1
00:00:00,000 --> 00:00:01,600
Okay, sounds good.

2
00:00:01,680 --> 00:00:03,560
My name is Matt.

3
00:00:03,700 --> 00:00:08,960
I put this all together because I... so basically...

4
00:00:10,940 --> 00:00:14,380
I guess, you know, brief who it is real quick.

5
00:00:15,180 --> 00:00:16,940
I'm from Louisville, Kentucky.

6
00:00:16,980 --> 00:00:19,420
I've been doing computers for a long time.

7
00:00:21,620 --> 00:00:23,220
I love it.

8
00:00:23,220 --> 00:00:27,480
And lately, the big thing I've been working on are Bogue Bounties.

9
00:00:29,020 --> 00:00:33,020
And that kind of actually got me into this.

10
00:00:33,420 --> 00:00:46,420
So basically, TLDR on this is Network-Based Unauthenticated Memory Disclosure on a SIFT phone.

11
00:00:46,880 --> 00:00:54,840
And I basically played with it and found there's some pretty interesting things that you can pull out of it.

12
00:00:54,900 --> 00:00:56,580
And I'm going to show you here.

13
00:00:56,580 --> 00:00:59,780
It's worked out pretty cool.

14
00:00:59,780 --> 00:01:06,260
The backstory actually goes back to basically DerbyCon 2019.

15
00:01:08,960 --> 00:01:17,420
So, you know, that was the last DerbyCon, of course, and being from Louisville, naturally, I was made sure I was there.

16
00:01:19,320 --> 00:01:23,400
And, you know, they always have a lineup of awesome speakers.

17
00:01:23,680 --> 00:01:43,980
But so the first I guess it must have been Saturday, I was on my way to the first talk of the day and I saw this sign over here across the way and I, you know, basically was like drawn to that thing like a bug is drawn to a zapper or something.

18
00:01:44,520 --> 00:01:51,000
And so I walked in there and literally did not leave for the rest of the day.

19
00:01:51,820 --> 00:01:58,620
And it's so cool, you know, we work on this stuff all the time and hear about the vulnerabilities and deal with them.

20
00:01:58,720 --> 00:02:13,720
But to see all the different stuff laid out there from basically, you know, NASs to routers to light bulbs really struck a chord with me, I guess.

21
00:02:13,720 --> 00:02:21,520
So I think in that sense, IOT Village really achieved what they were shooting for.

22
00:02:23,860 --> 00:02:30,420
So basically, that would have been in September of last year.

23
00:02:30,780 --> 00:02:46,760
And I kind of walked away from that with the notion that I wanted to spend some time in the next year hacking on that stuff, coming up with my own basically, you know, ODAs.

24
00:02:48,880 --> 00:03:01,800
And so about a month later, I was working on a bug bounty and had an interesting scope because it was basically like all IPs, which normally is like hosts and stuff.

25
00:03:01,980 --> 00:03:10,160
And so I thought I would do some recon, you know, follow all the steps, right?

26
00:03:10,160 --> 00:03:11,620
Passive recon first.

27
00:03:11,620 --> 00:03:17,660
And so I started with Shodan, mostly just to get familiar with it, because I hadn't really used it very much.

28
00:03:17,900 --> 00:03:24,800
And actually, I think I had done it wrong, because I didn't end up at the target that I thought I was wanting to end up at.

29
00:03:24,800 --> 00:03:29,940
But I basically ended up just browsing through Shodan for a few hours.

30
00:03:29,940 --> 00:03:37,340
And like, you know, I never was one to like, sit there and watch cat videos for hours.

31
00:03:38,880 --> 00:03:49,000
But once I came across Shodan and all the cool stuff that you can find on there, it's basically like my cat videos, I guess.

32
00:03:49,420 --> 00:03:54,700
And so basically, as I'm browsing through here, I

33
00:04:08,250 --> 00:04:11,830
I'm scrolling down and let's go back.

34
00:04:25,540 --> 00:04:27,680
Yeah, I guess.

35
00:04:38,570 --> 00:04:41,350
I imagine you guys probably can't see that very well.

36
00:04:42,410 --> 00:04:46,910
So I'm working on how I can make that look better.

37
00:04:46,910 --> 00:04:48,710
Give me just one second.

38
00:05:27,770 --> 00:05:28,810
Okay.

39
00:05:35,990 --> 00:05:37,590
There we go.

40
00:05:37,670 --> 00:05:39,550
That's what I was shooting for.

41
00:05:41,110 --> 00:05:42,370
Actually that.

42
00:05:42,470 --> 00:05:43,170
Okay.

43
00:05:43,910 --> 00:05:46,090
So I'm browsing on Shodan.

44
00:05:46,090 --> 00:05:47,050
I come across this.

45
00:05:47,050 --> 00:05:49,570
Obviously, I have a bunch of stuff marked out right now.

46
00:05:49,570 --> 00:05:51,330
So I apologize for that.

47
00:05:52,190 --> 00:05:55,490
But, you know, nothing too crazy here.

48
00:05:55,850 --> 00:05:58,130
And then I keep scrolling down.

49
00:06:09,310 --> 00:06:10,550
Okay.

50
00:06:15,010 --> 00:06:16,850
And basically come to this.

51
00:06:16,850 --> 00:06:27,970
So clearly what's happened here is, you know, the Shodan server is hitting this web server that's running on a phone over and over 401.

52
00:06:27,970 --> 00:06:37,270
And then basically, so they've implemented some security controls, like, you know, basically password lockout.

53
00:06:37,270 --> 00:06:42,990
And then it literally just pukes its guts up on you.

54
00:06:43,870 --> 00:06:45,810
It's like, oh, you failed your password.

55
00:06:46,050 --> 00:06:47,490
And here you go.

56
00:06:47,490 --> 00:06:55,310
So, you know, the first time I looked at this, I actually didn't see anything too interesting.

57
00:06:56,050 --> 00:06:57,910
You know, obviously, that's memory.

58
00:06:58,310 --> 00:06:59,930
Recognize that pretty quickly.

