start	end	text
0	8960	Okay, sounds good. My name is Matt. I put this all together because I... so basically...
10940	14380	I guess, you know, brief who it is real quick.
15180	19420	I'm from Louisville, Kentucky. I've been doing computers for a long time.
21620	27480	I love it. And lately, the big thing I've been working on are Bogue Bounties.
29020	40880	And that kind of actually got me into this. So basically, TLDR on this is
42660	50480	Network-Based Unauthenticated Memory Disclosure on a SIFT phone. And I basically played with it
50480	55820	and found there's some pretty interesting things that you can pull out of it. And I'm going to
55820	63720	show you here. It's worked out pretty cool. The backstory actually goes back to basically DerbyCon
65220	72700	2019. So, you know, that was the last DerbyCon, of course,
72700	77420	and being from Louisville, naturally, I was made sure I was there.
79320	85080	And, you know, they always have a lineup of awesome speakers. But so the first
85820	90600	I guess it must have been Saturday, I was on my way to the first talk of the day and I saw this
90600	99280	sign over here across the way and I, you know, basically was like drawn to that thing like
100440	109060	a bug is drawn to a zapper or something. And so I walked in there and literally did not leave
109060	116160	for the rest of the day. And it's so cool, you know, we work on this stuff all the time and
116160	121740	hear about the vulnerabilities and deal with them. But to see all the different stuff laid out there
123300	129280	from basically, you know, NASs to routers to light bulbs really
131900	136700	struck a chord with me, I guess. So I think in that sense,
137340	141520	IOT Village really achieved what they were shooting for.
143860	150960	So basically, that would have been in September of last year. And
153340	160980	I kind of walked away from that with the notion that I wanted to spend some time in the next year
161720	166760	hacking on that stuff, coming up with my own basically, you know, ODAs.
168880	175940	And so about a month later, I was working on a bug bounty and had an interesting scope because
175940	184800	it was basically like all IPs, which normally is like hosts and stuff. And so I thought I would
185780	193040	do some recon, you know, follow all the steps, right? Passive recon first. And so I started with
193040	197660	Shodan, mostly just to get familiar with it, because I hadn't really used it very much.
197900	203060	And actually, I think I had done it wrong, because I didn't end up at the target that I thought I was
203060	209940	wanting to end up at. But I basically ended up just browsing through Shodan for a few hours.
209940	217340	And like, you know, I never was one to like, sit there and watch cat videos for hours.
218880	225920	But once I came across Shodan and all the cool stuff that you can find on there,
225920	234700	it's basically like my cat videos, I guess. And so basically, as I'm browsing through here, I
248250	267680	I'm scrolling down and let's go back. Yeah, I guess.
278570	281350	I imagine you guys probably can't see that very well.
282410	288710	So I'm working on how I can make that look better. Give me just one second.
327770	328810	Okay.
335990	339550	There we go. That's what I was shooting for.
341110	347750	Actually that. Okay. So I'm browsing on Shodan. I come across this. Obviously,
347750	351330	I have a bunch of stuff marked out right now. So I apologize for that.
352190	358130	But, you know, nothing too crazy here. And then I keep scrolling down.
369310	380030	Okay. And basically come to this. So clearly what's happened here is, you know, the Shodan
380030	390290	server is hitting this web server that's running on a phone over and over 401. And then basically,
391190	397270	so they've implemented some security controls, like, you know, basically password lockout.
397270	402990	And then it literally just pukes its guts up on you.
403870	411250	It's like, oh, you failed your password. And here you go. So, you know, the first time I
411250	417910	looked at this, I actually didn't see anything too interesting. You know, obviously, that's memory.
418310	425010	Recognize that pretty quickly. But, you know, I didn't really see a whole lot of impact initially.
