbor, or as popularly, I think at
2274340	2279400	this point, referred to as safe harbor. What that's really talking about is what kind of legal protections
2279400	2285120	are available to the researcher that have been proactively included by the program owner into
2285120	2291080	the program. And we've broken it into partial safe harbor and partial, like a partial compliance
2291080	2295980	statement and a full safe harbor or a full compliance statement. The difference between
2295980	2301540	those two things, I think is quite important. For partial, what we're referring to as partial
2301540	2306120	safe harbor, essentially, it's a good faith statement. So it's this idea that, hey, we agree
2306120	2312580	not to lower up and cause you a hard time if you play by these rules, which is better than
2312580	2318120	there being nothing there, right? Because that's when, you know, there's, I think the risk can be
2318120	2322540	quite high. And there's even recently examples of where that sort of thing's gone wrong.
2323180	2327800	That statement in of itself is a good start. The problem is that you're still potentially
2328460	2334160	technically committing a crime as you conduct security research. And that's the part where
2334160	2339160	there's still, I think, a decent amount of exposure. I liken it to, you know, in California,
2339960	2344880	on the highways, the speed limits 60 miles an hour, but everyone drives at 80 and you don't
2344880	2350240	get pulled over, right? And that's because there's this sort of social contract. It's not quite,
2350240	2354880	that would be no safe harbor because it's not written down anywhere, but kind of everyone knows.
2355660	2360460	It's sort of the same thing. You could get pulled over for that, but you just don't.
2360460	2365440	Full safe harbor would be the analog to actually increasing the speed limit to what people will
2365440	2372860	drive at and putting it on the speed sign. So at that point, there's no recourse for you to be,
2372860	2376720	you know, issued a speeding ticket in that context. I'm doubling down on this driving
2376720	2382460	metaphor, but I think it's a neat way to explain it. And to basically get full compliance in
2382460	2389080	context of Disclose.io, there needs to be provision against anti-hacking laws. So authorization is
2389080	2393860	typically the hinge term. It certainly is with CFAA and the same is broadly true around the world.
2394620	2399780	Exemption against any circumvention laws like DMCA, which is very relevant to medical device
2399780	2406180	research. Exemption against acceptable use or TOS violation because you're breaking the thing and
2406180	2410680	that shouldn't mean that you're breaking the law if you're doing security research. And a general
2410680	2415720	acknowledgement of good faith as well. And this is the part where, you know, we'll get to how this
2415720	2420980	all works because ideally, and we've started to see this happen, but this is where everyone can help.
2421760	2427180	An organization initiates a Vulnerable Disclosure Program. It gets added to the list. People see
2427180	2433480	that and look at it, then say, oh, well, where are you at with these safe harbor clauses? Where are
2433480	2438740	you at with the legal protections that you're giving researchers to actually try to help you
2438740	2444000	out here? The organization's like, oh, I didn't even really think of that because oftentimes that's
2444000	2448900	true. They go back, look through the boilerplate stuff, you know, work out what they're going to
2448900	2452740	include or how they're going to adapt their policies. It gets updated in the list. And at
2452740	2459360	that point, they're issued with the logo. Should an organization actually take that logo and use it
2459360	2463800	to promote the fact that they've got a VDP or promote the fact that this is part of their
2463800	2468780	cybersecurity process? At that point, hackers see it and they start to help out, which is good.
2469200	2474600	Customers see it and they trust them more, which is good. The part I like best is that their peers
2474600	2480360	from a vertical standpoint see it and ask themselves, why am I doing that? I should
2480360	2486540	probably do that too. Like if, you know, we're in a vertical with five players in it, four are doing
2486540	2492000	it, one's left out, that one looks like a schmuck and no one wants to be that company. So it's
2492000	2497960	basically increasing lateral social pressure to adopt vulnerability disclosure and actually do
2497960	2505060	this well. And, you know, it feels too soon to be talking about... I was actually talking about this
2505060	2513800	in context of virality and network effect before COVID broke out. But, you know, without disrespecting,
2513800	2517220	I think the pain that that's causing a lot of people right now, I think it actually illustrates
2517220	2523780	the idea pretty effectively. Like how do we take this concept of doing the right thing,
2523780	2528860	making people more secure, doing the right thing by hackers, and just generally improving the
2528860	2533680	security of the internet and actually make that viral? That's really the goal that we've got here.
2534360	2539920	So how does it relate to medical security? What can we achieve in 2020? The first, and this is a
2539920	2545700	call for help, is to adapt the terms to the medical device sector in particular. I think
2545700	2554060	the medical sector in general would be great too. You know, I think the election security
2554760	2558740	revision that we did, it took a lot of work and a lot of thoughtfulness from people that are
2558740	2563360	involved in that space because there's a lot of edge cases that are specific that needed to be
2563360	2567820	considered and factored in and then you needed to simplify that. So you can't just add crap on
2567820	2573880	because that violates the simplicity design goal of the terms. So lawyers that are up for that,
2573880	2578880	please do reach out. As people adopt full disclosure in medical security, we want to
2578880	2583660	see at least 30% of them with this full authorization statement. Ideally higher,
2583660	2588860	like I'd love to see it get to 100% at some point in the future, but 30% seems like a great place to
2588860	2593800	start. Across the thousand-odd programs that we're tracking at the moment, compliance is about
2593800	2600220	at about 13%. I think last time I checked. So, you know, there's a gap there, but it's a
2600220	2607000	bridgeable gap. So I think that's a good goal. And I think specific to COVID, you know, this is
2607000	2611800	something that we've been pushing on commercially as bug crowd, but also just in general at a policy
2612340	2619840	level. You know, how can we use this to basically unscrew the problem of COVID contact tracing,
2619840	2623980	both from a security and privacy standpoint, but then also from an adoption standpoint?
