1 00:00:00,000 --> 00:00:01,220 Thank you, Giglio. 2 00:00:01,220 --> 00:00:03,040 I appreciate the heads up there. 3 00:00:04,640 --> 00:00:08,100 Well, good evening, good afternoon, good morning, wherever you are. 4 00:00:08,820 --> 00:00:11,520 And welcome back to the DEF CON group's village. 5 00:00:12,020 --> 00:00:18,400 I'm here from DC 603, which if your phone code, phone area code memory is not great, is New Hampshire. 6 00:00:19,240 --> 00:00:23,420 And so 603 does, as an MPA, cover all of New Hampshire. 7 00:00:23,420 --> 00:00:27,720 But really, we are located in the Upper Valley. 8 00:00:28,300 --> 00:00:35,640 And I'm going to ask that the speaker assistant here advance the slide to the next slide real quick. 9 00:00:36,340 --> 00:00:49,460 And so we're like halfway up New Hampshire, which makes it far enough away from Boston that we're not really part of the Boston commuter area, the Boston suburbs that kind of extend into the southern part of the state. 10 00:00:49,460 --> 00:00:55,980 And there's an awful lot of security meetups down in that area and around Boston generally. 11 00:00:56,520 --> 00:01:04,520 So we are actually up in an area that has a lower population density and definitely a lower tech job density. 12 00:01:05,380 --> 00:01:07,580 And if you could advance the slide, that'd be great. 13 00:01:07,580 --> 00:01:08,780 There we go. 14 00:01:08,840 --> 00:01:12,140 And let's just go one more part of that, please. 15 00:01:13,900 --> 00:01:17,120 I think that's an interesting red that we've got there on the state. 16 00:01:17,720 --> 00:01:19,720 The wonders about space VR. 17 00:01:19,720 --> 00:01:42,700 So just as an aside, I will say that if we make it through this slide, this talk today, I don't know about Jim Troutman, my compatriot here who I'll introduce in a second, but certainly from my point of view, I feel like this may be the most complicated setup we've done for a talk. 18 00:01:42,700 --> 00:01:47,040 So I'll feel like I can present on mainline or present anywhere if I can make it through this one. 19 00:01:47,040 --> 00:01:50,780 So thank you for bearing with us as we do this. 20 00:01:50,780 --> 00:02:01,260 And so what you should be seeing on Twitch is that we've got... there we go. 21 00:02:02,180 --> 00:02:03,300 That's weird. 22 00:02:03,300 --> 00:02:10,880 So I don't know where the slide is at right now because I see something on Twitch that is... 23 00:02:10,880 --> 00:02:11,520 oh, there we go. 24 00:02:11,520 --> 00:02:11,900 I got it. 25 00:02:11,900 --> 00:02:12,240 I got it. 26 00:02:12,240 --> 00:02:13,780 It just came through on my Twitch. 27 00:02:14,020 --> 00:02:25,300 So yeah, so that meeting room that you see there, that was our last virtual meeting back in March, and our last physical meeting back in March. 28 00:02:25,300 --> 00:02:39,700 And of course, with the lockdown situation, which I think we'd originally figured would not maybe last quite as long as it has so far, and as it looks like it's going to, we didn't immediately dive into a virtual mode, although we're kind of spinning that up more now. 29 00:02:40,140 --> 00:02:54,720 But yeah, so we've been getting together in person every month, and having some talks that are accessible if you're listening to this, and if you're in the area and you're new, and you're like, well, I'm not a super, super skilled hacker. 30 00:02:55,120 --> 00:02:55,880 It doesn't matter. 31 00:02:55,880 --> 00:02:56,600 Come along. 32 00:02:56,600 --> 00:03:12,860 I think as long as you've got the interest in the topic and the passion in the topic, we're going to be delighted to contribute to you and get your contribution and your experience back and just work as a group to share those experiences and expertise. 33 00:03:12,940 --> 00:03:36,180 So in the case of the talk that we're about to present, this is actually a talk that Jim Foutman has done before, and he gave the talk originally at ShmooCon as part of the ShmooCon Fire Talk series, and won the top prize for that this past year at ShmooCon. 34 00:03:36,180 --> 00:03:47,280 But when we did it locally in DC603, what happened there was it provoked an awful lot of conversation, and that's typically how it goes, right? 35 00:03:47,280 --> 00:03:59,360 We're looking to have not just, you know, talk sessions, but we're looking to have a meetup where it's small enough that we can really dive in and talk about some sort of topics in some detail. 36 00:03:59,860 --> 00:04:04,960 The Twitter that we have is easily, you know, findable. 37 00:04:04,960 --> 00:04:10,220 It's DC underscore 603, because I think somebody else has spotted on DC603. 38 00:04:10,220 --> 00:04:16,400 But yeah, if you follow us, DC underscore 603, it's a low volume list. 39 00:04:16,400 --> 00:04:19,460 We're just sending out when there's particular things to be aware of. 40 00:04:19,460 --> 00:04:26,980 And then we also have a Slack, which if you want to join with us and come to meetings and so forth, we can get you on Slack. 41 00:04:27,160 --> 00:04:40,980 And I think the expectation coming out of this DevCon is, I think there's going to be some evolution with how we're doing Discord, and I suspect we'll probably look to do more with Discord going forward. 42 00:04:40,980 --> 00:04:49,940 So rather than preempt that, we'll wait and see how that plays out through Con and after closing, and then, you know, any updates with that there. 43 00:04:49,940 --> 00:04:54,480 So I don't think, with the way this is set up, that I'm going to be able to hear anyone's questions. 44 00:04:54,480 --> 00:05:05,280 If there are questions that you want to try and yell out, go for it or throw it into the text in Discord, and I'll take a look at that and catch up on that and maybe get back to you at the end. 45 00:05:05,760 --> 00:05:10,000 But without further ado, we have Jim Froutman on the line with us. 46 00:05:10,000 --> 00:05:13,220 He is ventriloquizing through me. 47 00:05:13,240 --> 00:05:21,680 So, you know, you're seeing, I think, one disembodied body on stage, but there's actually two of us in the one body, which is kind of how I feel about Jim. 48 00:05:21,680 --> 00:05:23,000 He's an amazing guy. 49 00:05:23,000 --> 00:05:27,080 Some of you probably know he does Sky Talks with me or I do Sky Talks with him. 50 00:05:28,640 --> 00:05:39,020 And he is with us here to dive in on a topic that has been part of his life, I think, for a hell of a long time. 51 00:05:39,020 --> 00:05:43,760 He's been playing around with telecom and DNS and all that stuff forever. 