425570	431010	And then so I basically monitored it for a few days and started to see, like,
431010	440030	some stiff traffic come across. And so basically, I looked for other devices of this make and model,
440030	449250	and there were actually only, like, two or three on the internet. And they didn't always
449250	456910	produce this output when you hit the 403. So it's kind of like on that particular day,
456910	461610	I happened to just kind of stumble upon that particular device on the day that it was having
461750	478330	a bad day. And because I'm, you know, we work on this stuff, and, you know, you're just kind of,
478330	483350	you know, you're just kind of looking for some indication of a bug and followed up on it. And
483350	495240	it ended up being kind of cool. So I actually just I actually watched that for probably,
496560	503020	I don't know, a couple months. And then finally saw enough stuff come across there that I
503020	509400	decided, okay, you know, this is obviously a legit vulnerability. But I want to confirm it first and
509400	519320	also see, like, what's the impact. And so I went ahead and just bought one. Probably not,
524050	529550	you know, the most efficient way of doing it. Certainly, you know, I could have
530590	538590	tried to get the firmware and loaded it up on QEMU or Pi or something like that. But
539210	546150	in this case, basically, having it already basically worked out for me. It was just kind
546150	556030	of a matter of confirming. And so I figured I'll go ahead and just buy the device. I actually ended
556030	561550	up so I got it. And, you know, I mean, I've been working on this here and there for a few months
561550	569190	at this point. And so like, Amazon dropped it off while I was at work, and I came in and
569930	575970	tore it open. And, you know, so within an hour, basically, I've got the thing bricked.
577370	584010	You know, because I was thinking, well, let's make sure we have like the latest firmware on it.
584090	589630	So we're not like reporting vulnerability on some already patched software. And,
589630	597110	and yeah, that device basically never came back. And so that was a little bit discouraging,
597110	602690	especially after, you know, spending like 150 bucks on it. But you know, I mean, that's,
602690	610010	that's part of occupational hazard, I guess. And part of the fun, of course, you know, took it
610010	616610	apart, see what I could do and ribbon cable started breaking. I was like, wow, okay,
617330	622370	we'll revisit this. And so that's what I did. I waited probably, you know, a couple few more
622370	630390	months. And, and then finally decided, okay, well, I'll just order another one. And fortunately,
630390	638150	this one came with the latest firmware. So I didn't have to break it. And within an hour
638150	644670	of opening that one, I had confirmed the bug. And I actually did it through the browser.
645220	656130	I mean, as far as bugs go, super duper easy to find and to some degree to reproduce.
661640	666660	I mean, so basically, like the first time I powered it up, I opened up Chrome,
666660	673880	failed to log in a few times. And then and then we saw that. And so I quickly wrote it up,
673880	678860	looked up like, hey, does Mitel have a bug bounty program? That would be cool.
679080	687200	No, they didn't. But they did have a really good vulnerability disclosure presence, I guess.
687200	693360	And, and clearly, like, you know, they have a program and a team that's handling only those
693360	701460	things. So that worked out good. So I basically reported it to them immediately. And
703300	705260	let's see, I don't want to get ahead of myself.
708080	711360	And I'm not going to spend too much time on that, because I'm going to show you in person.
711740	720440	Yeah, okay, we're on track here. So, so, you know, as far as I was concerned,
720440	725600	I reproduced it, and I wrote it up, sent it off. And, and they were very, you know,
725600	730400	prompt and professional. And within a few days, I had a response like, hey, thanks,
730400	736500	we'll look into it. And a couple few weeks went by, and then they emailed me and like,
736500	745560	hey, we can reproduce this. And so like, you know, for a bug bounty hunter, like not being
745560	750720	able to reproduce your report is probably one of the worst possible things that could happen.
750860	756840	And so I'm like, oh, man, you know, here I am just some schmuck on the internet,
756840	761120	emailing these guys saying, hey, your stuff's broken. And they're like, no, it's not.
763560	768960	So fortunately, for me, I guess, I was able to figure out what happened there. And as it turns
768960	774700	out, like, I never did get it to reproduce in a browser again, which kind of makes sense,
774700	781040	because it's basically just random memory. And you never really know, like, Chrome is not going
781040	786560	to know what to do with a bunch of crazy stuff. And so like, the first time I did it, it just
786560	793340	happened to work in the browser. But basically, every time after that, I had to use like Netcat.