2624080	2628620	You know, one of the things that's preventing people from adopting rightly or wrongly,
2628620	2633760	or perhaps rightly and wrongly from adopting contact tracing applications is they don't
2633760	2638100	trust the security implication. They don't trust the privacy implication. They don't trust the
2638100	2644200	government, the folks that wrote it, like whatever the individual excuse or reason might be.
2645240	2652160	It's sort of similar to, you know, the conversation before around like, this is
2652160	2657200	Neighborhood Watch for the internet. If there's transparency, if there's like this known kind
2657200	2661660	of group of people that are constantly working to help improve this stuff for their own safety
2661660	2666480	as hackers and as members of this community, all of a sudden, you know, we solve all of those
2666480	2671940	problems with really the one shot, you know, obviously providing the issues are getting fixed,
2671940	2676640	which we're not addressing in this. We are just talking about vulnerability intake and policy.
2676640	2682760	That whole vulnerability management pieces is very much a separate but adjacent subject. I
2682760	2686740	don't want to confuse the two there, but you can sort of see the model here. If all of a sudden
2687100	2691760	a government or an agency is turning around saying, cool, this is our solution. These are
2691760	2695440	the concerns that we know you have. This is how we're addressing them. And by the way, the
2696060	2704020	should make you more confident. If that drives up adoption rates of safe and privacy conscious
2704020	2708840	contact tracing applications, I think that's part of what makes that particular model of pandemic
2708840	2713360	management work, which is something we need to be thinking about right now. I personally hate
2713360	2719840	that type of solution in any time other than this. I got asked a lot of questions about it and said,
2719840	2724980	yeah, in any other time I'd run screaming from something like contact tracing, I'd recommend
2724980	2730280	that absolutely everyone else do the same thing. But we haven't really dealt with the kind of
2730280	2734460	things that we're dealing with before with technology available as a potential solution.
2734460	2741660	So I think this is a really practical application of it. So help wanted. Lawyers, help us translate
2741660	2747160	the terms. If you want to translate it into a language that you speak in and a jurisdiction
2747160	2751560	where you can be considerate of the particular anti-hacking and anti-circumvention laws that
2751560	2756180	apply, that would be fantastic. We'd appreciate that. We want to see as much of that happen as
2756180	2761520	possible. For hackers, contribute to the list. If there's something missing or if there's a detail
2761520	2766040	that's incorrect, submit a pull request and actually use that list. The idea of it is to
2766040	2771940	help you guys and girls and everyone else who's involved in hacking to be able to look at the
2771940	2776860	target space that's out there that's actually wanting your help and giving you an opportunity
2776860	2781540	to do that. If you want to work on paid programs, go for it. If you want to work on BDPs and
2781540	2786200	verticals that you're passionate about, do it. The goal of the list is to get all of that
2786200	2791500	information in the one spot and make it easy and shareable to everyone and contributions
2792150	2800100	power that. For organizations that might be watching, start talking to your security team,
2800100	2804640	start talking to organizations like Bugcrowd, start talking to hackers about what you need
2804640	2809880	to do to take steps towards being proactive about launching a vulnerability disclosure program and
2809880	2815180	actually engaging the feedback of the hacker community. I think a thing to call out here is
2815180	2819920	you're probably going to get it anyway. And I think that's sort of where this is all going.
2820440	2825780	This idea of the internet being a feedback loop is very quickly becoming normalized.
2826580	2830840	So you can either be reactive to this trend or you can be proactive. And I think being
2830840	2836940	proactive is a better bet. And then include Safe Harbor. And for everyone in the mix, spread the
2836940	2842400	word. Again, this is the reason that we open sourced it. This is the reason that we created
2842400	2848740	this particular brand and this particular logo around the idea. We didn't want this to be purely
2848740	2852960	tied to a commercial initiative. We think this is something that should happen anyway. And I'm
2852960	2858820	speaking as Bugcrowd right now. This is the kind of thing where I think the more input we get,
2858820	2863060	the more it gets spread around, the more people get involved, and the more people adopt it, the
2863060	2866920	better off we all become. And I think that's something that we can all be a part of.
2866940	2874060	That is my spiel on Disclosure. I really appreciate everyone for attending this talk.
2874060	2880460	Thank you to Chloe and to Eric for their sections in the talk. And tying it all together, I think
2880460	2886260	this whole ecosystem of the relationship between the hacker community and hacker feedback loops
2886260	2892980	and the current and future state of security overall and safety as a byproduct of that in
2892980	2897540	the medical sector. Hopefully, we've given you all something to think about today.
2898120	2899560	And now we're going to do some Q&A.