59
00:07:00,190 --> 00:07:05,010
But, you know, I didn't really see a whole lot of impact initially.

60
00:07:05,570 --> 00:07:13,010
And then so I basically monitored it for a few days and started to see, like, some stiff traffic come across.

61
00:07:13,350 --> 00:07:26,410
And so basically, I looked for other devices of this make and model, and there were actually only, like, two or three on the internet.

62
00:07:26,770 --> 00:07:34,910
And they didn't always produce this output when you hit the 403.

63
00:07:34,910 --> 00:07:42,810
So it's kind of like on that particular day, I happened to just kind of stumble upon that particular device on the day that it was having a bad day.

64
00:07:43,310 --> 00:08:03,250
And because I'm, you know, we work on this stuff, and, you know, you're just kind of, you know, you're just kind of looking for some indication of a bug and followed up on it.

65
00:08:03,250 --> 00:08:05,190
And it ended up being kind of cool.

66
00:08:05,410 --> 00:08:18,680
So I actually just I actually watched that for probably, I don't know, a couple months.

67
00:08:18,680 --> 00:08:27,340
And then finally saw enough stuff come across there that I decided, okay, you know, this is obviously a legit vulnerability.

68
00:08:27,420 --> 00:08:32,140
But I want to confirm it first and also see, like, what's the impact.

69
00:08:33,240 --> 00:08:35,860
And so I went ahead and just bought one.

70
00:08:37,880 --> 00:08:39,320
Probably not,

71
00:08:44,050 --> 00:08:46,630
you know, the most efficient way of doing it.

72
00:08:46,630 --> 00:08:57,910
Certainly, you know, I could have tried to get the firmware and loaded it up on QEMU or Pi or something like that.

73
00:08:58,090 --> 00:09:04,610
But in this case, basically, having it already basically worked out for me.

74
00:09:05,250 --> 00:09:10,230
It was just kind of a matter of confirming.

75
00:09:10,350 --> 00:09:15,490
And so I figured I'll go ahead and just buy the device.

76
00:09:15,510 --> 00:09:17,830
I actually ended up so I got it.

77
00:09:17,830 --> 00:09:22,770
And, you know, I mean, I've been working on this here and there for a few months at this point.

78
00:09:24,350 --> 00:09:31,190
And so like, Amazon dropped it off while I was at work, and I came in and tore it open.

79
00:09:31,190 --> 00:09:35,970
And, you know, so within an hour, basically, I've got the thing bricked.

80
00:09:37,370 --> 00:09:44,010
You know, because I was thinking, well, let's make sure we have like the latest firmware on it.

81
00:09:44,090 --> 00:09:49,090
So we're not like reporting vulnerability on some already patched software.

82
00:09:49,270 --> 00:09:54,370
And, and yeah, that device basically never came back.

83
00:09:55,190 --> 00:10:00,710
And so that was a little bit discouraging, especially after, you know, spending like 150 bucks on it.

84
00:10:00,890 --> 00:10:07,490
But you know, I mean, that's, that's part of occupational hazard, I guess.

85
00:10:07,830 --> 00:10:14,790
And part of the fun, of course, you know, took it apart, see what I could do and ribbon cable started breaking.

86
00:10:14,790 --> 00:10:19,150
I was like, wow, okay, we'll revisit this.

87
00:10:19,230 --> 00:10:20,310
And so that's what I did.

88
00:10:20,310 --> 00:10:23,250
I waited probably, you know, a couple few more months.

89
00:10:23,590 --> 00:10:29,490
And, and then finally decided, okay, well, I'll just order another one.

90
00:10:29,490 --> 00:10:33,070
And fortunately, this one came with the latest firmware.

91
00:10:33,070 --> 00:10:36,290
So I didn't have to break it.

92
00:10:36,650 --> 00:10:41,670
And within an hour of opening that one, I had confirmed the bug.

93
00:10:41,730 --> 00:10:44,670
And I actually did it through the browser.

94
00:10:45,220 --> 00:10:56,130
I mean, as far as bugs go, super duper easy to find and to some degree to reproduce.

95
00:11:01,640 --> 00:11:08,500
I mean, so basically, like the first time I powered it up, I opened up Chrome, failed to log in a few times.

96
00:11:08,500 --> 00:11:10,500
And then and then we saw that.

97
00:11:10,720 --> 00:11:17,720
And so I quickly wrote it up, looked up like, hey, does Mitel have a bug bounty program?

98
00:11:17,720 --> 00:11:18,860
That would be cool.

99
00:11:19,080 --> 00:11:20,480
No, they didn't.

100
00:11:20,600 --> 00:11:27,200
But they did have a really good vulnerability disclosure presence, I guess.

101
00:11:27,200 --> 00:11:34,280
And, and clearly, like, you know, they have a program and a team that's handling only those things.

102
00:11:34,780 --> 00:11:37,600
So that worked out good.

103
00:11:37,880 --> 00:11:40,840
So I basically reported it to them immediately.

104
00:11:41,140 --> 00:11:45,260
And let's see, I don't want to get ahead of myself.

105
00:11:48,080 --> 00:11:51,360
And I'm not going to spend too much time on that, because I'm going to show you in person.

106
00:11:51,740 --> 00:11:53,460
Yeah, okay, we're on track here.

107
00:11:53,540 --> 00:12:03,100
So, so, you know, as far as I was concerned, I reproduced it, and I wrote it up, sent it off.

108
00:12:03,100 --> 00:12:06,800
And, and they were very, you know, prompt and professional.

109
00:12:06,800 --> 00:12:11,980
And within a few days, I had a response like, hey, thanks, we'll look into it.

110
00:12:12,200 --> 00:12:18,260
And a couple few weeks went by, and then they emailed me and like, hey, we can reproduce this.

111
00:12:18,760 --> 00:12:30,720
And so like, you know, for a bug bounty hunter, like not being able to reproduce your report is probably one of the worst possible things that could happen.

112
00:12:30,860 --> 00:12:39,280
And so I'm like, oh, man, you know, here I am just some schmuck on the internet, emailing these guys saying, hey, your stuff's broken.

