WEBVTT 00:00.000 --> 00:08.660 Hi everyone, my name is Chloe Mostagi and I'm happy to be on the disclosure panel with you for this wonderful biohacking village. 00:08.760 --> 00:17.140 And so before I get started, I just wanted to let you know who I am so you have a better idea of basically what the content I'm going to share with you. 00:17.280 --> 00:22.820 So I am the VP of Strategy over at Point3Security and when I'm not that, I'm an ethical hacker advocate. 00:22.820 --> 00:36.100 And if you're wondering what is an ethical hacker advocate, basically I'm trying to fight for rights for hackers and also to change the imagery and the wording that the press tends to use about us in a very negative light. 00:36.100 --> 00:40.220 But when I'm not doing that, I also am trying to push for diverse inclusion within the community. 00:40.620 --> 00:55.980 I am the president and co-founder of WOSEC and when I'm not that, I'm also the founder of WeAreHackers, which used to be formally called as LoneHackers, but WeAreHackers is a private online community of hackers who are underrepresented genders. 00:56.260 --> 01:00.460 And yes, we hack at all different levels and have workshops and all that fun stuff. 01:00.900 --> 01:02.380 And yes, I am a parent. 01:02.380 --> 01:11.080 If you're wondering what's a parent, it's basically a parent of any dogs, cats, and hamsters, I guess, and bunnies or any of those kind of things. 01:11.080 --> 01:15.140 Anyway, Shirlika and Luna, which are both some sheebs. 01:15.280 --> 01:34.480 And also I am the Hacker Book Club organizer and what we do is one of those things where we read a new book every month written by someone in the about the hacker community and the author and the people that are mentioned in the book do attend our weekly meetups on Tuesday at 5 p.m pacific time. 01:34.700 --> 01:36.360 Anyway, enough about me. 01:36.360 --> 01:37.820 If you want to follow me, feel free to. 01:37.820 --> 01:38.940 I'm on Twitter and Instagram. 01:38.940 --> 01:40.600 Let's go into the good stuff though. 01:41.460 --> 01:56.140 So what usually when we see the word hacker or when we type in hacker in Google or whatnot, we get like this these type of images, this dark hooded figure, but also we see these ones that have whole cutout and you know. 01:56.540 --> 01:59.000 Anyway, let's just be honest with each other. 01:59.000 --> 02:05.700 This is really annoying at this point because what's happening is that people are seeing us in this way. 02:05.740 --> 02:08.040 Something that looks like a criminal. 02:08.800 --> 02:17.820 And it's not just that, but even if you type in ethical hacker or criminal hacker, if you see on both sides of this, you get the exact same imagery. 02:17.820 --> 02:24.800 So which is even more annoying because it looks like we're still having this situation ongoing. 02:24.940 --> 02:26.680 And it's not the imagery either. 02:26.680 --> 02:29.220 It's also the words being used. 02:29.220 --> 02:40.700 The media, which is press and marketing organizations, keep using the term hacker in a negative way when they should be saying malicious actors or cyber criminals. 02:41.640 --> 02:51.120 But if you're wondering how does this imagery impact us, I'm glad that you're asking because I'm one of those people that's obsessed with brains. 02:51.300 --> 02:52.840 So we're going to talk about them. 02:52.840 --> 03:05.100 All right, so first things first that you should know about when it comes to your brain is we're going to have to dive into the amygdala, which is an almond shaped part of your brain within the temporal lobe. 03:05.220 --> 03:09.520 Now the thing to know about the amygdala, it sorts who's like us, who's not like us. 03:09.520 --> 03:12.940 And because of that, it's the fear versus flight mechanism. 03:12.940 --> 03:29.100 So if the person somehow has a connection like us or looks like us, we're like, this is a friend versus if the person doesn't look like us or we have no association, never had any conversation with someone that is that type of person, we see them as an enemy. 03:29.240 --> 03:35.180 And because of that, that is how we have these things called socially constructed beliefs. 03:35.180 --> 03:52.800 One in the media when they share hackers and imagery of this hooded figure or using the term hacker, what is happening is socially constructed beliefs are now being implanted in other people's minds that hackers are criminals and that all of us are criminals, 03:52.800 --> 03:54.540 we're bad people. 03:54.540 --> 03:59.280 And because of that, it has created this fear in the public. 04:00.100 --> 04:17.580 Now to know about is that when the amygdala sees, for example, let's put it this way, you know when we always tell someone that we're a hacker, and usually the person takes a step back and kind of goes, or they're like the mouth drops, or their eyes get a little big. 04:17.740 --> 04:21.460 They're nervous, but they don't want to come off that they are, but they totally are. 04:21.460 --> 04:22.240 And you know it. 04:22.240 --> 04:26.800 And you're like, dang it, I should have gone the security researcher term, but you did it. 04:26.800 --> 04:27.640 It's okay. 04:27.640 --> 04:33.860 Anyway, what happens is at that point, what's happening is that person knows that now you're a hacker. 04:34.200 --> 04:38.500 And they've seen the images, they've heard the words in the press and whatnot of hacker. 04:38.500 --> 04:44.040 And when they see you, and you tell them you're a hacker, they're taking the step back because they're trying to figure out something. 04:44.620 --> 04:48.700 If you are a friend or a foe. 04:48.700 --> 04:54.340 Now the thing to note about the amygdala is that even though it sends that signal, it's completely subconscious. 04:54.340 --> 04:57.080 So you don't even know that you have a fear of it. 04:57.080 --> 05:03.040 The only time when you know that it's a fear is if it comes in the prefrontal cortex of your brain, which is right here. 05:03.560 --> 05:10.020 Anyway, so what it does is that it sends a message that are saying warning, warning, there's a hacker near you. 05:10.020 --> 05:10.940 Be careful. 05:10.940 --> 05:12.060 It's a criminal . 05:12.060 --> 05:14.720 They do bad, terrible things. 05:14.720 --> 05:23.540 Now the thing is, is that that person now has a choice to react or to ignore it. 05:23.540 --> 05:32.860 Now the only way that you can question socially constructed beliefs and biases is through stories and from meeting people within that community. 05:32.860 --> 05:36.740 The thing is, when we're inside our bubble, we're protected from these things. 05:36.740 --> 05:41.480 We have our own beliefs and it's constantly being verified that you are correct always. 05:41.480 --> 05:46.700 When we go outside our bubble, that's when we realize you're not actually, you don't know everything. 05:46.700 --> 05:50.620 And to be comfortable with the uncomfortable is always a hard thing. 05:51.080 --> 05:57.260 So what's the main takeaway if you're wondering, Chloe, why are we still talking about the brain and the amygdala? 05:57.260 --> 06:01.500 The thing you need to understand is that it's not permanent. 06:01.560 --> 06:04.440 These socially constructed ideas are never permanent. 06:04.440 --> 06:10.900 You have a choice to learn about another perspective, but they have to hear the other perspective. 