52 00:05:44,160 --> 00:05:51,640 And when he first said to me many months ago, he was going to do a talk on DNS, I was like, oh, cool, that's a neat 101 talk. 53 00:05:52,680 --> 00:06:01,580 And then he did the talk, I'm like, oh, my goodness, there is so much about this that I've just been oblivious to and not keeping up on the tech. 54 00:06:01,580 --> 00:06:03,420 And there's some really interesting stuff here. 55 00:06:03,420 --> 00:06:06,640 So, if you think you know DNS, maybe you do. 56 00:06:06,920 --> 00:06:11,400 More power to you, but I suspect there's a few folks out there that are going to learn something today. 57 00:06:11,500 --> 00:06:13,120 Jim, over to you, man. 58 00:06:14,100 --> 00:06:16,060 Hey, good afternoon. 59 00:06:16,060 --> 00:06:17,640 Can you guys hear me? 60 00:06:18,200 --> 00:06:19,540 They better. 61 00:06:19,540 --> 00:06:20,800 Just keep going. 62 00:06:20,880 --> 00:06:21,760 We hope so. 63 00:06:21,760 --> 00:06:22,580 All right. 64 00:06:22,680 --> 00:06:28,560 Well, if we can take the slide, if we can take the slide forward to the title slide. 65 00:06:30,920 --> 00:06:32,040 Thank you. 66 00:06:32,520 --> 00:06:40,000 So, thank you, guys, for the DC Groups team for setting this up and making all this work. 67 00:06:40,000 --> 00:06:48,480 And I know there's been a lot of technical challenges, but I think it's been a good learning experience for everybody involved. 68 00:06:48,480 --> 00:06:55,620 And thank you to Donald for inviting me to come and do this presentation today. 69 00:06:56,200 --> 00:06:57,200 Okay. 70 00:06:57,260 --> 00:07:00,460 So, DNS New World Order. 71 00:07:00,560 --> 00:07:04,040 What the fuck? 72 00:07:04,680 --> 00:07:09,720 So, I'm a guy on the internet. 73 00:07:09,720 --> 00:07:13,980 You can find me easily. 74 00:07:13,980 --> 00:07:18,940 I've been around, done a lot of things in ISP land. 75 00:07:19,000 --> 00:07:21,760 I've been on the internet since 87. 76 00:07:23,180 --> 00:07:25,940 I have to issue a disclaimer. 77 00:07:26,120 --> 00:07:32,520 I am a director and co-founder of a non-profit internet exchange called Weenix. 78 00:07:33,120 --> 00:07:40,120 We happen to host some servers for one of the companies that I'm going to be discussing today, Quad9. 79 00:07:42,180 --> 00:07:44,180 So, just a little disclaimer. 80 00:07:44,840 --> 00:07:45,440 All right. 81 00:07:45,440 --> 00:07:48,200 So, here's what we're going to learn today. 82 00:07:48,280 --> 00:07:49,920 Topics of presentation. 83 00:07:50,580 --> 00:07:58,020 We're going to talk about the DNS system in general and some of these new encrypted DNS methods like Doe and Dot. 84 00:07:59,160 --> 00:08:13,340 We're going to talk about operational reasons why you should monitor your DNS, about all these cloud services that are out there offering easy-to-remember DNS servers and why would they want to do such a thing. 85 00:08:14,140 --> 00:08:19,880 The privacy implications of some of the web browser product decisions. 86 00:08:20,200 --> 00:08:33,170 And then I'm going to end with some recommendations on how to mitigate the impact of all of these new encryption methods and those cloud-based DNS services. 87 00:08:34,890 --> 00:08:44,090 So, this slide here, which is, talks about the new troubleshooting procedure. 88 00:08:44,690 --> 00:08:46,750 It is not DNS. 89 00:08:46,750 --> 00:08:48,890 There's no way it's DNS. 90 00:08:49,210 --> 00:08:50,710 It was DNS. 91 00:08:54,110 --> 00:08:59,710 And I'm going to pause here until the slides catch up. 92 00:09:02,730 --> 00:09:06,030 We should be on the one that says new troubleshooting procedure. 93 00:09:06,030 --> 00:09:06,830 It's not DNS. 94 00:09:06,830 --> 00:09:07,850 There's no way it's DNS. 95 00:09:07,850 --> 00:09:08,650 It was DNS. 96 00:09:08,650 --> 00:09:09,890 We know it was always DNS. 97 00:09:10,190 --> 00:09:15,690 And if Jim, if you can do a next every time from now on, hopefully we can keep it that same. 98 00:09:16,930 --> 00:09:20,670 So , we're on the graphic, right guys? 99 00:09:20,670 --> 00:09:23,490 New troubleshooting procedure sitting on a cube wall. 100 00:09:24,810 --> 00:09:27,370 There's a little bit of a delay on the screen. 101 00:09:27,370 --> 00:09:28,030 I can see that. 102 00:09:28,030 --> 00:09:29,210 Who would have thought? 103 00:09:29,210 --> 00:09:30,650 Latency on the internet. 104 00:09:31,150 --> 00:09:32,710 Yeah, it's amazing. 105 00:09:35,230 --> 00:09:38,350 All right, are we going to share these slides afterwards, Jim? 106 00:09:38,350 --> 00:09:39,270 Yes, yeah. 107 00:09:39,270 --> 00:09:49,790 Okay, so if there's anyone in the audience who's trying to throw bricks at us right now, we will make sure you get a copy of the slide deck and you can just play it through in your own mind afterwards again. 108 00:09:50,430 --> 00:09:51,550 Yes. 109 00:09:52,930 --> 00:09:55,270 Oh, I see it loading. 110 00:09:55,270 --> 00:09:56,930 I see your cube wall loading. 111 00:10:01,650 --> 00:10:05,450 It's rendering like line by line on my Twitch. 112 00:10:05,450 --> 00:10:06,450 I don't know about yours. 113 00:10:06,450 --> 00:10:08,670 Yeah, I apologize. 114 00:10:08,670 --> 00:10:09,470 That's awesome. 115 00:10:09,470 --> 00:10:11,030 Apparently, my slides... 116 00:10:16,610 --> 00:10:19,150 They're not even all that complicated. 117 00:10:19,150 --> 00:10:20,950 Hey, look, graphics. 118 00:10:20,950 --> 00:10:23,090 Masterized PNGs, right? 119 00:10:23,090 --> 00:10:23,250 Yeah. 120 00:10:23,870 --> 00:10:31,690 I wonder if it's like upscaling them into some sort of ludicrously detailed resolution that it doesn't need to. 121 00:10:31,830 --> 00:10:35,810 Anyway, I'm proceeding onward. 122 00:10:35,810 --> 00:10:37,830 So, let's talk about DNS. 123 00:10:37,830 --> 00:10:38,950 Next slide. 