113
00:12:39,280 --> 00:12:41,120
And they're like, no, it's not.

114
00:12:43,560 --> 00:12:48,380
So fortunately, for me, I guess, I was able to figure out what happened there.

115
00:12:48,380 --> 00:12:57,280
And as it turns out, like, I never did get it to reproduce in a browser again, which kind of makes sense, because it's basically just random memory.

116
00:12:57,280 --> 00:13:03,460
And you never really know, like, Chrome is not going to know what to do with a bunch of crazy stuff.

117
00:13:04,080 --> 00:13:09,500
And so like, the first time I did it, it just happened to work in the browser.

118
00:13:09,520 --> 00:13:13,340
But basically, every time after that, I had to use like Netcat.

119
00:13:13,340 --> 00:13:19,720
But using Netcat or Telnet or whatever, it is super duper reproducible.

120
00:13:19,720 --> 00:13:25,200
It's actually kind of impressive how much you can get from it.

121
00:13:26,460 --> 00:13:28,180
So that was pretty cool.

122
00:13:28,180 --> 00:13:32,100
They do have a GPG key or PGP, I guess.

123
00:13:32,960 --> 00:13:38,240
So like, I probably did it the hard way.

124
00:13:40,060 --> 00:13:44,420
But, you know, I literally just use like GPG command line.

125
00:13:44,480 --> 00:14:00,280
So for someone who's used to reporting stuff to companies through bounty program, where they have basically like, you know, a website, HTTPS, they provide all the to upload evidence and tutorials and all that stuff.

126
00:14:00,320 --> 00:14:13,500
So major kudos to Mitel for basically, you know, being willing to hear and having people and the resources dedicated to fixing these problems.

127
00:14:13,500 --> 00:14:18,580
Like, you know, that in and of itself is a huge thing.

128
00:14:18,820 --> 00:14:37,360
One of the takeaways for me, and not necessarily for me, but something that I would like to help some of these companies appreciate is, you know, the burden and really for them the potential for human error.

129
00:14:37,600 --> 00:14:50,140
Because, you know, when you are like manually doing all that, even even understanding asymmetric cryptography, you know, I still have to take a second like, okay, so I'm sending this to them.

130
00:14:50,870 --> 00:14:54,440
They need to be able to open so I got encrypted their public key.

131
00:14:54,820 --> 00:14:58,020
You know, I got a generated private key from their reply.

132
00:14:58,460 --> 00:15:07,720
So that's just a lot of logistical stuff that I think a lot of people may not have the patience or background for.

133
00:15:07,740 --> 00:15:20,460
And so, you know, that could could have some some pretty negative impacts if they basically just, you know, if someone else reporting a bug, failed to do that properly.

134
00:15:20,460 --> 00:15:25,280
And next thing you know, you're sending it over HTTPS or playing on HTTP.

135
00:15:26,340 --> 00:15:29,180
You know, not really cool.

136
00:15:29,400 --> 00:15:35,780
So it ended up actually being, you know, P1, I guess, in my terms.

137
00:15:39,640 --> 00:15:41,440
So pretty interesting.

138
00:15:41,700 --> 00:15:43,920
ModCell is a CVE naming authority.

139
00:15:44,240 --> 00:15:45,040
Oh, no.

140
00:15:45,240 --> 00:15:48,440
Oh, yeah, PowerPoint, corrected that for me again.

141
00:15:48,440 --> 00:15:56,660
So basically, one of the things that was cool for me in this experience was learning the process for CVE.

142
00:15:57,100 --> 00:16:05,180
And I actually had another program, another bug through a natural bounding program, pretty much simultaneously.

143
00:16:05,480 --> 00:16:12,080
And it was interesting because like there, that one was not a CNA, Mitel is a CNA.

144
00:16:12,080 --> 00:16:25,540
And so walking that path and understanding the different roles, and how you do it, and how you coordinate it, it's not very hard at all.

145
00:16:25,540 --> 00:16:30,780
And MITRE basically has like a PowerPoint that walks you through everything.

146
00:16:31,740 --> 00:16:36,040
But you know, it's kind of cool to go through the experience and understand it.

147
00:16:36,080 --> 00:16:36,920
Okay.

148
00:16:37,440 --> 00:16:40,880
So now we'll do some fun stuff.

149
00:16:46,940 --> 00:16:47,680
Okay.

150
00:16:59,870 --> 00:17:01,110
Okay, I'm sorry.

151
00:17:01,150 --> 00:17:02,150
I'm going to switch this off.

152
00:17:02,150 --> 00:17:02,850
My bad.

153
00:17:26,480 --> 00:17:28,440
I guess I have to maximize this window.

154
00:17:41,640 --> 00:17:42,440
There we

155
00:17:47,170 --> 00:17:49,790
go.

156
00:17:58,840 --> 00:17:59,640
Okay.

157
00:18:04,660 --> 00:18:05,860
We'll see how this goes.

158
00:18:05,860 --> 00:18:10,240
And if I get too annoying on top of it, I will swagger.

159
00:18:10,680 --> 00:18:17,360
Okay, so basically, I have like, have one of these phones right here.

160
00:18:17,500 --> 00:18:24,200
And so, okay.

161
00:18:26,490 --> 00:18:27,970
So if we just

162
00:18:32,700 --> 00:18:41,120
basically, okay, plain old as vanilla as you can get, HTTP request, write that to like a text file.

163
00:18:41,960 --> 00:18:45,740
And then cap that, type it to this

164
00:18:49,240 --> 00:18:50,580
non -porting.

165
00:18:51,300 --> 00:18:53,060
Okay, 401 unauthorized.

166
00:18:53,060 --> 00:18:56,720
That's perfectly acceptable, normal, expected.

167
00:18:56,940 --> 00:18:58,540
We'll do that a few times.

168
00:18:58,560 --> 00:19:00,620
I don't remember exactly how many it is.

169
00:19:00,620 --> 00:19:03,600
Okay, probably about that many, five, something like that.

170
00:19:03,600 --> 00:19:17,340
Which really, so like, you know, this came about I always think it's interesting when you see like, multiple level deep failure of code.