06:10.900 --> 06:14.660 And right now in the press, we're not seeing that yet. 06:14.660 --> 06:18.980 And because of that, we're still being seen as criminals. 06:19.920 --> 06:30.800 So, and because of this fear and the public perception, we still have a situation where 93% of the Forbes Global 2000 don't have a vulnerability disclosure program. 06:30.820 --> 06:37.380 And 60% of hackers do not report vulnerabilities out of fear of being prosecuted. 06:37.460 --> 06:44.420 And laws that are preventing like good hacking are such as the CFA and DMCA. 06:44.640 --> 06:58.520 And because of this stigma associated with being a hacker and how the public sees us, it also increases the chances of having more malicious attackers, not hackers, attackers. 06:58.520 --> 07:02.140 But I try to catch you there in that slide and see if you caught it or not. 07:02.840 --> 07:09.340 But overall, what we need to know about is that there are legislation out there that is hurting us still to this day. 07:09.340 --> 07:12.060 And what we need right now are some amendments. 07:12.480 --> 07:22.500 So, for example, the anti-hacking laws, the Computer Fraud Abuse Act was actually created in 1984 because Ronald Reagan watched this movie called War Games and panicked. 07:22.500 --> 07:30.380 As you can tell, many of the rules and laws that have been created are usually stemmed from panic and fear based and not through empathy. 07:30.380 --> 07:36.900 They never really had a conversation with the hacker community to say, hey, is this right or wrong what we're doing here? 07:36.900 --> 07:42.340 And the thing is, is that we need to push more than ever some amendments for this. 07:42.380 --> 07:46.800 Yes, we do believe that, you know, malicious actors should have to deal with prosecution. 07:47.020 --> 07:53.620 But if we are going, you know, within scope, then we shouldn't be having to worry about being prosecuted. 07:53.620 --> 07:58.700 If we go out of scope by accident, we shouldn't have to worry about being prosecuted. 07:58.700 --> 08:05.280 However, if we go out of scope and we exploit, okay, yes, we did something bad with a malicious intent. 08:06.260 --> 08:09.980 And anti-circumvention laws are the copyright acts. 08:10.060 --> 08:13.760 And basically seeing reverse engineering is seen as a breach. 08:13.860 --> 08:16.080 Not a breach, but it's just wrong. 08:16.080 --> 08:17.240 It's not legal. 08:17.520 --> 08:21.140 So these are things to consider and remember of. 08:21.240 --> 08:30.100 And of course, we have an acceptable use policy, which is every time that you are on your iPhone or any of those things, it's like, please check this terms and conditions. 08:30.260 --> 08:34.780 I know some of us try to read it, but it's really hard to understand because we're not attorneys. 08:34.940 --> 08:38.700 So it makes it even harder for us to understand what we're reading. 08:38.940 --> 08:42.700 And also many of us, English is not our first language. 08:42.700 --> 08:53.240 And so that's the other issue, is that there's all these things that are set up for hackers ourselves to fall into a situation of being prosecuted. 08:53.240 --> 08:54.480 And it's scary. 08:55.660 --> 09:08.680 But if you want to start changing things, there's one step that you can do right now, which is if you go to change.org, there's this petition that was created, which basically tries to get all of us to sign it. 09:08.680 --> 09:12.140 So then we can bring it and push for changes to happen. 09:12.160 --> 09:20.240 We need organizations to start trusting us and have bilateral trust that they will not prosecute us if we report a vulnerability and we don't exploit it. 09:20.240 --> 09:23.540 We're also asking for politicians to update. 09:23.580 --> 09:25.700 Update the laws that we have. 09:25.700 --> 09:31.900 Creating amendments is one of those because it's the laws that they've created are preventing good hacking. 09:32.380 --> 09:39.560 And also for the media to let them know that please, if you're reporting about the hacker community, please keep us in a good light. 09:39.560 --> 09:43.380 But if it is someone who did something malicious, don't call them a hacker. 09:43.380 --> 09:46.160 Call them a malicious actor or cyber criminal. 09:46.700 --> 09:48.260 And that's one of those important things. 09:48.260 --> 09:58.680 But us as a community, we have to try to do our best to stay within scope and not exploit because when one of us breaks that, it takes us 10 steps backwards. 09:59.520 --> 10:07.720 And I'm looking forward to the other panelists sharing more about what on their side and what they're seeing when it comes to disclosure. 10:08.280 --> 10:12.940 So let's start out by kind of getting a little bit more into the weeds here. 10:12.940 --> 10:20.160 My focus in this area is going to be more on hospitals and the vulnerabilities involved with hospitals. 10:20.460 --> 10:23.440 To start off with, here's a little bit about me. 10:23.440 --> 10:32.160 I don't really want to spend too much time on this particular page other than to say I've got a lot of experience across a lot of hospitals. 10:32.160 --> 10:36.280 It gives me a unique perspective to see some interesting patterns. 10:36.880 --> 10:43.600 And unfortunately, I'm here to scare the crap out of you a little bit about how insecure hospitals really are. 10:43.600 --> 10:47.900 And then hopefully I'll be able to motivate you guys to do something about that. 10:48.060 --> 10:52.560 Let's first talk about the most important thing here, and that's inventory. 10:53.840 --> 11:03.620 When I'm dealing with hospitals, particularly the ones that come into my environment where we start supporting them for the first time, they never have an inventory. 11:03.980 --> 11:08.720 If we're lucky, they've got a spreadsheet similar to one that St. 11:08.720 --> 11:10.320 Ellis here has. 11:10.780 --> 11:14.220 If you get a chance, please participate in the CTF. 11:14.220 --> 11:19.960 That's actually the inventory list for the CTF that we used just recently. 11:20.000 --> 11:21.780 And it's pretty accurate. 11:21.780 --> 11:24.640 It covers pretty much the same thing that I see at hospitals. 11:25.540 --> 11:29.900 Now, there are some tools that kind of help us figure out inventories. 11:30.520 --> 11:38.800 Lansweeper is my favorite, but there's also Case, SCCM, Configuration Manager, and then you can get real manual with Nmap, Mascan. 11:38.920 --> 11:45.740 Those will kind of get you about 80% of the inventory, but it's still going to be mostly accurate. 11:45.740 --> 11:55.560 And the reasons for some of that is because there are things that are getting added and removed to the environment all the time, and the spreadsheets never get updated. 11:56.400 --> 12:16.340 And there's always the fun one where there's a grant that comes along, and the vendor comes in and installs the devices in the environment and doesn't tell IT or IS, and all of a sudden IT and IS have to support these tools, and it's kind of a mess. 12:16.340 --> 12:26.400 So starting out from the very basics, inventories is one of those vulnerabilities that we kind of have to deal with and start figuring out how to get a better inventory for hospitals. 12:27.240 --> 12:30.700 The next one we're going to move into is actually discovering vulnerabilities. 