124 00:10:39,310 --> 00:10:41,630 So, what the heck is DNS? 125 00:10:41,650 --> 00:10:43,490 So, it's the domain name system. 126 00:10:44,250 --> 00:10:54,350 And it is really about the most fundamental technology that makes the internet work other than packets and wires and fiber. 127 00:10:54,950 --> 00:11:00,230 And it works so well that most people never even think about it. 128 00:11:00,230 --> 00:11:02,710 We don't think about it until it breaks. 129 00:11:02,890 --> 00:11:06,830 Most end users really have no knowledge about it. 130 00:11:07,290 --> 00:11:20,970 So, what DNS does is that it simply converts the names that humans can remember into numbers, which is what computers use, network addresses. 131 00:11:21,130 --> 00:11:22,650 Next slide, please. 132 00:11:24,060 --> 00:11:32,310 It's also used internally by almost every organization because almost everybody's running Microsoft Active Directory. 133 00:11:32,430 --> 00:11:33,890 And guess what? 134 00:11:33,890 --> 00:11:41,230 Active Directory depends entirely on DNS working correctly and reliably. 135 00:11:41,230 --> 00:11:43,370 Next slide, please. 136 00:11:46,370 --> 00:11:51,650 So, really, everything you do on the internet needs DNS to function. 137 00:11:52,290 --> 00:12:03,950 This is why a lot of people will say something like, and I'm sure those of you in the audience that have done any sort of tech support or help desk, you've heard this before, the internet is down. 138 00:12:04,410 --> 00:12:06,670 And usually, that's not the case. 139 00:12:06,670 --> 00:12:08,790 The internet is just fine. 140 00:12:08,790 --> 00:12:12,450 But DNS resolution was broken for that user. 141 00:12:13,000 --> 00:12:18,370 So, DNS requests are usually called queries. 142 00:12:19,110 --> 00:12:21,010 And next slide, please. 143 00:12:23,040 --> 00:12:37,890 These queries that you issue all the time with your browser and with your phone and pretty much every single app that you use, they reveal an awful lot about you and what you are doing online. 144 00:12:37,890 --> 00:12:41,870 The games you play, email, et cetera. 145 00:12:42,410 --> 00:12:45,350 So, a little refresher about what DNS is. 146 00:12:45,350 --> 00:12:46,850 Next slide, please. 147 00:12:47,890 --> 00:12:50,110 Domain names are hierarchical. 148 00:12:50,190 --> 00:12:52,890 They start at the root or the dot. 149 00:12:52,890 --> 00:12:55,110 And then we have top-level domains. 150 00:12:55,590 --> 00:13:06,710 And there's the original generic top-level domains like .com and .gov and .net or various country codes like .uk, .jp. 151 00:13:07,810 --> 00:13:13,510 Originally, there was just a very few number of top-level domains. 152 00:13:13,510 --> 00:13:15,950 Now there's more than a thousand. 153 00:13:16,210 --> 00:13:25,150 You have such things as .bank, .coop, even .horse, which is kind of fascinating. 154 00:13:27,600 --> 00:13:28,300 All right. 155 00:13:28,300 --> 00:13:31,160 So, this next slide, please. 156 00:13:35,090 --> 00:13:39,010 So, we have some example DNS names. 157 00:13:39,630 --> 00:13:44,630 Google.com, www.bbc.co.uk, et cetera. 158 00:13:44,630 --> 00:13:46,130 You get the idea. 159 00:13:46,290 --> 00:13:49,610 Most of you guys know how DNS is structured. 160 00:13:50,110 --> 00:13:54,130 So, DNS is a service that converts names into numbers. 161 00:13:54,130 --> 00:13:58,990 So, for example, next slide, please. 162 00:13:58,990 --> 00:14:05,290 You look up a record like www.cnn.com when you punch that into your browser. 163 00:14:05,470 --> 00:14:13,610 You'll get an IPv4 address that you can almost remember, 151.101.167. 164 00:14:13,610 --> 00:14:22,110 But with IPv6, you're going to get a big, long hexadecimal address that nobody in the world should try to remember. 165 00:14:22,150 --> 00:14:24,570 This is why we have DNS. 166 00:14:25,630 --> 00:14:27,450 Next slide. 167 00:14:27,930 --> 00:14:37,690 So, DNS was originally conceived in 1983, roughly. 168 00:14:37,690 --> 00:14:41,970 At least the RFC was published then, RFC 882. 169 00:14:41,970 --> 00:14:45,830 And that was superseded by RFC 1035 in 1987. 170 00:14:45,830 --> 00:14:51,430 And that is basically more or less the DNS that we have today. 171 00:14:52,950 --> 00:15:00,310 BIND, the Berkeley Internet named Daemon, was created in 1985. 172 00:15:01,590 --> 00:15:08,890 And this DNS is really the last major plain text protocol that's left on the Internet. 173 00:15:08,890 --> 00:15:14,450 Although, as we're going to discuss, there's lots of people trying to make it go away. 174 00:15:14,970 --> 00:15:18,170 A little more background on the DNS. 175 00:15:18,290 --> 00:15:22,250 In order for DNS to work, you have to have the root servers. 176 00:15:22,310 --> 00:15:23,870 Next slide, please. 177 00:15:24,450 --> 00:15:30,130 The 13 root servers in the world, lettered A through M. 178 00:15:30,570 --> 00:15:33,990 And they're operated by 12 different organizations. 179 00:15:33,990 --> 00:15:43,410 And it's important to understand that these 13 servers that are the root of the DNS, they are by no means individual servers. 180 00:15:43,410 --> 00:15:50,690 These are clusters of servers with load balancers and multiple instances all over the world. 181 00:15:50,690 --> 00:15:59,030 Some of these root servers have over 160 separate physical instances around the world in various data centers. 182 00:15:59,030 --> 00:16:16,410 Because they're so widely distributed, this allows scaling of traffic volumes and lots of increased resiliency and redundancy, particularly against directed attacks like DDoS attacks, which root servers get all day long. 183 00:16:16,470 --> 00:16:18,210 Next slide, please. 184 00:16:18,510 --> 00:16:30,870 So, all of the root servers in the letters A through M, they get a massive amount of traffic in terms of queries and transactions. 185 00:16:30,870 --> 00:16:38,190 We're talking double digit billions of queries per day processed by these root servers. 186 00:16:38,190 --> 00:16:42,690 That's trillions of DNS queries per month. 187 00:16:43,390 --> 00:16:54,810 And the DNS has actually managed to scale over nine orders of magnitude in the last 35 years. 