793340	800560	But using Netcat or Telnet or whatever, it is super duper reproducible. It's actually kind of
800560	811280	impressive how much you can get from it. So that was pretty cool. They do have a GPG key or PGP,
811280	822780	I guess. So like, I probably did it the hard way. But, you know, I literally just use like
822780	829720	GPG command line. So for someone who's used to reporting stuff to companies through bounty
829720	834840	program, where they have basically like, you know, a website, HTTPS, they provide all the
835180	847380	to upload evidence and tutorials and all that stuff. So major kudos to Mitel for basically,
847380	852700	you know, being willing to hear and having people and the resources dedicated to fixing
852700	860360	these problems. Like, you know, that in and of itself is a huge thing. One of the takeaways for
860360	868440	me, and not necessarily for me, but something that I would like to help some of these companies
870520	878360	appreciate is, you know, the burden and really for them the potential for human error. Because,
878360	884600	you know, when you are like manually doing all that, even even understanding asymmetric
884600	890140	cryptography, you know, I still have to take a second like, okay, so I'm sending this to them.
890870	895600	They need to be able to open so I got encrypted their public key. You know, I got a generated
895600	902500	private key from their reply. So that's just a lot of logistical stuff that I think a lot of people
902500	911460	may not have the patience or background for. And so, you know, that could could have some
911460	918660	some pretty negative impacts if they basically just, you know, if someone else reporting a bug,
918660	924000	failed to do that properly. And next thing you know, you're sending it over HTTPS or playing
924000	935780	on HTTP. You know, not really cool. So it ended up actually being, you know, P1, I guess, in my terms.
939640	946180	So pretty interesting. ModCell is a CVE naming authority. Oh, no. Oh, yeah, PowerPoint,
946180	951240	corrected that for me again. So basically, one of the things that was cool for me
951240	958500	in this experience was learning the process for CVE. And I actually had another
959640	966780	program, another bug through a natural bounding program, pretty much simultaneously. And it was
966780	974680	interesting because like there, that one was not a CNA, Mitel is a CNA. And so walking that path
974680	983920	and understanding the different roles, and how you do it, and how you coordinate it, it's not
983920	990780	very hard at all. And MITRE basically has like a PowerPoint that walks you through everything.
991740	997920	But you know, it's kind of cool to go through the experience and understand it. Okay. So
999120	1007680	now we'll do some fun stuff. Okay.
1019870	1048440	Okay, I'm sorry. I'm going to switch this off. My bad. I guess I have to maximize this window.
1061640	1088340	There we go. Okay. We'll see how this goes. And if I get too annoying on top of it, I will
1089060	1092540	swagger. Okay, so basically, I have like,
1094660	1107970	have one of these phones right here. And so, okay. So if we just
1112700	1118020	basically, okay, plain old as vanilla as you can get,
1118020	1125740	HTTP request, write that to like a text file. And then cap that, type it to this
1129240	1137100	non-porting. Okay, 401 unauthorized. That's perfectly acceptable, normal, expected. We'll
1137100	1142260	do that a few times. I don't remember exactly how many it is. Okay, probably about that many,
1142260	1148280	five, something like that. Which really, so like, you know, this came about
1150260	1157340	I always think it's interesting when you see like, multiple level deep failure of code.
1157400	1162840	And so like, this one is especially interesting, because it's in an actual security control.
1162840	1169040	And so like, I think there's really a lesson to be learned for all of us. You know,
1169040	1177780	whether you're a penetration tester, or building a system, or software developer,
1177780	1183500	or, you know, on like the IT security compliance side of things,
1185940	1192200	you know, don't just check the box, push it a little bit, because no one would think to
1194920	1201580	set up these particular circumstances to see what happens. But those are exactly the types
1201580	1208420	of things that lead to some of the most impactful vulnerabilities. And, you know,
1208420	1211480	I mean, there's all sorts of really good resources on that.