171
00:19:17,400 --> 00:19:22,840
And so like, this one is especially interesting, because it's in an actual security control.

172
00:19:22,840 --> 00:19:27,700
And so like, I think there's really a lesson to be learned for all of us.

173
00:19:28,200 --> 00:19:59,820
You know, whether you're a penetration tester, or building a system, or software developer, or, you know, on like the IT security compliance side of things, you know, don't just check the box, push it a little bit, because no one would think to set up these particular circumstances to see what happens.

174
00:19:59,820 --> 00:20:06,720
But those are exactly the types of things that lead to some of the most impactful vulnerabilities.

175
00:20:07,000 --> 00:20:11,480
And, you know, I mean, there's all sorts of really good resources on that.

176
00:20:14,120 --> 00:20:23,100
Like, so the other day, I was like rewatching, I think, Sammy Kamkar's 2016 talk at AppSecCollege.

177
00:20:23,100 --> 00:20:31,860
And he basically, it's just very interesting to listen to someone with his level of experience, because he's explaining his thought process.

178
00:20:31,860 --> 00:20:35,940
And he's like, so I asked myself, what would happen if I did this?

179
00:20:35,940 --> 00:20:37,780
What would, what if I did this?

180
00:20:37,780 --> 00:20:39,280
Could I make it do that?

181
00:20:39,340 --> 00:21:00,100
And, and that's the kind of basically, like structured, but creative, and out of the box thinking that, that it takes to, to find impactful vulnerabilities, and not end up like with a whole bunch of duplicates and get frustrated with the whole process.

182
00:21:00,160 --> 00:21:04,980
Okay, so at this point, I've basically locked out the account, and it's locked up.

183
00:21:05,460 --> 00:21:05,940
Yeah.

184
00:21:06,480 --> 00:21:13,980
So, so I've written a script here at this point, make it real easy.

185
00:21:14,860 --> 00:21:15,760
Give me a second.

186
00:21:16,760 --> 00:21:18,160
See what that is.

187
00:21:21,140 --> 00:21:28,920
Okay, some of that has to do with being able to make it so people can call in.

188
00:21:28,920 --> 00:21:34,060
But basically, the key thing there, you can see, I guess you can see here, right?

189
00:21:35,420 --> 00:21:40,820
Same thing I just did, but we're doing it 20 million times or something like that.

190
00:21:41,020 --> 00:21:47,860
Okay, so what I'm going to do, this is the number here.

191
00:21:47,860 --> 00:21:50,200
Okay, so I'm going to fire that off.

192
00:21:50,820 --> 00:21:54,920
That should just basically start spilling its guts.

193
00:22:01,440 --> 00:22:03,540
Yeah, it's ringing right here.

194
00:22:11,190 --> 00:22:11,710
Okay.

195
00:22:11,710 --> 00:22:16,510
I mean, I have literally sacrificed one of these devices to the demo gods.

196
00:22:16,630 --> 00:22:22,650
So I fully expect that this is going to work right off the bat.

197
00:22:25,730 --> 00:22:26,990
Let's see.

198
00:22:31,390 --> 00:22:32,650
Obviously not.

199
00:22:42,270 --> 00:22:43,070
Okay.

200
00:22:48,560 --> 00:22:49,960
Maybe then we did.

201
00:22:50,060 --> 00:22:52,540
Let's just take another look at that real quick.

202
00:23:16,790 --> 00:23:18,830
Let's take a look and see.

203
00:23:20,770 --> 00:23:22,390
We're getting something.

204
00:23:24,210 --> 00:23:26,170
That should be good.

205
00:23:26,270 --> 00:23:26,930
Okay.

206
00:23:26,930 --> 00:23:33,230
Sometimes, you know, you totally mess up your shell.

207
00:23:36,740 --> 00:23:40,160
So let me just re-open the new shell today.

208
00:24:35,370 --> 00:24:39,250
You know, this wouldn't be fun if it worked immediately, I guess.

209
00:24:58,060 --> 00:25:00,020
We'll simplify it for a second.

210
00:25:14,160 --> 00:25:15,440
Oh my goodness.

211
00:25:15,440 --> 00:25:16,520
I'm such a doofus.

212
00:25:16,520 --> 00:25:17,660
I'm so sorry.

213
00:25:18,340 --> 00:25:20,700
It is literally doing exactly what it's supposed to.

214
00:25:20,700 --> 00:25:21,640
I apologize.

215
00:25:24,180 --> 00:25:29,520
I forgot that I changed it up.

216
00:25:29,520 --> 00:25:30,020
Okay.

217
00:25:30,400 --> 00:25:35,280
So that is, at this point, basically just pushing to a file.

218
00:25:37,750 --> 00:25:41,270
And I'm going to open another window and we're going to monitor that file.

219
00:26:00,010 --> 00:26:01,010
Cool.

220
00:26:01,690 --> 00:26:07,450
And, okay, so we will, this guy just created a script.

221
00:26:07,710 --> 00:26:09,030
It's going to sit there.

222
00:26:11,090 --> 00:26:12,090
So,

223
00:26:16,820 --> 00:26:19,580
just making sure I don't have anything where to go off.

224
00:26:19,580 --> 00:26:20,160
Okay.

225
00:26:20,580 --> 00:26:21,220
Okay.

226
00:26:21,220 --> 00:26:25,060
So if nothing is happening, it doesn't do anything.

227
00:26:25,060 --> 00:26:26,880
It just sits there and does nothing.

228
00:26:26,880 --> 00:26:35,650
So when I initially got it, basically, uh, how I confirmed it was just go in here and play with stuff.

229
00:26:35,790 --> 00:26:42,610
And it was kind of neat because I would start to see, kind of going to do a bunch of stuff.

230
00:27:35,390 --> 00:27:36,870
I didn't say a lot.

231
00:27:37,550 --> 00:27:38,130
Yeah.

232
00:27:38,130 --> 00:27:38,570
Wow.

233
00:27:38,570 --> 00:27:40,090
That's an incredible amount of stuff.