188 00:16:54,990 --> 00:16:57,810 And it will continue to do so. 189 00:16:57,810 --> 00:17:04,570 I think that's pretty impressive for a protocol designed in the mid-80s. 190 00:17:05,290 --> 00:17:12,750 One of the ways that DNS scales... next slide, please... is a technique called IP NCASI. 191 00:17:12,750 --> 00:17:22,390 This is where you take an IP address block and you advertise it in multiple locations on the internet at the same time via BGP routing. 192 00:17:22,970 --> 00:17:36,350 The same address appears in multiple locations and your ISP or your network makes decisions to steer the traffic to the best, nearest instance of that IP address. 193 00:17:36,670 --> 00:17:43,710 So, all the DNS servers, all the root DNS and all the cloud DNS in the world uses NCAST. 194 00:17:43,850 --> 00:17:45,390 Next slide, please. 195 00:17:45,850 --> 00:17:51,650 So, we talked about traditional DNS started in 85. 196 00:17:51,650 --> 00:17:58,490 It's what some people are now calling DO-53, since we have DOH and DOT. 197 00:17:58,670 --> 00:18:02,770 DO-53 is the original unencrypted DNS. 198 00:18:03,440 --> 00:18:10,170 So, it's UDP port 53 for queries, TCP port 53 for zone transfers. 199 00:18:10,410 --> 00:18:16,050 And it's, again, it's been largely the same for the last 35 years. 200 00:18:16,250 --> 00:18:18,230 Next slide, please. 201 00:18:18,230 --> 00:18:27,690 The wonderful thing about DNS from a network management point of view and a security point of view is that it's plain text. 202 00:18:27,690 --> 00:18:30,970 So, you can monitor it over the wire very easily. 203 00:18:31,930 --> 00:18:42,890 And I have to say, if you're in a corporate environment and your IT security staff isn't monitoring DNS, they're doing it wrong. 204 00:18:42,890 --> 00:18:52,710 If you are the IT security staff for your organization and you are not monitoring DNS, you really ought to. 205 00:18:52,970 --> 00:18:59,310 It is incredibly useful to monitor DNS, lets you know what your endpoints are up to. 206 00:18:59,310 --> 00:19:08,390 It makes it easier to find malware and, of course, good old AUP violations on your network. 207 00:19:09,270 --> 00:19:10,750 Next slide, please. 208 00:19:11,410 --> 00:19:21,250 So, there is some other, and some people have thought, well, that's kind of a problem. 209 00:19:21,250 --> 00:19:26,430 I don't really want people to know what I'm doing and what my DNS queries are. 210 00:19:26,710 --> 00:19:41,950 So, there was a group of folks that were not IETF and did not come up with an official standard, but they created a thing out of the free VSD community called DNS Crypt. 211 00:19:41,950 --> 00:19:45,630 And I skipped over DNSSEC. 212 00:19:45,830 --> 00:19:48,250 You may have heard of DNSSEC. 213 00:19:48,470 --> 00:19:59,070 It's a way to cryptographically authenticate DNS data, but it doesn't actually hide it, it just authenticates it. 214 00:19:59,070 --> 00:20:05,990 And DNSSEC is really not a topic of this presentation, it's like a whole other presentation unto itself. 215 00:20:06,510 --> 00:20:07,370 Okay. 216 00:20:07,770 --> 00:20:09,270 Next slide. 217 00:20:09,310 --> 00:20:17,470 DNS Crypt, 2011, bunch of folks in the free VSD world were instrumental in that. 218 00:20:17,470 --> 00:20:21,470 They created an encryption protocol. 219 00:20:21,470 --> 00:20:22,270 It worked. 220 00:20:22,270 --> 00:20:30,650 It actually used port 443, but didn't use TLS, used another encryption method. 221 00:20:31,510 --> 00:20:41,530 So, it worked, it solved the problems, but it really didn't get much traction at the time with anybody. 222 00:20:41,530 --> 00:20:43,090 Because, you know what? 223 00:20:43,090 --> 00:20:44,530 DNS is kind of boring. 224 00:20:46,470 --> 00:20:49,450 So, fast forward a little bit. 225 00:20:49,710 --> 00:20:50,910 Next slide. 226 00:20:50,910 --> 00:20:54,510 DNS over TLS, or commonly known as DOT. 227 00:20:54,510 --> 00:21:00,230 This was an RFC process issued May 2016. 228 00:21:00,370 --> 00:21:06,790 And this is basically traditional DNS with TLS encryption running on a different port. 229 00:21:06,790 --> 00:21:09,950 This uses TCP port 853. 230 00:21:09,950 --> 00:21:19,800 And the nice thing about that is it keeps the network control traffic separate from your application data traffic. 231 00:21:21,440 --> 00:21:35,180 Now, you may not be aware, but... next slide, please... support for TLS at DNS over TLS DOT has actually been around for a while. 232 00:21:36,740 --> 00:21:42,180 It started in Android 9 for the whole OS. 233 00:21:42,180 --> 00:21:51,520 So, if you have recent Android, it's enabled by default and it will just work if it's supported by the server that you're talking to. 234 00:21:52,200 --> 00:21:57,880 Microsoft says they may eventually support DOT in the operating system. 235 00:21:58,220 --> 00:22:06,000 And Apple is going to be supporting DOT in the new iOS 14 and in macOS 11. 236 00:22:06,000 --> 00:22:09,520 So, this is fairly recent developments. 237 00:22:09,520 --> 00:22:18,640 And this is good to have encrypted DNS, right? 238 00:22:19,420 --> 00:22:21,700 Next slide, please. 239 00:22:21,900 --> 00:22:30,300 So, there was a different group of folks that decided to create DNS over HTTPS or DOE. 240 00:22:30,300 --> 00:22:37,520 This is a different RFC, 8484, issued in December of 2018. 241 00:22:38,240 --> 00:22:44,520 So, this is a protocol that uses TCP port 443 with TLS encryption. 242 00:22:44,520 --> 00:22:46,920 What does that remind you of? 243 00:22:46,920 --> 00:22:51,280 Yes, it is the same as HTTPS for websites. 244 00:22:51,600 --> 00:22:59,620 So, it implements DNS queries using a special HTTP GET with JSON responses that get parsed. 245 00:23:00,720 --> 00:23:08,280 It can be a little bit slower than regular DNS by several milliseconds, but it's not really a big deal. 246 00:23:10,920 --> 00:23:19,640 Microsoft has actually just added support for DOE, starting in Windows 10 Preview Build 19.6.2.8. 247 00:23:19,800 --> 00:23:29,560 And Apple is going to support DOE in the OS, starting in iOS 14 and macOS 11, which are coming out this fall. 248 00:23:31,500 --> 00:23:37,860 So, we'll talk about why DOE and DOT exist in a little bit. 249 00:23:37,860 --> 00:23:39,960 I'm going to talk about DNS in the cloud. 