12:30.700 --> 12:40.720 Now, I like to start out with an external scan to figure out all of the stuff that a hospital has put out on the internet that they use to communicate over the internet. 12:41.520 --> 12:52.140 Generally speaking, when those first hospitals come into our support area, they are very, very vulnerable, and we have to start narrowing that down. 12:52.300 --> 12:55.100 You can see the little spreadsheet to the left there. 12:55.120 --> 13:01.800 That's about a year ago, and I'm proud to say that most of those in the critical areas have at least moved off. 13:03.380 --> 13:07.080 But when, like I said, when a new hospital comes in, they're very, very vulnerable. 13:07.240 --> 13:09.560 Nobody knows what they've got out on the internet. 13:09.560 --> 13:12.200 It's always a fun little situation. 13:12.740 --> 13:15.820 And there are a lot of tools that can be used to do this. 13:15.820 --> 13:19.100 I use Tenable.io and the reference page. 13:19.100 --> 13:20.740 You'll get to see a whole bunch of different other ones. 13:20.740 --> 13:26.000 But I also like to bring out Shodan.io and Census.io. 13:26.720 --> 13:38.440 Shodan.io is a website that you can go to, Shodan.io, and you can search for medical devices on it and see how many are actually published on the internet that you have access to. 13:38.460 --> 13:47.220 In the particular case here, I put PAX in there, and there's about 700 plus medical devices published on the internet that you have access to that you can see about. 13:47.220 --> 13:53.780 And if you click on the IP of that particular device, you'll be able to see the CVs and all the things that are vulnerable for that device. 13:53.780 --> 13:55.280 Kind of a scary little thing. 13:56.280 --> 14:03.820 Now, as bad as the external scan is, scannable IPs on the internet, the internals are always much, much worse. 14:03.820 --> 14:11.800 Because hospitals usually design systems where they have this nice, hard firewall that is supposed to protect them from all the different types of things. 14:12.020 --> 14:16.140 And then once you get inside, it's not much security whatsoever. 14:16.220 --> 14:20.080 So it's like that nice little M&M hard candy shell, soft inside. 14:20.760 --> 14:22.360 Nice and scary stuff. 14:22.360 --> 14:24.440 So how does this kind of come about? 14:25.100 --> 14:28.560 Well, I kind of blame it a lot of it on availability. 14:29.620 --> 14:35.760 And then we're talking about the CIA availability, confidentiality, integrity, and then availability. 14:35.780 --> 14:38.760 Availability is king when it comes to hospitals. 14:38.760 --> 14:48.740 If you've ever seen a physician get upset about not being able to access what they need right then and there, it's quite a terrifying experience. 14:48.740 --> 14:50.960 They usually take it out on everybody. 14:50.960 --> 14:54.160 And rightfully so, because we're talking about life and death here. 14:54.900 --> 15:03.140 So that tends to be one of the challenges that we have to deal with for patch Tuesday that comes out, everything getting patched. 15:03.140 --> 15:10.040 How do you reboot something when it has to be up for that surgery that's going to take place at six o'clock in the morning the next day? 15:10.120 --> 15:16.300 And we could also talk about maybe N plus one and having server farms, but hospitals are kind of cheap. 15:16.300 --> 15:26.220 And that leads to my next one where fast and cheap is far, far more important than good or having it built accurate or done with quality. 15:26.220 --> 15:28.620 So the fast and cheap is always going to win. 15:28.620 --> 15:33.020 Nobody really cares how good it is or the quality of it is. 15:33.020 --> 15:37.340 They just want it set up and running and they don't worry about anything else. 15:38.600 --> 15:46.680 Now, of course, that leads to all kinds of fun little problems because Microsoft is a wonderful company that gets everything to work fairly well. 15:46.680 --> 15:47.980 That's kind of one of their goals. 15:47.980 --> 15:51.740 Everything's got to work, but they turn on all the services by default. 15:52.340 --> 15:56.600 And when you're pushing something out fast and cheap, you push it out with the default settings. 15:56.600 --> 16:06.160 So here we are set up with all these services that we don't need that are running and they're now vulnerable because they haven't been patched in at least six months or so. 16:07.560 --> 16:16.860 The next one is kind of a more challenging one and probably the most important one, both IT and IES. 16:16.860 --> 16:18.840 Really, we kind of suck at talking to humans. 16:18.840 --> 16:25.340 We're great at talking about technology and working with computers and communicating along those routes. 16:25.860 --> 16:29.220 And the staff, they don't talk tech at all. 16:29.220 --> 16:30.200 They talk human. 16:30.200 --> 16:39.220 They're worried about emotions and they're worried about being able to understand people's needs and wants and desires and they don't care about the technology. 16:39.220 --> 16:44.300 That's just the thing that's there that kind of gets in their way and hopefully will help them out just a little bit. 16:45.140 --> 16:50.140 And then the last one I want to talk about is there's really no accountability. 16:50.460 --> 16:55.020 There's also no incentive to do better or to fix all these types of things. 16:55.260 --> 17:15.770 So it kind of to Chloe's point earlier there in her talk, she mentions that there's all these different laws out there, but there's no laws about making sure that medical devices or hospital devices are secure and not going to cause us problems. 17:17.020 --> 17:18.300 And there's also no incentive. 17:18.300 --> 17:22.220 There are a few nice little things, hopefully Casey will cover some of that stuff in his talk. 17:22.220 --> 17:26.600 So next I'm going to talk about my solution for this. 17:26.600 --> 17:28.700 And the key word is communication. 17:28.700 --> 17:34.860 Now we as IT, information security, IS, we've got to do much, much better at communication. 17:35.140 --> 17:38.740 We've got to figure out how to communicate with our target audience. 17:38.800 --> 17:42.280 We've got to figure out how to deliver our message to our target audience. 17:42.520 --> 17:50.820 We've got to be able to read our target audience and get better at understanding when our target audience understands our message. 17:50.820 --> 17:54.760 And we may have to modify our message to get that across. 17:54.800 --> 18:02.620 Once we're able to effectively communicate, you know, those horrible soft skills that nobody ever wants to work on because it's boring and challenging and difficult. 18:02.620 --> 18:10.380 Once those are down, then we can start talking about ensuring that integrity and confidentiality of data is maintained. 18:10.560 --> 18:15.660 And it's just as important, if not more important than the availability of the data. 18:16.220 --> 18:29.080 And we'll be able to talk about how quality is just as important, maybe more so, and even cheaper in the long run than getting something out as fast as possible, as cheap as possible. 18:29.620 --> 18:44.540 And then we can also start convincing those politicians to hold people accountable and people, meaning the CEO boards, all those people that build corporations in order to avoid being accountable to different things. 