234
00:27:40,090 --> 00:27:40,570
Okay.

235
00:27:40,570 --> 00:27:40,830
Yeah.

236
00:27:40,830 --> 00:27:41,570
So there we go.

237
00:27:41,570 --> 00:27:42,690
That's what I was expecting.

238
00:27:42,690 --> 00:27:45,870
Like literally the thing is just puking its guts up.

239
00:27:46,430 --> 00:27:50,030
And, uh, you know, it's kind of neat.

240
00:27:50,030 --> 00:28:11,290
So like, you know, I've seen CVEs come across, like I subscribed to the RSS feed and, um, sometimes like memory disclosure can be tricky to, to exploit, to actually get something valuable because it's, you know, a lot of times you don't have control over exactly which,

241
00:28:11,290 --> 00:28:13,710
uh, memory space you're going to get.

242
00:28:13,710 --> 00:28:23,910
And so one thing that's kind of neat about this is, uh, just how easy it is to get stuff.

243
00:28:23,910 --> 00:28:24,650
It's kind of funny.

244
00:28:24,650 --> 00:28:26,030
That's why I named this talk.

245
00:28:26,030 --> 00:28:41,950
What I did, because it's like, basically other than me, like breaking the device, um, everything just like lined up the stars aligned and, you know, at the end of the day, the world's a safer place.

246
00:28:43,450 --> 00:28:48,870
So what, what I thought was really cool one time is I was sitting in here and I like changed the password.

247
00:28:48,870 --> 00:28:52,770
I'm in the admin portal and, uh, and I saw it right there.

248
00:28:52,870 --> 00:28:55,730
I'm like, okay, well, there's secrets right there.

249
00:28:56,010 --> 00:29:12,470
And, um, uh, one of my slides, you can't really read it very well, but basically, um, when you configure the SIP endpoint, uh, you had, you know, you have to give your credentials and, uh, I could see those in the dump as well.

250
00:29:12,990 --> 00:29:13,790
Okay.

251
00:29:14,010 --> 00:29:20,870
So at this point, what I'll do, so I've got a couple of numbers registered to this.

252
00:29:20,990 --> 00:29:46,810
Um, so what I'll do is since we've done a bunch of stuff, I'm going to reboot this phone and, uh, that basically will, uh, basically like wipe its, uh, RAM and, uh, also let me get to the web interface to change this phone number while that's rebooting.

253
00:29:47,670 --> 00:29:49,830
I'll talk about a couple of things here.

254
00:30:14,820 --> 00:30:15,460
Okay.

255
00:30:15,460 --> 00:30:15,940
Yeah.

256
00:30:16,300 --> 00:30:31,290
So obviously there's not a whole lot of technical, uh, chops being, uh, put on display for finding this one.

257
00:30:31,670 --> 00:30:35,130
Let me kill this before it locks out this phone again.

258
00:30:38,510 --> 00:30:39,450
Okay.

259
00:30:39,450 --> 00:30:53,630
Uh, so, but there, but what this did do was presents a lot of opportunities, uh, to, for like, I guess, lessons that I already knew, but kind of reinforced them and some insights about things that I had not really thought about.

260
00:30:53,630 --> 00:30:59,850
And so, you know, we have all these sayings, like, you know, hacking stuff and funding for profit.

261
00:31:00,510 --> 00:31:08,230
Um , and, and I've used that myself and, you know, sounds cool, but never really thought about it, the actual words.

262
00:31:08,330 --> 00:31:29,510
And, um, but it kind of hit me the other day, I was reading some, you know, someone's Twitter or something, and basically people just like going off and, uh, you know, just really struck me, uh, that, I think sometimes we need to step back and see where we're at,

263
00:31:29,510 --> 00:31:34,990
how we got here and where we're going and really why we're doing what we're doing.

264
00:31:35,350 --> 00:31:53,550
Um, because not that long ago, and even still today, you, you know, a security researcher would find something like this and reach out to a company and either not get a response or get sued.

265
00:31:53,830 --> 00:32:19,850
And so for me to be able to just reach out to them and, you know, basically just browse my way to a 10 and 9.8 CVSS bug on Shodan with absolutely no intent, uh, and then find the company and they have a, uh, a disclosure program.

266
00:32:19,850 --> 00:32:20,910
They want to hear about it.

267
00:32:20,910 --> 00:32:22,650
They're very friendly and professional.

268
00:32:23,230 --> 00:32:25,290
And, uh, and then they fix it.

269
00:32:25,290 --> 00:32:30,390
And, uh, and it all just like went so swimmingly like that.

270
00:32:31,150 --> 00:32:34,190
That didn't just happen out of nowhere.

271
00:32:34,210 --> 00:32:49,750
Uh, there was a whole like industry-wide, I don't know what you want to call it, but you know, issue 10 years ago, maybe not that long ago.

272
00:32:49,750 --> 00:32:53,330
And, uh, okay.

273
00:32:53,970 --> 00:32:58,230
Where like the whole question of vulnerability disclosure was a huge deal.

274
00:32:58,230 --> 00:33:08,090
And basically it got to the point where, where researchers are like, well, you know, we all love technology and we all want the technology that you're building.

275
00:33:08,090 --> 00:33:08,930
We all need it.

276
00:33:08,930 --> 00:33:16,570
I think like COVID for example, just shows how important technology is to humankind at this point.

277
00:33:17,370 --> 00:33:26,250
And, you know, I mean, as bad as it's been, how much worse would it have been, would it be, it's still going on, obviously.

278
00:33:26,470 --> 00:33:40,190
Uh, you know, if, uh, if the people who are working from home couldn't work from home, that's not to minimize the impact that it has had, but just to say like, you know, I guess it could actually be worse.

279
00:33:40,190 --> 00:33:52,450
And so like these companies, you know, SIP phones, for example, I mean, that is a key driver to the ability to work from home and have a distributed workforce.

280
00:33:52,450 --> 00:34:01,930
And so like, we rely on not only these things working and not only them being secure, but like the people's trust in them.