250 00:23:39,960 --> 00:23:41,320 Next slide, please. 251 00:23:42,760 --> 00:23:53,380 So, you may be aware that for many years, there's been public DNS servers, usually operated by ISPs, as a resource. 252 00:23:53,380 --> 00:24:08,800 If you've been around on the internet for a while, you may recognize some of these numbers on the slide, like 4.2.2.2, operated by level 3, 75.75.75.75, which I believe is Comcast. 253 00:24:08,800 --> 00:24:10,560 And there's others out there. 254 00:24:10,840 --> 00:24:20,820 And these were really just primarily for network engineers and network people who just needed to set up DNS to get something working real quick. 255 00:24:21,940 --> 00:24:25,980 And most end users didn't really know about them. 256 00:24:26,940 --> 00:24:30,580 Until DNS in the cloud. 257 00:24:30,580 --> 00:24:31,580 Next slide. 258 00:24:31,920 --> 00:24:44,420 So, Google, back in December 2009, and some of you were probably still in high school then, they launched a service called 8.8.8.8. 259 00:24:44,420 --> 00:24:47,020 And why did they do that? 260 00:24:47,020 --> 00:24:58,100 Well, they said they wanted to improve the speeds and the user experience versus a lot of ISPs that had broken DNS and still do. 261 00:24:58,500 --> 00:25:01,260 And I believe that. 262 00:25:01,800 --> 00:25:08,000 It also gave them all sorts of data about what people were doing and where they were going. 263 00:25:08,260 --> 00:25:18,380 Now, using Google DNS back then was useful to work around censorship issues at the time. 264 00:25:19,160 --> 00:25:27,620 You may or may not remember this picture, which will probably take a minute and a half to load on the stream. 265 00:25:27,900 --> 00:25:42,060 It's a picture from the Arab Spring uprising where people were actually spray painting graffiti with the DNS numbers on buildings more than once all over the place. 266 00:25:42,060 --> 00:25:50,340 And this, at the time, was actually an effective way to avoid censorship by the government. 267 00:25:50,340 --> 00:25:52,700 Not so much anymore. 268 00:25:53,140 --> 00:25:56,970 Censorship and network control has gotten a lot more sophisticated. 269 00:25:58,940 --> 00:26:01,020 Next slide, please. 270 00:26:01,260 --> 00:26:09,180 So, Google, they're quad nine for several years, and there wasn't really any others. 271 00:26:09,360 --> 00:26:13,420 And then now there's more. 272 00:26:13,420 --> 00:26:24,100 Cloudflare came up with 1.1.1.1 in cooperation with the APNIC that controlled that IP space. 273 00:26:24,720 --> 00:26:30,160 Then there's another organization called quad nine that is all nines. 274 00:26:30,800 --> 00:26:31,800 Interesting. 275 00:26:31,800 --> 00:26:43,680 And then there's been other cloud-based... next slide, please... such as OpenDNS, which is now Cisco Umbrella, because Cisco bought them, because that's what Cisco does. 276 00:26:43,680 --> 00:26:45,240 They buy things. 277 00:26:45,700 --> 00:27:00,000 And most recently, CIRA, the Canadian.ca registry authority, they created a new service called Canadian Shield with an IP address that is available to the public. 278 00:27:03,620 --> 00:27:06,820 So, next slide, please. 279 00:27:06,960 --> 00:27:19,960 If you can control the DNS for what someone goes to, what they're resolving, what your end users see, if you control the DNS, you basically control everything. 280 00:27:19,960 --> 00:27:24,220 It's almost as good as controlling the entire network. 281 00:27:25,260 --> 00:27:47,360 Which is the reason why so much malware that attacks home routers and things like that, they want to modify your DNS settings on your network router, if your clients are pointed at your local router, so that they can send you to illegitimate sites. 282 00:27:49,360 --> 00:27:51,640 So, next slide, please. 283 00:27:51,640 --> 00:27:57,460 Again, DNS, it's great for tracking. 284 00:27:57,840 --> 00:28:01,640 If you monitor DNS queries, you know where everyone goes online. 285 00:28:01,640 --> 00:28:22,600 Your shopping, your entertainment, what you do for work, most likely, any medical sites, the apps you run on your phone, and even right down to depending on the device, you can figure out what device it is in your house or your business, and particularly with IoT devices based on those DNS queries. 286 00:28:23,140 --> 00:28:24,820 Next slide, please. 287 00:28:25,640 --> 00:28:32,920 So, if you control the DNS, again, you control where users go or don't go. 288 00:28:33,720 --> 00:28:44,040 I believe strongly DNS monitoring is great for fighting malware and intrusions, and I, again, say it is essential for Blue Team network defense and monitoring. 289 00:28:45,560 --> 00:29:00,720 Ah, but DNS also is money, because many ISPs, and this includes your cell phone company, because they are, in fact, an ISP, because you use data on your phone. 290 00:29:01,360 --> 00:29:24,780 Many of these ISPs, including your cable TV companies, iLex, telcos, wireless carriers, et cetera, they are monitoring your DNS, and they are actually, many of them, selling that information to a variety of data brokers and advertising companies and other companies that want to track people. 291 00:29:24,920 --> 00:29:47,260 And in some cases, those ISPs and carriers, they actually own some of the advertising companies themselves, which is why, when they say things in their acceptable use policy, like, we will not sell your data, that 292 00:29:52,570 --> 00:30:10,550 they're able to tie you directly via your cell phone ID numbers, your home IP address range, whatever IP address you had at the time, they can tie that data directly to you demographically. 293 00:30:10,550 --> 00:30:13,610 They know it's you and not somebody else. 294 00:30:14,250 --> 00:30:16,210 Next slide, please. 295 00:30:16,210 --> 00:30:23,850 So, there are different estimates what this data is worth and how they can sell it for. 296 00:30:23,910 --> 00:30:32,830 I have seen everything from $3 a year per subscriber up to several hundred. 