18:44.540 --> 18:54.800 And we'll be able to start building out some incentives to help us have reasons to do things rather than reasons not to do things. 18:56.400 --> 18:59.300 Next, I want to talk about something that kind of scares me. 18:59.540 --> 19:16.060 Last year at the Biohacking Village, there was a conversation going on, and I believe Beau had said this, and it was about how physicians don't really care about security because there's no body count associated with security. 19:16.080 --> 19:20.820 There's no direct correlation of a medical device killing people. 19:21.200 --> 19:24.320 And to be honest, I think medical devices are being used to kill people. 19:25.820 --> 19:36.200 And there's really no way to tell if they have or they haven't been used to kill people because we don't have the technology in place to detect that. 19:36.200 --> 19:43.040 There's no SOCs, there's no SIMs, there's no IPS, there's no logs, there's none of that good stuff. 19:43.220 --> 19:45.020 Not at least at hospitals. 19:45.020 --> 19:50.160 At hospitals, they have a firewall and they have anti-virus type situations. 19:50.700 --> 19:55.900 And at hospitals, technology is very, very far behind everybody else. 19:55.900 --> 20:03.440 Pagers are still being used, fax machines in multifunction printers are being used to fax between floors. 20:03.900 --> 20:24.340 Just this morning, I had a fun conversation about how a CD was being sent from one hospital to another hospital and how it's important to verify the data on that CD, how it's important to make sure that there's no viruses on that CD, and if they're going to be communicating through CDs, 20:24.340 --> 20:28.520 they should probably encrypt the data, all of which I don't think any of that has been done. 20:30.460 --> 20:34.100 Now, kind of to bring it back around, I posted a little image here. 20:34.100 --> 20:38.840 It's from 2004 about the arrest rates and percentage of crimes cleared. 20:38.840 --> 20:42.840 And as you can see, murders are solved about 62% of the time. 20:43.340 --> 20:56.260 So even if a murder is committed, then there's a pretty good chance, 40% chance that whoever commits the murder is also going to be able to get away with it. 20:56.260 --> 21:01.460 And that's just the way it is with all the legal and law enforcement areas. 21:01.560 --> 21:04.900 As I mentioned, it was 2004 when this particular one came out. 21:04.900 --> 21:07.760 If you do a search and check, that hasn't changed. 21:07.760 --> 21:09.500 It's still right around 60%. 21:09.500 --> 21:13.620 So we need to do better. 21:13.620 --> 21:26.300 We need to start using a communication like I talked about to start holding people accountable and just start providing incentives to ensure that these medical devices aren't actually killing people. 21:26.300 --> 21:27.740 Got to figure it out. 21:27.740 --> 21:30.400 Now here's a little scary thought for everybody. 21:30.660 --> 21:43.560 If hospitals have to invest in these monitoring site solutions, then the hospitals are also going to have to invest in ways to prevent that from happening. 21:43.560 --> 21:49.180 All of this is a huge cost effort and hospitals don't make very much money. 21:49.440 --> 21:58.360 A lot of it is spent on administration and they would much rather buy an MRI machine than they would spend the money on securing something. 21:58.480 --> 22:01.540 So I'm going to drive home that we've got to set up some incentives. 22:03.020 --> 22:07.640 All right, let's pull up this last slide because I don't want to end on too scary or say out of a note. 22:07.820 --> 22:11.640 Everybody's trying their absolute best in everything that they're kind of doing. 22:11.660 --> 22:21.440 Hopefully we'll all keep trying and hopefully we'll get better and learn more and just kind of do the best we can. 22:22.000 --> 22:23.260 I'll also throw this up. 22:23.260 --> 22:24.320 Here's the references. 22:24.680 --> 22:33.200 I'm sure that at a certain point the slides will become available and you will be able to click on the links and utilize the information in these. 22:33.540 --> 22:34.300 Thanks for hearing me. 22:34.300 --> 22:38.000 I believe Casey's up next and we'll hear from him next. 22:38.320 --> 22:39.820 All right, greetings DEF CON. 22:39.820 --> 22:46.160 Thank you for joining this talk and thanks to Eric and Chloe leading into my section now. 22:46.560 --> 22:48.100 Who the heck is this guy? 22:48.100 --> 22:50.600 I am the founder, chairman, and CTO of BugCrowd. 22:50.600 --> 22:51.880 My name is Casey Ellis. 22:51.880 --> 22:54.760 I've been in information security for about 20 years. 22:55.720 --> 23:05.300 From a BugCrowd standpoint, and especially as it relates to vulnerability disclosure, BugCrowd actually pioneered the crowdsource security as a service space. 23:05.300 --> 23:09.860 So, you know, vulnerable disclosure and bug bounty predates us by a long way, which I'll get to in the talk. 23:09.860 --> 23:13.300 We were the first to actually get in the middle and try to make it work better. 23:13.300 --> 23:18.920 So, you know, pretty proud of that, but it means we've learned a lot about how that works from a process standpoint. 23:18.920 --> 23:23.100 From a journey standpoint, for me, you know, I started life as a hacker. 23:23.100 --> 23:34.640 I got into Pentest as a career, moved across into the dark side of security solutions and sales, and then broke bad and became an entrepreneur, which eventually led to starting BugCrowd in 2012. 23:35.260 --> 23:42.940 And yeah, you can see the, you know, the hack persona and the hustle persona on the side that pretty much sums up who I am and how I do what I do. 23:42.940 --> 23:43.860 So now you know me. 23:43.860 --> 23:45.620 That's where to find me as well. 23:46.540 --> 23:53.020 So yeah, with respect to the talk, you know, when we started BugCrowd, it was really all about, like, how do we do this? 23:53.020 --> 24:01.880 Well, there's this enormous community of white hats from all around the world, which Eric's talked about, and some of the things that they can do. 24:01.880 --> 24:08.200 And, you know, this incredible need for security feedback in all sorts of areas of cybersecurity. 24:08.200 --> 24:10.620 Like, how do we make this easy to do it well? 24:10.660 --> 24:16.800 How can you connect that latent potential with the unmet demands of security itself? 24:17.760 --> 24:22.440 And, you know, on this, like, if you look at it simplistically, it's a fairly easy problem to solve. 24:22.440 --> 24:25.760 You just invite a conversation to happen and everything's great. 24:26.260 --> 24:35.040 But it turns out there's a lot of devil in the detail, which is, you know, we did anticipate that when we started off, but it's a lot of what we've been continuing to work on over the last eight years. 24:35.460 --> 24:47.540 And Disclose.io, which is what I'm going to talk about today, is a product actually of the policy and really the adoption of vulnerability disclosure component of that. 24:47.540 --> 24:52.220 Like, at this point, we're a ways along from where we were even back in 2012. 24:52.220 --> 25:03.760 I think nowadays vuln disclosure is becoming this normalized phenomena, and it's starting to become a lot of social pressure around it, which I think is a really good thing. 