281
00:34:01,930 --> 00:34:11,010
Like that's the worst possible thing that could happen is if people just stop trusting the internet, uh, that that's going to be a problem.

282
00:34:11,130 --> 00:34:17,230
And no one is going to protect it or can protect it.

283
00:34:17,230 --> 00:34:21,310
So like it falls on this relatively tiny community.

284
00:34:21,910 --> 00:34:31,650
And, uh, and so yeah, I mean, we, it's a very high paying industry and about bug bounties.

285
00:34:31,650 --> 00:34:38,950
Like I was watching the, uh, interview between mayonnaise, I don't know his real name and the homestead the other day.

286
00:34:38,950 --> 00:34:45,590
And like, so he started doing bug bounties late 2018 and has already made over a million dollars.

287
00:34:45,630 --> 00:34:49,010
I mean, that's amazing.

288
00:34:50,390 --> 00:35:04,550
But at the same time, it's important to, uh, to understand where we came from and not be so caught up in that stuff that we're basically going off on Twitter because somebody didn't pay us as much as we thought they should pay us for above.

289
00:35:04,790 --> 00:35:06,810
And, and that doesn't help anybody.

290
00:35:07,230 --> 00:35:12,770
Um, so I think like sometimes you got to do it for fun and sometimes you do it for profit.

291
00:35:12,930 --> 00:35:15,110
In this case, I did it for fun.

292
00:35:15,210 --> 00:35:20,990
And, uh, you know, the other day I was basically just like, what else can I do with this?

293
00:35:21,150 --> 00:35:23,850
And I thought this might be kind of cool.

294
00:35:23,850 --> 00:35:31,350
So actually the biggest issue I had with it was my internet connection is going through carrier grade NAT.

295
00:35:31,350 --> 00:35:33,710
So my public IP is not actually public.

296
00:35:33,710 --> 00:35:37,610
So getting the SIP traffic to me has been a debacle.

297
00:35:37,810 --> 00:35:52,390
Uh, but I actually, uh, applied something I picked up from the, uh, so hopelessly broken lab I was doing like last year with, uh, you know, tunneling stuff through SSH.

298
00:35:52,390 --> 00:36:06,770
And so that's what I'm doing right now is basically UDP SIP traffic is hitting a Twilio and going to AWS through an SSH session that I created outbound and getting forwarded all to this phone.

299
00:36:06,770 --> 00:36:10,270
So, uh, basically let

300
00:36:17,300 --> 00:36:18,780
me get a couple of things set up.

301
00:36:19,180 --> 00:36:23,640
What I was going to do is, uh, I'll post a number.

302
00:36:23,640 --> 00:36:30,160
I've got like scripts and everything, just grepping stuff out to mask phone numbers and stuff.

303
00:36:30,300 --> 00:36:41,780
But, uh, if you call and, uh, you saw how fast that's coming up here, it's grabbing the phone numbers and, uh, it's going to show the last four digits.

304
00:36:41,780 --> 00:36:44,320
And I think like the first one or something.

305
00:36:44,320 --> 00:37:00,160
And so, uh, if you call this number, I put up there and your number shows up on this board over here somewhere, uh, ping me after this and just tell me the remaining digits and your email address.

306
00:37:00,160 --> 00:37:07,960
And I'll send you a, uh, Kindle, like a redemption code for IOT hackers handbook.

307
00:37:08,440 --> 00:37:11,260
Um, okay.

308
00:37:15,030 --> 00:37:16,890
So I'm going to turn that off for one second.

309
00:37:17,050 --> 00:37:25,050
I'm going to mute myself so you don't hear me like clacking these keys and then, uh, just get a couple of things set up here and we'll be all set.

310
00:37:37,200 --> 00:37:37,700
Yeah.

311
00:37:37,760 --> 00:37:44,660
So I think I put this out there, but like only like the first five people can I do that for.

312
00:37:44,940 --> 00:37:45,580
Yeah.

313
00:37:46,020 --> 00:37:47,340
I'm not making any sense.

314
00:38:10,420 --> 00:38:10,420
Okay.

315
00:38:33,750 --> 00:38:34,650
There we go.

316
00:38:34,650 --> 00:38:37,570
At least nine, like you see what I'm doing here.

317
00:38:37,710 --> 00:38:38,750
Nothing crazy.

318
00:38:40,670 --> 00:38:41,190
Okay.

319
00:38:41,190 --> 00:38:42,730
It's going to clear up this one.

320
00:38:42,730 --> 00:38:43,410
Okay.

321
00:39:15,650 --> 00:39:15,850
My

322
00:39:29,990 --> 00:39:45,950
bad.

323
00:39:50,790 --> 00:39:54,110
You ever have yourself like double muted on a meeting or something?

324
00:39:54,110 --> 00:39:55,790
I basically just did that to myself.

325
00:39:55,790 --> 00:39:56,770
I'm sitting here talking to you.

326
00:39:56,770 --> 00:39:57,670
My bad.

327
00:40:12,450 --> 00:40:15,670
So I do have it on just basically ready to fire off.

328
00:40:50,330 --> 00:40:52,310
Well,

329
00:41:51,470 --> 00:41:53,610
that's actually the one we care about anyway.

330
00:41:53,710 --> 00:41:56,890
So that

331
00:42:02,500 --> 00:42:05,840
should work.

332
00:43:16,650 --> 00:43:18,250
Okay.

333
00:44:44,610 --> 00:44:53,530
And if anybody is watching that window, they probably realize it's literally not doing anything.

334
00:45:02,540 --> 00:45:02,940
Let

335
00:45:25,720 --> 00:45:32,940
me just hide that window so I don't dump people's phone numbers out.

336
00:47:02,770 --> 00:47:04,430
It looks like we're close.

337
00:47:04,430 --> 00:47:05,890
We're at the time here.

338
00:47:05,890 --> 00:47:09,990
So Sam, I guess you just let me know if you want to stop.

339
00:47:09,990 --> 00:47:12,090
But basically, we've got

340
00:47:18,690 --> 00:47:19,650
Yeah.

341
00:47:23,550 --> 00:47:24,030
So

342
00:47:33,360 --> 00:47:35,480
No, Matt, you're all good.