297 00:30:32,830 --> 00:30:37,530 I think it varies upon the demographics of the value of the person. 298 00:30:37,870 --> 00:30:45,430 So, if you are not paying for a product on the Internet, you are the product. 299 00:30:46,470 --> 00:30:49,350 So, next slide. 300 00:30:51,890 --> 00:30:53,630 So, why do we have Doe? 301 00:30:53,630 --> 00:31:06,110 Well, the reason we have Doe is, up until just recently, the operating system vendors, really, they had not implemented any sort of encrypted DNS. 302 00:31:06,270 --> 00:31:10,970 They are now about to release dot support. 303 00:31:11,770 --> 00:31:15,410 But for years, they really weren't doing anything. 304 00:31:15,410 --> 00:31:26,950 So, some of the browser makers, like Firefox, Mozilla, they decided that they needed to take matters into their own hands, and that's in part how Doe came about. 305 00:31:28,730 --> 00:31:34,770 So, Firefox added Doe support in September of 2018. 306 00:31:35,970 --> 00:31:45,530 And then, in January of this year, they made it an option that you could enable Doe, if you wanted to, in Firefox. 307 00:31:46,390 --> 00:31:57,790 But since February 25th of this year, Doe is now enabled by default for all Firefox users in the U.S. 308 00:31:58,170 --> 00:31:59,750 Next slide, please. 309 00:32:00,250 --> 00:32:05,630 So, this is a picture of the opt-out in Firefox. 310 00:32:05,630 --> 00:32:11,390 And I think most end users are just going to see this thing and say, okay, yeah, that's great. 311 00:32:11,390 --> 00:32:14,830 It's more encryption and it's more privacy. 312 00:32:16,570 --> 00:32:21,470 And, in fact, that is true, to a point. 313 00:32:22,510 --> 00:32:28,630 So, Mozilla picked Cloudflare as their first and default Doe provider. 314 00:32:28,630 --> 00:32:35,430 And they drew up a contract and there's various requirements that they have to honor. 315 00:32:37,490 --> 00:32:41,610 And that's interesting. 316 00:32:43,970 --> 00:32:57,120 Firefox also includes a domain name canary, which is something that your ISP can set in their DNS servers, which will actually disable Doe in Firefox. 317 00:32:57,510 --> 00:33:03,890 Because you see, there's a whole lot of tension over who gets to monetize you. 318 00:33:06,570 --> 00:33:09,250 Because you are the product. 319 00:33:09,490 --> 00:33:12,050 So, the ISPs have been doing the monetization. 320 00:33:12,650 --> 00:33:16,130 And now there are other folks that would like to do that. 321 00:33:16,130 --> 00:33:17,650 And it's also the monitoring. 322 00:33:18,410 --> 00:33:20,210 Next slide, please. 323 00:33:21,030 --> 00:33:26,590 So, there are other web browsers besides Firefox supporting Doe now. 324 00:33:26,590 --> 00:33:30,670 Chrome supports it, but it's not enabled by default yet. 325 00:33:30,670 --> 00:33:37,950 I understand there's some A-B testing going on and I imagine Chrome will be enabling it soon. 326 00:33:38,150 --> 00:33:46,690 But Chrome says they will have a GPO that will enable you to disable Doe entirely. 327 00:33:48,270 --> 00:33:51,230 Microsoft Chromium Edge supports it. 328 00:33:51,230 --> 00:33:53,030 It's not enabled by default. 329 00:33:53,030 --> 00:33:54,510 Opera supports it. 330 00:33:54,510 --> 00:33:56,130 Brave supports it, et cetera. 331 00:33:56,130 --> 00:33:57,810 Not enabled by default. 332 00:33:58,390 --> 00:34:02,670 So, you know, Doe does encrypt things. 333 00:34:02,670 --> 00:34:12,150 And it makes it harder for people to see where you're going on the internet by encrypting your DNS traffic. 334 00:34:13,310 --> 00:34:16,110 But this is a double-edged sword. 335 00:34:16,110 --> 00:34:19,370 There's a lot of malware now using Doe. 336 00:34:21,820 --> 00:34:26,360 And because it's using Doe, you're not seeing that traffic anymore. 337 00:34:26,920 --> 00:34:37,460 There's been at least one piece of malware, the, I guess, God Lula backdoor for Linux and Windows, and that came out in January of 2019. 338 00:34:37,700 --> 00:34:41,540 And it was using Doe for its CNC servers. 339 00:34:42,340 --> 00:34:52,020 And I expect there's going to be all sorts of additional malware developed that's going to use Doe because it makes it easier, you know, for them to hide. 340 00:34:52,340 --> 00:35:00,240 So, I think you're going to need to start deploying man-in-the-middle TLS proxies in your corporate environments if you aren't already. 341 00:35:00,780 --> 00:35:02,260 Next slide, please. 342 00:35:04,600 --> 00:35:10,780 And again, I think the Adversaries TTPs are changing to adapt to Doe. 343 00:35:11,320 --> 00:35:19,340 I suspect there's probably some malware out there in the wild using Doe that people don't even know about right now. 344 00:35:19,880 --> 00:35:23,760 I think that's going to be a big, big thing for the rest of this year and next year. 345 00:35:26,080 --> 00:35:32,840 So, DNS in the cloud, going back to that. 346 00:35:33,620 --> 00:35:35,440 It's really surveillance. 347 00:35:35,440 --> 00:35:36,980 Next slide, please. 348 00:35:37,680 --> 00:35:42,820 Not all of the DNS cloud providers have a clear privacy policy. 349 00:35:42,820 --> 00:35:49,540 Some things they're retaining for a couple of years in summary, maybe just 24 hours. 350 00:35:49,540 --> 00:35:51,800 Okay, some of that doesn't bother me. 351 00:35:51,800 --> 00:35:53,320 Some of it does. 352 00:35:54,080 --> 00:36:01,920 However, everybody is just assuming that Doe actually does give you privacy. 353 00:36:02,480 --> 00:36:06,500 And the answer is, not as much as you think. 354 00:36:07,900 --> 00:36:20,880 It also is centralizing your DNS queries by using these sort of well-known cloud providers to provide DNS service for all sorts of people. 355 00:36:21,520 --> 00:36:28,600 You're really centralizing the places where that data can be monitored and collected. 356 00:36:32,080 --> 00:36:39,620 So, DNS over HTTPS, it's not as secure. 357 00:36:39,620 --> 00:36:41,360 Next slide, please. 358 00:36:41,420 --> 00:36:42,600 We're up to 49. 359 00:36:44,380 --> 00:36:52,080 Doe doesn't actually encrypt the data that you can't get in other unencrypted forms. 