25:03.760 --> 25:14.040 It's still the company, the kind of thing, rather, that you're a bit special if you do, as opposed to being, you know, abnormal or unusual if you don't do it. 25:14.040 --> 25:20.340 And really, Disclose.io is about flipping that, but I'll not preempt myself anymore, and we'll get into a bit of backstory. 25:20.900 --> 25:25.260 So, in 95, Netscape launched the Bugs bounty program. 25:25.800 --> 25:31.940 They've since dropped the S because it's cleaner, and that is a Silicon Valley joke for anyone who missed it. 25:32.760 --> 25:35.720 There's lockpick bounty programs. 25:35.720 --> 25:41.660 There's all sorts of other things that go back centuries, even, around getting security feedback through a reward model. 25:41.820 --> 25:48.040 But Netscape's broadly accepted as the first kind of high-tech bug bounty program. 25:48.040 --> 25:58.940 And really, with that, kind of almost the instantiation of being proactive around vulnerability disclosure and actually inviting and engaging it as a part of your security process. 25:58.940 --> 26:02.080 So, bug bounties and vulnerability disclosure, they're not the same thing. 26:02.160 --> 26:04.000 Don't let anyone tell you that they are. 26:04.700 --> 26:13.980 But they look enough, they look similar enough in terms of how they operate that, you know, we put that back down to kind of where this whole idea started to really gain momentum. 26:14.320 --> 26:19.300 You know, Bug Crowd started in 2012, and in 2013, I've got these flipped around, but you get it. 26:19.360 --> 26:31.220 One of the things that we noticed was, you know, legal teams don't seem to really understand how to write a policy that is almost the opposite of everything they've written before it. 26:31.220 --> 26:41.360 So, you've traditionally gone out saying, hey, if you're a hacker, go away, you're bad, and here's all of the legal stuff to, you know, create a legal framework for us to say that to you. 26:41.560 --> 26:50.060 Now, we're starting to try to get our heads around the idea that, you know, there's locksmiths as well as burglars out there, and we actually want the help of the locksmiths. 26:50.120 --> 26:51.660 Legal teams don't know how to do that. 26:51.660 --> 26:56.080 It's still, I believe, a net new kind of idea in the space of law. 26:56.460 --> 27:03.280 And the challenge is with legal teams, you know, when they don't, when they're uncertain about what they're doing, they tend to write war and peace. 27:03.540 --> 27:06.380 Like, they'll err on the side of verbosity. 27:06.620 --> 27:12.000 So, you end up with these great big, long, confusing briefs, and that's the first part of the problem. 27:12.000 --> 27:15.080 The second part is that hackers don't read those things in the first place. 27:15.080 --> 27:17.840 They should, but it's the yielder problem. 27:17.960 --> 27:23.180 You know, I think you get a subset of the community who actually really do dig in, and we're very grateful for them. 27:23.300 --> 27:31.680 But you've got to expect the behavior from the internet that people are just going to click through, look for the thing to do next, and go, which is certainly true also in this space. 27:31.960 --> 27:46.080 And the challenge is that when you talk about, you know, the anti-hacking laws and some of the provisions that have been invoked to chill security research that Chloe was talking about earlier, you know, the CFIA makes screwing this up as a hacker potentially a felony crime. 27:46.620 --> 27:49.980 And the same is true for similar laws in other countries. 27:49.980 --> 27:56.020 So in 2014, we thought, all right, let's try to untangle this one and solve it. 27:56.420 --> 28:03.740 So we released the Open Source Vulnerability Disclosure Framework in partnership with Jim Dinaro and the folk over at Cypher Law out of DC. 28:05.240 --> 28:06.720 And that was awesome. 28:06.720 --> 28:19.620 It was basically this idea of, like, how do we, you know, kind of compress down the really important things that need to be in a brief like this to the point where people can theoretically just copy paste and get it right like 90% of the time. 28:20.000 --> 28:25.580 At the same time, Katie, Art, a bunch of others in InDisclosure were working on the ISO standards. 28:25.580 --> 28:27.120 They got released to paying customers. 28:27.120 --> 28:31.280 So there was this kind of convergence on trying to solve this problem of standardization. 28:31.880 --> 28:43.980 Fast forward to 2018, what we did was basically take some of the, well, actually kind of capitalized on some of the attention that was around this concept of legal safe harbor. 28:44.240 --> 28:50.300 Thank you to Amit for really pushing that forward and her legal bug bounty initiative. 28:50.440 --> 28:59.300 And then Dropbox and a couple of other folks that were going on took the OSVDF and legal bug bounty, merged them, and put them all under Disclose.io. 28:59.700 --> 29:02.800 Bug crowd added it as default and off we went from there. 29:03.060 --> 29:04.060 So that's the backstory. 29:04.060 --> 29:09.260 And I think with respect to CFAA, you know, it's important to keep in mind that it is in active use. 29:09.400 --> 29:17.760 I personally believe that there should be laws in place that address computers as a vector to commit a crime. 29:18.320 --> 29:29.380 But, you know, as Chloe called out, if it's not clear what side of the law you're on, especially when you're trying to help, then there's a chilling effect that means that security feedback doesn't pass from A to B. 29:29.380 --> 29:30.460 And that's always bad. 29:30.460 --> 29:31.820 So we're trying to solve that problem. 29:32.800 --> 29:42.400 So really what Disclose.io is about is like, how do we make this idea of vuln disclosure, how do we make the adoption of a vulnerability disclosure program go viral? 29:42.600 --> 29:44.280 And doing it with best practice. 29:44.280 --> 29:50.660 How do we make that into something that is not this huge push from companies like Bug Crowd and people in the researcher community? 29:51.220 --> 29:58.620 Not this like reactive, oh crap, I got tweeted at, what do I do now experience for folk on the vendor side? 29:58.620 --> 30:03.580 Something that, you know, the internet collectively is leaning into and doing well. 30:03.660 --> 30:06.400 And that really is the mission of Disclose.io. 30:06.400 --> 30:20.400 It's a healthy and ubiquitous internet immune system and props to Karen Elazari, Amit's sister, for I think making that concept of hackers operating as the immune system of the internet popular in her TED talk. 30:21.300 --> 30:24.840 Feels like a billion years ago at this point, but it was a little while back. 30:25.740 --> 30:27.340 You know, I think that's true. 30:27.340 --> 30:44.820 I think, you know, the healthcare sector and the internet in general's rejection of security input or its inability to identify that input as important and good, but then its rejection of that input is kind of like an auto immune deficiency in a lot of ways. 30:44.820 --> 30:46.820 And, you know, this is what we're trying to solve. 30:46.820 --> 31:01.300 Like, how do we get it to the point where hackers are functioning as the, like the T-cells of the internet and the internet as an organism, as a body is able to cooperate with that and actually have, you know, everything grow up and be big and strong as a byproduct. 