343
00:47:35,480 --> 00:47:38,340
If you want to sort of show anything off.

344
00:47:38,340 --> 00:47:39,640
I mean, like you're the last talk.

345
00:47:39,640 --> 00:47:41,400
So don't worry.

346
00:47:41,400 --> 00:47:42,960
I can keep going for a while.

347
00:47:42,960 --> 00:47:49,480
I mean, there's people there and you get time.

348
00:47:49,500 --> 00:47:50,280
That's cool.

349
00:47:51,240 --> 00:47:52,140
So I do.

350
00:47:52,140 --> 00:47:54,040
I mean, I can see this person's called right now.

351
00:47:54,040 --> 00:47:59,920
So, you know, I think I'm not in the discord at this moment.

352
00:47:59,920 --> 00:48:01,900
I was having some problem with it.

353
00:48:02,000 --> 00:48:03,120
But just ping me.

354
00:48:03,120 --> 00:48:10,280
I'll hop on there as soon as we get off here and give me your email address and I'll shoot that over to you.

355
00:48:11,700 --> 00:48:12,580
Yeah.

356
00:48:14,920 --> 00:48:15,360
06275

357
00:48:18,450 --> 00:48:21,430
might be the only one.

358
00:48:21,490 --> 00:48:22,170
Let's see.

359
00:48:23,930 --> 00:48:25,010
That would explain.

360
00:48:37,080 --> 00:48:37,960
57702.

361
00:48:39,700 --> 00:48:44,860
So if these numbers are your phone numbers, you know, ping me.

362
00:48:44,860 --> 00:48:50,540
So that was that 293310.

363
00:49:12,180 --> 00:49:13,460
It's kind of funny.

364
00:49:13,460 --> 00:49:24,240
So like, because of the way I had to get that stuff working through SSH tunnels, it's basically does not understand that you hung up.

365
00:49:35,350 --> 00:49:38,570
Well, that was three.

366
00:49:38,570 --> 00:49:39,790
I'll go through here.

367
00:49:39,790 --> 00:49:48,830
And if there are two more unique ones, I will post that.

368
00:49:49,250 --> 00:49:49,970
There's one right there.

369
00:49:50,010 --> 00:49:51,090
25120.

370
00:49:58,220 --> 00:50:06,140
And actually, I thought this may happen if you are actually using like a SIP trunk that's not PSTN source.

371
00:50:08,740 --> 00:50:14,580
So yeah, yeah, I put it together kind of cheap and fast.

372
00:50:15,560 --> 00:50:20,040
And you know how they say you can have things like cheap, fast and good pick two.

373
00:50:20,040 --> 00:50:21,860
This is cheap and fast.

374
00:50:26,450 --> 00:50:27,930
One second.

375
00:50:28,030 --> 00:50:32,310
If that's legit it.

376
00:51:59,530 --> 00:52:02,490
I believe that's anonymous.

377
00:52:03,010 --> 00:52:06,130
So I mean, if that is legitimately you, that's cool.

378
00:52:07,030 --> 00:52:09,490
Well, okay.

379
00:52:21,960 --> 00:52:22,920
60918.

380
00:52:24,100 --> 00:52:25,640
I think that's five.

381
00:52:26,580 --> 00:52:30,920
So if any of those ring a bell to you, then just ping me after this.

382
00:52:31,560 --> 00:52:33,920
I'll send those codes over to you.

383
00:52:34,060 --> 00:52:37,460
And if that ends up being six, that's cool too.

384
00:52:38,100 --> 00:52:38,720
Okay.

385
00:52:42,240 --> 00:52:44,040
So let's switch.

386
00:52:46,700 --> 00:52:58,590
But actually, it was a little bit, I'm kind of glad it worked out like that, even though it was a little unplanned.

387
00:52:59,070 --> 00:53:05,050
I was, you know, based on what my testing, I was a little afraid like five people will call just like that.

388
00:53:05,190 --> 00:53:07,170
We wouldn't even be able to find them.

389
00:53:07,170 --> 00:53:08,670
So, okay.

390
00:53:10,210 --> 00:53:14,290
So I think I went through some of this already, most of this.

391
00:53:17,970 --> 00:53:20,270
But show Dan dorking.

392
00:53:20,450 --> 00:53:25,750
And someone mentioned a similar service to me the other day and I can't remember it.

393
00:53:26,010 --> 00:53:36,870
But a lot of times I think we go and we use these tools when we have found a vulnerability and we want to see the scale of the impact.

394
00:53:38,350 --> 00:53:46,310
I propose that you could, well, I mean, what this demonstrates is like, there's a lot of untapped data out there.

395
00:53:48,490 --> 00:53:50,510
And they have an API.

396
00:53:51,170 --> 00:54:03,690
And so it's like, if you're wanting to get into IoT, and don't want to go spend $142 on a phone and then break it and buy another one, which is completely understandable.

397
00:54:04,630 --> 00:54:20,590
One potential way to pick a target would be to use these APIs and, you know, structure a search that maybe, you know, searches for something like a bunch of 401s and then something unexpected.

398
00:54:20,590 --> 00:54:34,840
Or, you know, if you know a particular request, you know, the results for a certain type of device are typically of a certain size, search for things that are outside that realm.

399
00:54:35,780 --> 00:54:37,120
Excuse me.

400
00:54:42,620 --> 00:54:43,740
Okay.

401
00:54:43,980 --> 00:54:49,480
So yeah, this is kind of something like, I've just applied.

402
00:54:49,480 --> 00:54:53,280
So I've been doing computers professionally for 20 something years.

403
00:54:53,540 --> 00:54:56,280
And, you know, my whole life, I'm a geek at heart, I love it.

404
00:54:56,280 --> 00:54:57,660
And I do it because I love it.

405
00:54:57,660 --> 00:55:00,260
And I would be doing it even if I wasn't getting paid.

406
00:55:02,480 --> 00:55:29,940
And I've noticed over the years, whether it's in selling hardware, software, networking, or services, when you are invested in something, because you care about it, and, traditional salesperson, and just having fun, you know, money follows that, and it builds trust.