360 00:36:52,160 --> 00:37:09,400 You see, because where you go with Doe, SNI information, the IP address you're actually talking to, OSCP checks for certificates, and all of that is still in clear text. 361 00:37:09,400 --> 00:37:23,340 So, it's... and if they know the IP address of the website you're going to, there's been studies that can pretty much correlate that with, you know, the website, something like 85% of the time. 362 00:37:23,780 --> 00:37:31,280 So, you think that you may be getting all sorts of privacy from using Doe, but you're not. 363 00:37:31,280 --> 00:37:41,240 Just because they can't see exactly what DNS queries you are issuing doesn't mean they can't figure out what you're actually doing. 364 00:37:42,040 --> 00:37:43,480 Next slide. 365 00:37:43,480 --> 00:37:51,520 Here's a tweet from DA667 pointing out some of the same things. 366 00:37:51,520 --> 00:37:58,720 It really consolidates trust of confidential data to organizations that may not deserve it. 367 00:37:59,280 --> 00:38:00,980 Next slide, please. 368 00:38:01,460 --> 00:38:07,160 And then we have TLS session resumption tickets. 369 00:38:07,580 --> 00:38:16,520 And this was an area that I did not know about and was unaware of until I started doing the research for this talk. 370 00:38:18,000 --> 00:38:27,560 These are basically unblockable cookies that can track you everywhere you go by resuming your previous TLS sessions. 371 00:38:27,560 --> 00:38:34,040 Now, this was done and included in the standards to help reduce session setup time and increase performance. 372 00:38:34,060 --> 00:38:54,660 But by renewing these resumption tickets, which can be done over a long period of time, up to seven days with TLS 1.3, that provides a method to track you across the internet no matter what you're doing and where you're doing it. 373 00:38:54,660 --> 00:39:14,480 So, if you get up in the morning and you are using your phone at home, let's say on your home Wi-Fi, and then you leave and you go out in the world and you use your phone on your cellular carrier with cellular data, you go to an office, back when people used to do that, 374 00:39:14,480 --> 00:39:22,320 go to a coffee shop, back when that was standard to do, any Wi-Fi that you use, they're still able to track you. 375 00:39:22,320 --> 00:39:24,500 You go someplace else, you go back home. 376 00:39:24,500 --> 00:39:39,000 The point is, is that across all of those sessions in all of those multiple ISPs and multiple wireless networks, we're tracking directly back to you because of these session resumption tickets. 377 00:39:40,640 --> 00:39:57,760 The other problem with DNS in the cloud, particularly people outside the US, they're USA-based, USA companies. 378 00:39:57,960 --> 00:40:02,280 So, that means they are subject to getting national security letters. 379 00:40:02,320 --> 00:40:06,600 They're subject to FISA 702 and other laws. 380 00:40:06,900 --> 00:40:18,540 So, that means that the government can go to one of these providers and say, we would like a copy of all of your server logs. 381 00:40:18,540 --> 00:40:21,940 And yes, you may be deleting them, but we don't have to. 382 00:40:23,280 --> 00:40:29,140 And if it's a national security letter, they can't even talk about it or tell anyone. 383 00:40:30,460 --> 00:40:41,830 So, by centralizing into these cloud services, it just makes it easier for governments and law enforcement to get your information. 384 00:40:43,310 --> 00:40:47,910 So, what do we do about all of this? 385 00:40:47,910 --> 00:40:49,110 Next slide. 386 00:40:49,490 --> 00:40:52,210 So, I have some recommendations. 387 00:40:52,790 --> 00:41:06,910 Number one, if you should be running your own internal recursive DNS server for your network, this will give you the absolute best performance for DNS because it's the lowest latency because it's on your network. 388 00:41:07,110 --> 00:41:19,790 Now, the good news is, if you're in a corporate environment, you're probably running Microsoft Active Directory, you're already running a local recursive DNS server, but it's probably not set up well. 389 00:41:20,710 --> 00:41:28,790 You should have this internal recursive DNS server, and you should put all kinds of logging and monitoring on this server. 390 00:41:28,790 --> 00:41:31,870 This is where your logging and monitoring goes here. 391 00:41:32,130 --> 00:41:38,070 Because logging on the server level, of course, it's decrypted those packets. 392 00:41:38,070 --> 00:41:42,670 This allows you to monitor your internal endpoint traffic. 393 00:41:42,670 --> 00:41:43,670 Next slide. 394 00:41:44,610 --> 00:41:55,550 On your firewalls, you set your firewalls to block all TCP and UDP port 53 traffic for all your endpoints out to the world. 395 00:41:55,630 --> 00:41:59,350 So, they can't use regular DNS. 396 00:41:59,590 --> 00:42:03,450 This will force your endpoints to use your internal DNS. 397 00:42:03,610 --> 00:42:12,610 You also want to block TCP port 853 to block DOT on your corporate firewall. 398 00:42:13,310 --> 00:42:21,850 Now, when it comes to DOE, DOE is a lot harder to block because DOE looks just like regular HTTPS traffic. 399 00:42:22,230 --> 00:42:29,590 So, there are some vendors, depending on what kind of firewall that you have, and which vendor, and how much money you're giving them. 400 00:42:29,950 --> 00:42:34,450 They have some rule sets to help enable blocking of DOE. 401 00:42:34,450 --> 00:42:39,950 Some of them work just by blocking the IP addresses of well-known DOE servers. 402 00:42:40,370 --> 00:42:48,270 Others actually use man-in-the-middle proxy functionality built in their solutions, and they may have rule sets. 403 00:42:48,710 --> 00:43:04,210 This is an area where I think a lot of corporate defenders are going to need to invest time specifically to monitor DOE queries via some sort of man-in-the-middle proxy that you're going to have to manage. 404 00:43:05,650 --> 00:43:09,710 And this is what you're going to have to do, ultimately. 405 00:43:10,570 --> 00:43:20,170 You're going to want to set your endpoint configuration standards to disable DOE in any browsers on your endpoints. 406 00:43:20,350 --> 00:43:26,690 And you do have endpoint configuration standards, right, in your organization? 