31:02.380 --> 31:13.760 The mission of Disclose.io is to drive vulnerability disclosure adoption, as I probably made clear at this point, but doing that through safety, simplicity, and standardization. 31:13.760 --> 31:20.140 So if that's what you remember about this project, that's going to be kind of the key takeaway because it does involve everyone. 31:20.140 --> 31:21.180 It is open source. 31:21.880 --> 31:30.120 You know, I'm known for bug crowds, sitting in front of a big bug crowd logo, and this is kind of the commercial concept construct for starting this project. 31:30.120 --> 31:33.940 But at this point, we have basically spun it out into its own thing. 31:33.940 --> 31:39.840 It's very much something that we want everyone to participate in, regardless of whether they're a customer of my company or not. 31:39.840 --> 31:41.700 So that's kind of the goal here. 31:42.460 --> 31:43.620 So what is it? 31:43.620 --> 31:44.720 How are we doing it? 31:44.760 --> 31:50.160 How do you unscrew a 30-year-old problem on the internet? 31:50.180 --> 31:51.300 Glad you asked. 31:51.300 --> 31:53.640 So there's three main components to it. 31:53.640 --> 31:57.380 There's the terms, the purpose of the terms is to make it easy. 31:57.480 --> 32:05.420 How do we eliminate the friction of understanding and adopting B2B language in a way that benefits hackers and companies? 32:05.620 --> 32:10.900 And the overall outcome of that is ideally standardization of what those terms should look like. 32:11.260 --> 32:24.180 Eventually, ideally, to the point where things like CFAA, DMCA, and others start to come under the right kind of pressure to be reformed, to actually accommodate for good faith in our space. 32:24.180 --> 32:25.800 I think that's the utopian goal. 32:25.800 --> 32:26.760 We're a ways off from that. 32:26.760 --> 32:31.580 And there's a lot of other things for the legal folk to be occupying themselves with right now. 32:31.580 --> 32:34.500 But in the meantime, we can do our part. 32:34.640 --> 32:41.340 The second piece is the list, which is to aggregate adoption and really to drive adoption as well. 32:41.660 --> 32:45.960 The whole idea there is network effect, which is that kind of virality piece I was talking about before. 32:45.960 --> 32:55.060 How do we get it all into the one spot in a way that basically creates this critical mass of best practice that people are actually drawn to? 32:55.260 --> 32:58.900 And the third piece is the logo, which is really normalization. 32:59.520 --> 33:02.640 I'll go into these in a second because I'm kind of getting ahead of it. 33:02.640 --> 33:05.460 But how do we promote best practice? 33:05.460 --> 33:15.940 I think VDP is a little bit unique in terms of security things that a company can do because a non-technical user can understand it. 33:15.940 --> 33:22.360 They might not get blockchain-enabled, AI-powered, next-gen endpoint something, something. 33:22.400 --> 33:30.820 But the idea of neighborhood watch for the internet, especially when you're talking about a safety-critical space like medical, anyone can get that. 33:30.820 --> 33:38.760 And we're at a point in time where I think the average human is more concerned about the risk that they have when they're buying a product than ever before. 33:38.760 --> 33:45.440 So this becomes something that's actually a benefit aside from the security benefit and the fact that it's just the right thing to do. 33:45.680 --> 33:51.140 The goal with this is for it to almost become like the green padlock for SSL. 33:51.540 --> 33:56.780 And I say that fully mindful that people started to remove the green padlock because it has been normalized. 33:56.840 --> 34:03.420 If this whole idea of VDP adoption can go through that same arc, I would be incredibly happy. 34:03.420 --> 34:08.260 And I think pretty much everyone in this space would benefit from it as well as the internet itself. 34:08.800 --> 34:10.440 So, all right, the terms. 34:10.580 --> 34:14.460 It is a collection of boilerplate, full disclosure templates. 34:14.560 --> 34:16.320 Some folks just copy-paste it. 34:16.320 --> 34:22.620 With the OSVDF, the initial incarnation of this, we noticed the language popping up everywhere. 34:22.620 --> 34:25.180 It was getting translated into different languages. 34:26.440 --> 34:31.160 That document has grandfathered into policies all over the internet at this point. 34:31.160 --> 34:33.020 And that's just the thing that people do. 34:33.080 --> 34:34.340 So, okay, you can do that. 34:34.460 --> 34:40.880 Or you can use it as a foundational framework or a starting point for new versions, which is one of the reasons that it's open source. 34:40.880 --> 34:50.300 We've actually taken input from programs who've looked at the policy, said, hang on, here's an edge that a lot of people have that you probably haven't considered that we're going to write in. 34:50.300 --> 34:56.320 You should consider it, issued a pull request, and we've actually merged that into the language over time. 34:56.620 --> 34:59.760 It's open source, as I keep saying, because I want to really stress that point. 34:59.760 --> 35:03.280 It's licensed under CCA 4.0, so anyone can use it. 35:03.360 --> 35:10.260 And some of the represented in the NASCAR section here are the kind of people that are helping out. 35:10.740 --> 35:20.020 This isn't an endorsement from them of the project itself, but it's the kind of folks that are participating on an individual level to making that language better and driving this forward. 35:20.020 --> 35:22.580 These are the kind of folks that are actually rocking up and assisting. 35:22.580 --> 35:25.480 So that's the other benefit of open source. 35:25.480 --> 35:30.380 It's not just, you know, Casey the Bush lawyer from Australia's opinion on how to do this as well. 35:31.100 --> 35:36.520 It's all sorts of different folks that are actually coming in and making the whole thing more and more effective over time. 35:37.920 --> 35:43.440 And honestly, like, this is the interesting part, I find, is that it's actually kind of hard to do. 35:43.640 --> 35:53.140 You know, one of the things that's a challenge, frankly, that needs to be overcome, because it's a function of how it works, is that not every hacker is a lawyer. 35:53.300 --> 35:55.440 In fact, most aren't, I would say. 35:56.080 --> 35:59.920 And many of them, I would say most, are English as a second language. 35:59.920 --> 36:07.920 So you've got to be able to actually articulate what the hell you're trying to do in this brief in a way that if they do read it, they can understand what's okay and what's not. 36:07.920 --> 36:11.820 So you've got to balance this readability and brevity with legal completeness. 36:11.820 --> 36:21.460 Obviously, you want to provide safety to whatever degree you can without going overboard and having it turn into this 12-page read-fest. 36:22.040 --> 36:26.580 And the safety that's provided by the clauses in this type of thing need to be bilateral. 36:26.580 --> 36:30.680 They need to protect the company that's putting it up on their policy. 36:30.680 --> 36:36.160 And it needs to, more importantly, I think in context of this talk, protect that hacker as they're doing research. 36:36.520 --> 36:46.400 Or even, you know, the concerned citizen who's found a bug, not as a product of security research, that just wants to send it across and doesn't know if that'll get them sent to jail or not. 36:46.520 --> 36:50.620 So at the moment, it's covering US, Canada, the Netherlands, and Belgium. 