407
00:55:29,960 --> 00:55:42,060
So I would propose to people, like, especially people who are trying to get into the industry, and maybe see like, wow, look at all these people doing all this cool stuff, making all this money, this is so cool, I want to get me some of that.

408
00:55:43,640 --> 00:55:48,560
There's a whole lot behind the scenes that you're not seeing when you see that.

409
00:55:49,020 --> 00:55:56,520
And so it's very easy to get frustrated if you have like the wrong, you know, you're focusing on the wrong thing.

410
00:55:56,520 --> 00:56:02,460
And so hack for fun, and the profits will come.

411
00:56:02,460 --> 00:56:04,220
I truly believe that.

412
00:56:04,320 --> 00:56:14,220
And the only other thing on here that I want to point out is we really do need to praise these companies like Mitel.

413
00:56:14,320 --> 00:56:21,640
And there was someone else this week who gave a talk, and he's like, you know, this company was spectacular.

414
00:56:22,480 --> 00:56:25,320
I mean, that's not nothing.

415
00:56:25,600 --> 00:56:37,140
And really, like, you could put companies on like the, my goodness, the grief scale, right?

416
00:56:37,140 --> 00:56:40,160
Like, over here, you have denial, over here, you have acceptance.

417
00:56:40,160 --> 00:56:42,860
And 10 years ago, everyone was in denial.

418
00:56:42,860 --> 00:56:50,900
And if you went to them with it, they just preemptively sued you out of fear and denial.

419
00:56:51,280 --> 00:56:54,260
And there's still people there, still companies at that place.

420
00:56:54,260 --> 00:56:58,960
And then you have companies who are like, hey, you know, come hack us.

421
00:56:58,960 --> 00:57:03,020
And if you write us a good report, we'll pay you even if you don't find bugs.

422
00:57:03,720 --> 00:57:06,680
Because we care, and we want our stuff to work right.

423
00:57:07,820 --> 00:57:10,480
And you know, there's people everywhere in between.

424
00:57:10,480 --> 00:57:24,220
And while we as, you know, even if you're not in this for like bug bounties, but you're in it for whether it's just the good of the internet, or pen testing as a career, whatever it may be.

425
00:57:25,520 --> 00:57:41,580
There are some elements that are similar to like traditional IT jobs, where like, you don't just walk into a company and be like, hey, you know, let's replace all your computers and Windows upgraded to 2019.

426
00:57:41,580 --> 00:57:49,560
And all this, you know, exchange in the cloud tomorrow, you have to build a relationship and trust and understand them.

427
00:57:49,700 --> 00:57:53,120
And there's a whole bunch of stuff that goes into that.

428
00:57:53,120 --> 00:58:05,380
And I think if you approach this industry with that same attitude, where we'll get to a place where we understand that like, software vulnerabilities are going to happen.

429
00:58:05,620 --> 00:58:14,200
It doesn't matter, like what controls you have in place, human beings are writing it, and it is only human to make mistakes.

430
00:58:14,420 --> 00:58:19,180
And we don't want to like stigmatize it.

431
00:58:19,180 --> 00:58:22,160
Actually, I think we should praise people who are doing it.

432
00:58:22,260 --> 00:58:31,340
And, and really where we're at right now is there's basically like a set of companies who are like subsidizing this, this burgeoning industry.

433
00:58:31,340 --> 00:58:37,040
I realize it's, you know, quite a several years old, but in the grand scheme of things, it's still pretty new.

434
00:58:38,260 --> 00:58:44,200
And so we need to move these companies from over here to over here.

435
00:58:44,200 --> 00:58:45,940
And that's going to take time.

436
00:58:46,140 --> 00:58:57,600
And I can, I can think of one scenario, in my own experience, where basically, like I reported something to a company, clearly was an impactful bug.

437
00:58:58,040 --> 00:58:59,940
They didn't see it that way.

438
00:59:00,380 --> 00:59:02,640
You know, I didn't, I was like, okay, cool.

439
00:59:02,640 --> 00:59:03,680
You know, that's cool.

440
00:59:04,380 --> 00:59:05,980
Yeah, I didn't push it.

441
00:59:06,120 --> 00:59:09,280
I haven't returned to their program since then.

442
00:59:09,280 --> 00:59:19,040
But I actually noticed like a few weeks ago, maybe a month ago, you know, now they're doing things to try to attract researchers to their program.

443
00:59:19,040 --> 00:59:25,140
So what I think is happening there is like they probably realize yeah, we're not getting much traffic.

444
00:59:26,220 --> 00:59:31,260
And so they're slowly moving over in this way.

445
00:59:31,420 --> 00:59:33,280
And, you know, it takes time.

446
00:59:33,280 --> 00:59:44,360
And if you're getting upset going off on Twitter, or, you know, just being unprofessional, not only is that going to hurt you, but that's going to hurt the whole industry.

447
00:59:44,420 --> 00:59:49,900
Because, I mean, you represent this industry to those people.

448
00:59:49,900 --> 00:59:59,180
And, and that's that can be dangerous for us all, because really, at the end of the day, we do need all this stuff to work.

449
00:59:59,540 --> 01:00:08,400
And I mean, like, the Great Firewall of America is now a topic of discussion.

450
01:00:08,400 --> 01:00:11,160
I mean, that that's like a vote of no confidence in the internet.

451
01:00:11,200 --> 01:00:13,000
That's concerning.

452
01:00:13,000 --> 01:00:17,160
And we need to not let that happen.

453
01:00:17,220 --> 01:00:19,300
And okay.

454
01:00:20,180 --> 01:00:22,540
So I'm 15 over.

455
01:00:22,540 --> 01:00:23,680
So that's cool.

456
01:00:23,940 --> 01:00:25,460
Thanks for the extra time.

457
01:00:25,460 --> 01:00:29,760
Ping me afterwards if any of those numbers were yours.

458
01:00:30,020 --> 01:00:31,680
Thanks for your time.

459
01:00:31,960 --> 01:00:33,200
Happy DEF CON.