407 00:43:26,750 --> 00:43:30,270 That magical golden image, as they say. 408 00:43:31,010 --> 00:43:38,950 So, you want to make sure that all of your endpoints are configured to talk to your internal recursive servers only. 409 00:43:38,950 --> 00:43:50,370 Yeah, whatever method you have to do that, whether it's DHCP options, group policy objects, static configs, registry keys, whatever, make it so. 410 00:43:50,730 --> 00:43:57,790 You can also set up DOE logging in Firefox if you have to use Firefox. 411 00:44:00,030 --> 00:44:09,830 So, now that you have everybody talking to your internal recursive servers, that's great. 412 00:44:09,830 --> 00:44:14,190 But now you want to protect your traffic from those servers out to the internet. 413 00:44:14,190 --> 00:44:24,610 Because if you don't do that, then it's still possible to watch the data stream coming out of your environment, whether that's home or at work. 414 00:44:24,850 --> 00:44:41,690 So, you can set your internal servers to use an external resolver where it will just automatically forward, as some of the software calls this forwarding, all of those queries to a particular outside server rather than talking to the root servers directly. 415 00:44:42,250 --> 00:45:12,800 So, if you do this, if you have an internal recursive server and you tell it to talk to some external server over an encrypted protocol, whether that's DOT or DNS Crypt, DOE still leaks information, and you use an external server, particularly an external server in a GDPR country that has some actual privacy protection, 416 00:45:12,800 --> 00:45:22,460 and if that server has enough other users, you're going to get a privacy mixer sort of herd protection for your DNS queries. 417 00:45:22,600 --> 00:45:35,160 If there's tens of thousands or hundreds of thousands of people all using a particular server, it's going to be a lot easier, a lot harder rather than that to tie those queries back to you. 418 00:45:35,440 --> 00:45:43,500 The other option that you can do is you can set up your own DOH server in like a VPS. 419 00:45:43,500 --> 00:45:47,760 If you trust DOH, you can also set up your own DOT server. 420 00:45:47,880 --> 00:45:58,460 It's not very hard, and if you are at all handy with a Linux command line, it's the sort of thing that you can do in, you know, a couple hours. 421 00:46:00,780 --> 00:46:20,660 Another recommendation for your, particularly for your corporate networks, but I would also extend this to any power user geek home network, is you want to capture all of the IP addresses of those well-known public DNS resolvers in addition to doing a block at the edge. 422 00:46:21,000 --> 00:46:29,960 And this is because you will be surprised to find out how many devices are using some sort of hard-coded DNS. 423 00:46:30,620 --> 00:46:37,120 In particular, I know Google Chromecasts, they ignore whatever you set in DHCP. 424 00:46:37,580 --> 00:46:41,520 They will use Google DNS always, and there's others. 425 00:46:42,020 --> 00:46:52,280 So, many, many ISPs and a lot of hotel hospitality networks already do this sort of network capturing, and you just haven't noticed. 426 00:46:52,300 --> 00:46:58,860 Many times you think you may be talking to Google Quad 8 or some other server, but you're not. 427 00:46:58,860 --> 00:47:05,140 Just something they've done particularly in hospitality networks to give you that hotspot login. 428 00:47:06,680 --> 00:47:08,240 Next slide. 429 00:47:09,080 --> 00:47:30,440 Now, a recommendation if you're in a small business environment or home environment, you might want to use Quad 9 or Cisco Umbrella or Canadian Shield if you're not as concerned with privacy issues, because all of those services include some malware blocking, 430 00:47:30,440 --> 00:47:42,360 where they get threat intelligence feeds about the latest command and control servers, the latest compromised servers that are feeding downloads of malware. 431 00:47:42,820 --> 00:47:50,940 And so, they are specially set up to not return the correct DNS information for any of those DNS queries. 432 00:47:50,940 --> 00:48:03,020 So, that provides a level of additional protection, particularly in an environment that just simply can't afford anything else. 433 00:48:03,500 --> 00:48:13,140 The other recommendation that I give everyone, particularly, you know, enthusiasts, is you want to look at running something like PyHole. 434 00:48:13,140 --> 00:48:14,460 Next slide. 435 00:48:15,120 --> 00:48:19,000 PyHole was originally meant to run on a Raspberry Pi. 436 00:48:19,000 --> 00:48:19,960 It doesn't have to. 437 00:48:19,960 --> 00:48:23,200 You can run it pretty much on any Linux or in a container. 438 00:48:23,380 --> 00:48:29,420 And it works by blocking advertising servers, known advertising servers. 439 00:48:29,420 --> 00:48:31,120 And it's pretty effective. 440 00:48:31,120 --> 00:48:33,720 It's not perfect, but it's pretty effective. 441 00:48:33,740 --> 00:48:44,040 And you can use PyHole to do your internal resolution and then chain it to external DOH servers or DOT. 442 00:48:45,000 --> 00:48:47,940 So, that's my presentation. 443 00:48:47,940 --> 00:48:51,200 And remember, it's always DNS. 444 00:48:51,240 --> 00:48:52,420 Always. 445 00:48:54,180 --> 00:48:57,880 I will be making this slide deck available for download. 446 00:48:57,880 --> 00:49:03,940 There is a whole bunch of bibliography, about five pages of interesting links. 447 00:49:03,940 --> 00:49:10,160 If you are at all interested in this sort of topic, I recommend that you read much further. 448 00:49:10,400 --> 00:49:22,340 Also, there are various folks in the DNS community, the true legends, like Paul Vixie, who is one of the original authors of Bind, and he's been doing DNS for decades. 449 00:49:22,500 --> 00:49:25,540 And Bert Hubert of PowerDNS. 450 00:49:25,680 --> 00:49:31,380 Those guys have many wonderful talks available on YouTube. 451 00:49:31,520 --> 00:49:34,640 And they are the real experts. 452 00:49:34,640 --> 00:49:39,360 I'm just the guy doing some research bringing it to you folks. 453 00:49:41,420 --> 00:49:43,300 Jim, thank you so much. 454 00:49:43,300 --> 00:49:44,040 That was amazing.