36:50.620 --> 36:54.340 And we wrote one for the 2020 US presidential elections. 36:55.540 --> 36:59.680 That was tough because there's obviously a lot to consider there. 36:59.680 --> 37:06.240 That's the sort of problem sets that we're trying to tackle with these terms and with the goal of making it easy and standardized. 37:07.460 --> 37:14.540 The list itself is this true community-powered vendor-agnostic directory of all known BDPs and bug-banning programs. 37:15.280 --> 37:21.240 At the moment, we've got, you know, what kind of legal protections afforded by the program, what kind of rewards does it offer. 37:21.240 --> 37:25.260 We're about to integrate support with security.txt. 37:26.120 --> 37:33.400 And I think calling it at the disclosure models and timelines, if it's a coordinated vulnerability disclosure model, that's going to be different for every organization. 37:34.120 --> 37:37.120 So we've accommodated that in there as well. 37:37.220 --> 37:39.800 Again, open source licensed under CCA. 37:39.920 --> 37:41.180 So that brings us to the seal. 37:41.180 --> 37:44.760 This is like the green padlock part that I was talking about at the front. 37:44.800 --> 37:56.260 What we've done at this stage, this will continue to evolve, but where it's up to at this point is dividing out what we're referring to as safe harbor, or as popularly, I think at this point, referred to as safe harbor. 37:56.660 --> 38:05.780 What that's really talking about is what kind of legal protections are available to the researcher that have been proactively included by the program owner into the program. 38:05.780 --> 38:14.940 And we've broken it into partial safe harbor and partial, like a partial compliance statement and a full safe harbor or a full compliance statement. 38:14.940 --> 38:17.560 The difference between those two things, I think is quite important. 38:18.720 --> 38:24.260 For partial, what we're referring to as partial safe harbor, essentially, it's a good faith statement. 38:24.260 --> 38:35.020 So it's this idea that, hey, we agree not to lower up and cause you a hard time if you play by these rules, which is better than there being nothing there, right? 38:35.080 --> 38:38.960 Because that's when, you know, there's, I think the risk can be quite high. 38:38.960 --> 38:42.540 And there's even recently examples of where that sort of thing's gone wrong. 38:43.180 --> 38:45.360 That statement in of itself is a good start. 38:45.360 --> 38:51.460 The problem is that you're still potentially technically committing a crime as you conduct security research. 38:52.620 --> 38:56.500 And that's the part where there's still, I think, a decent amount of exposure. 38:56.500 --> 39:06.140 I liken it to, you know, in California, on the highways, the speed limits 60 miles an hour, but everyone drives at 80 and you don't get pulled over, right? 39:06.140 --> 39:09.320 And that's because there's this sort of social contract. 39:09.320 --> 39:14.880 It's not quite, that would be no safe harbor because it's not written down anywhere, but kind of everyone knows. 39:15.660 --> 39:17.060 It's sort of the same thing. 39:17.060 --> 39:20.460 You could get pulled over for that, but you just don't. 39:20.460 --> 39:28.560 Full safe harbor would be the analog to actually increasing the speed limit to what people will drive at and putting it on the speed sign. 39:28.560 --> 39:35.160 So at that point, there's no recourse for you to be, you know, issued a speeding ticket in that context. 39:35.160 --> 39:39.000 I'm doubling down on this driving metaphor, but I think it's a neat way to explain it. 39:39.620 --> 39:47.420 And to basically get full compliance in context of Disclose.io, there needs to be provision against anti-hacking laws. 39:47.480 --> 39:50.220 So authorization is typically the hinge term. 39:50.220 --> 39:53.860 It certainly is with CFAA and the same is broadly true around the world. 39:54.620 --> 40:00.240 Exemption against any circumvention laws like DMCA, which is very relevant to medical device research. 40:00.640 --> 40:09.480 Exemption against acceptable use or TOS violation because you're breaking the thing and that shouldn't mean that you're breaking the law if you're doing security research. 40:09.840 --> 40:12.400 And a general acknowledgement of good faith as well. 40:12.940 --> 40:20.980 And this is the part where, you know, we'll get to how this all works because ideally, and we've started to see this happen, but this is where everyone can help. 40:21.760 --> 40:24.320 An organization initiates a Vulnerable Disclosure Program. 40:24.620 --> 40:26.400 It gets added to the list. 40:26.420 --> 40:33.300 People see that and look at it, then say, oh, well, where are you at with these safe harbor clauses? 40:33.300 --> 40:39.240 Where are you at with the legal protections that you're giving researchers to actually try to help you out here? 40:39.480 --> 40:44.340 The organization's like, oh, I didn't even really think of that because oftentimes that's true. 40:44.560 --> 40:50.660 They go back, look through the boilerplate stuff, you know, work out what they're going to include or how they're going to adapt their policies. 40:50.660 --> 40:52.500 It gets updated in the list. 40:52.500 --> 40:55.200 And at that point, they're issued with the logo. 40:56.160 --> 41:04.740 Should an organization actually take that logo and use it to promote the fact that they've got a VDP or promote the fact that this is part of their cybersecurity process? 41:05.100 --> 41:08.780 At that point, hackers see it and they start to help out, which is good. 41:09.200 --> 41:11.540 Customers see it and they trust them more, which is good. 41:12.320 --> 41:19.460 The part I like best is that their peers from a vertical standpoint see it and ask themselves, why am I doing that? 41:19.800 --> 41:21.200 I should probably do that too. 41:21.200 --> 41:31.120 Like if, you know, we're in a vertical with five players in it, four are doing it, one's left out, that one looks like a schmuck and no one wants to be that company. 41:31.120 --> 41:38.940 So it's basically increasing lateral social pressure to adopt vulnerability disclosure and actually do this well. 41:39.220 --> 41:51.120 And, you know, it feels too soon to be talking about... I was actually talking about this in context of virality and network effect before COVID broke out. 41:51.120 --> 41:58.860 But, you know, without disrespecting, I think the pain that that's causing a lot of people right now, I think it actually illustrates the idea pretty effectively. 41:58.880 --> 42:11.100 Like how do we take this concept of doing the right thing, making people more secure, doing the right thing by hackers, and just generally improving the security of the internet and actually make that viral? 42:11.500 --> 42:13.680 That's really the goal that we've got here. 42:14.360 --> 42:16.680 So how does it relate to medical security? 42:16.680 --> 42:18.400 What can we achieve in 2020? 42:18.640 --> 42:25.520 The first, and this is a call for help, is to adapt the terms to the medical device sector in particular. 42:25.520 --> 42:30.160 I think the medical sector in general would be great too. 42:30.840 --> 42:46.320 You know, I think the election security revision that we did, it took a lot of work and a lot of thoughtfulness from people that are involved in that space because there's a lot of edge cases that are specific that needed to be considered and factored in and then you needed to simplify that. 42:46.320 --> 42:52.340 So you can't just add crap on because that violates the simplicity design goal of the terms. 42:52.340 --> 42:55.200 So lawyers that are up for that, please do reach out. 42:55.360 --> 43:02.360 As people adopt full disclosure in medical security, we want to see at least 30% of them with this full authorization statement. 43:02.480 --> 43:09.700 Ideally higher, like I'd love to see it get to 100% at some point in the future, but 30% seems like a great place to start. 43:09.780 --> 43:15.620 Across the thousand-odd programs that we're tracking at the moment, compliance is about at about 13%. 43:15.620 --> 43:17.440 I think last time I checked. 43:17.440 --> 43:20.780 So, you know, there's a gap there, but it's a bridgeable gap. 43:20.780 --> 43:21.860 So I think that's a good goal. 43:22.640 --> 43:31.800 And I think specific to COVID, you know, this is something that we've been pushing on commercially as bug crowd, but also just in general at a policy level. 43:32.340 --> 43:43.980 You know, how can we use this to basically unscrew the problem of COVID contact tracing, both from a security and privacy standpoint, but then also from an adoption standpoint? 43:44.080 --> 43:55.200 You know, one of the things that's preventing people from adopting rightly or wrongly, or perhaps rightly and wrongly from adopting contact tracing applications is they don't trust the security implication. 43:55.200 --> 43:57.220 They don't trust the privacy implication. 43:57.220 --> 44:04.200 They don't trust the government, the folks that wrote it, like whatever the individual excuse or reason might be. 44:05.240 --> 44:13.260 It's sort of similar to, you know, the conversation before around like, this is Neighborhood Watch for the internet. 44:13.260 --> 44:29.340 If there's transparency, if there's like this known kind of group of people that are constantly working to help improve this stuff for their own safety as hackers and as members of this community, all of a sudden, you know, we solve all of those problems with really the one shot, 44:29.340 --> 44:34.240 you know, obviously providing the issues are getting fixed, which we're not addressing in this. 44:34.240 --> 44:36.640 We are just talking about vulnerability intake and policy. 44:36.640 --> 44:42.760 That whole vulnerability management pieces is very much a separate but adjacent subject. 44:42.760 --> 44:45.860 I don't want to confuse the two there, but you can sort of see the model here. 44:45.860 --> 44:51.080 If all of a sudden a government or an agency is turning around saying, cool, this is our solution. 44:51.240 --> 44:53.520 These are the concerns that we know you have. 44:53.520 --> 44:54.640 This is how we're addressing them. 44:54.640 --> 44:58.700 And by the way, the should make you more confident. 44:59.000 --> 45:12.380 If that drives up adoption rates of safe and privacy conscious contact tracing applications, I think that's part of what makes that particular model of pandemic management work, which is something we need to be thinking about right now. 45:12.380 --> 45:17.120 I personally hate that type of solution in any time other than this. 45:17.460 --> 45:27.400 I got asked a lot of questions about it and said, yeah, in any other time I'd run screaming from something like contact tracing, I'd recommend that absolutely everyone else do the same thing. 45:27.440 --> 45:34.460 But we haven't really dealt with the kind of things that we're dealing with before with technology available as a potential solution. 45:34.460 --> 45:37.440 So I think this is a really practical application of it. 45:37.800 --> 45:39.300 So help wanted. 45:40.180 --> 45:42.500 Lawyers, help us translate the terms. 45:42.500 --> 45:53.840 If you want to translate it into a language that you speak in and a jurisdiction where you can be considerate of the particular anti-hacking and anti-circumvention laws that apply, that would be fantastic. 45:53.840 --> 45:54.700 We'd appreciate that. 45:54.700 --> 45:56.720 We want to see as much of that happen as possible. 45:57.240 --> 45:59.080 For hackers, contribute to the list. 45:59.080 --> 46:04.900 If there's something missing or if there's a detail that's incorrect, submit a pull request and actually use that list. 46:04.900 --> 46:17.620 The idea of it is to help you guys and girls and everyone else who's involved in hacking to be able to look at the target space that's out there that's actually wanting your help and giving you an opportunity to do that. 46:17.620 --> 46:19.940 If you want to work on paid programs, go for it. 46:19.940 --> 46:24.520 If you want to work on BDPs and verticals that you're passionate about, do it. 46:24.620 --> 46:33.460 The goal of the list is to get all of that information in the one spot and make it easy and shareable to everyone and contributions power that. 46:33.880 --> 46:53.140 For organizations that might be watching, start talking to your security team, start talking to organizations like Bugcrowd, start talking to hackers about what you need to do to take steps towards being proactive about launching a vulnerability disclosure program and actually engaging the feedback of the hacker community. 46:53.300 --> 46:56.400 I think a thing to call out here is you're probably going to get it anyway. 46:57.500 --> 46:59.920 And I think that's sort of where this is all going. 47:00.440 --> 47:05.780 This idea of the internet being a feedback loop is very quickly becoming normalized. 47:06.580 --> 47:09.780 So you can either be reactive to this trend or you can be proactive. 47:09.820 --> 47:12.380 And I think being proactive is a better bet. 47:12.760 --> 47:14.420 And then include Safe Harbor. 47:14.740 --> 47:17.480 And for everyone in the mix, spread the word. 47:17.560 --> 47:20.600 Again, this is the reason that we open sourced it. 47:20.600 --> 47:26.920 This is the reason that we created this particular brand and this particular logo around the idea. 47:26.920 --> 47:30.760 We didn't want this to be purely tied to a commercial initiative. 47:30.760 --> 47:32.780 We think this is something that should happen anyway. 47:32.780 --> 47:34.720 And I'm speaking as Bugcrowd right now. 47:35.820 --> 47:44.440 This is the kind of thing where I think the more input we get, the more it gets spread around, the more people get involved, and the more people adopt it, the better off we all become. 47:44.560 --> 47:46.920 And I think that's something that we can all be a part of. 47:46.940 --> 47:50.260 That is my spiel on Disclosure. 47:50.260 --> 47:54.060 I really appreciate everyone for attending this talk. 47:54.060 --> 47:58.980 Thank you to Chloe and to Eric for their sections in the talk. 47:58.980 --> 48:14.140 And tying it all together, I think this whole ecosystem of the relationship between the hacker community and hacker feedback loops and the current and future state of security overall and safety as a byproduct of that in the medical sector. 48:14.600 --> 48:17.540 Hopefully, we've given you all something to think about today. 48:18.120 --> 48:19.560 And now we're going to do some Q&A.