1214120	1220040	Like, so the other day, I was like rewatching, I think, Sammy Kamkar's 2016
1221600	1227580	talk at AppSecCollege. And he basically, it's just very interesting to listen to someone with
1227580	1233160	his level of experience, because he's explaining his thought process. And he's like, so I asked
1233160	1238440	myself, what would happen if I did this? What would, what if I did this? Could I make it do
1238440	1248700	that? And, and that's the kind of basically, like structured, but creative, and out of the box
1248700	1257380	thinking that, that it takes to, to find impactful vulnerabilities, and not end up like with a whole
1257380	1262140	bunch of duplicates and get frustrated with the whole process. Okay, so at this point, I've
1262140	1271220	basically locked out the account, and it's locked up. Yeah. So, so I've written a script here at
1271220	1284160	this point, make it real easy. Give me a second. See what that is. Okay, some of that has to do
1284160	1292120	with being able to make it so people can call in. But basically, the key thing there, you can see,
1292140	1297360	I guess you can see here, right? Same thing I just did, but we're doing it
1298520	1306180	20 million times or something like that. Okay, so what I'm going to do,
1306180	1310200	this is the number here. Okay, so I'm going to fire that off.
1310820	1323540	That should just basically start spilling its guts. Yeah, it's ringing right here.
1331190	1336510	Okay. I mean, I have literally sacrificed one of these devices to the demo gods.
1336630	1342650	So I fully expect that this is going to work right off the bat.
1345730	1372540	Let's see. Obviously not. Okay. Maybe then we did. Let's just take another look at that real quick.
1396790	1402390	Let's take a look and see. We're getting something.
1404210	1413230	That should be good. Okay. Sometimes, you know, you totally mess up your shell.
1416740	1420160	So let me just re-open the new shell today.
1475370	1479250	You know, this wouldn't be fun if it worked immediately, I guess.
1498060	1500020	We'll simplify it for a second.
1514160	1517660	Oh my goodness. I'm such a doofus. I'm so sorry.
1518340	1521640	It is literally doing exactly what it's supposed to. I apologize.
1524180	1535280	I forgot that I changed it up. Okay. So that is, at this point, basically just pushing to a file.
1537750	1541270	And I'm going to open another window and we're going to monitor that file.
1560010	1569030	Cool. And, okay, so we will, this guy just created a script. It's going to sit there.
1571090	1580160	So, just making sure I don't have anything where to go off. Okay.
1580580	1585060	Okay. So if nothing is happening, it doesn't do anything.
1585060	1589950	It just sits there and does nothing. So when I initially got it, basically,
1589950	1595650	uh, how I confirmed it was just go in here and play with stuff.
1595790	1602610	And it was kind of neat because I would start to see, kind of going to do a bunch of stuff.
1655390	1660990	I didn't say a lot. Yeah. Wow. That's an incredible amount of stuff. Okay. Yeah. So
1660990	1665870	there we go. That's what I was expecting. Like literally the thing is just puking its guts up.
1666430	1673450	And, uh, you know, it's kind of neat. So like, you know, I've seen CVEs come across,
1673450	1684430	like I subscribed to the RSS feed and, um, sometimes like memory disclosure can be tricky to,
1684430	1689570	to exploit, to actually get something valuable because it's, you know, a lot of times you don't
1689570	1695790	have control over exactly which, uh, memory space you're going to get. And so one thing that's
1695790	1704830	kind of neat about this is, uh, just how easy it is to get stuff. It's kind of funny. That's
1704830	1710010	why I named this talk. What I did, because it's like, basically other than me, like breaking the
1710010	1720210	device, um, everything just like lined up the stars aligned and, you know, at the end of the
1720210	1726950	day, the world's a safer place. So what, what I thought was really cool one time is I was sitting
1726950	1732770	in here and I like changed the password. I'm in the admin portal and, uh, and I saw it right there.
1732870	1740250	I'm like, okay, well, there's secrets right there. And, um, uh, one of my slides, you can't really
1740250	1746190	read it very well, but basically, um, when you configure the SIP endpoint, uh, you had, you know,
1746190	1754410	you have to give your credentials and, uh, I could see those in the dump as well. Okay. So
1756350	1760870	at this point, what I'll do, so I've got a couple of numbers registered to this.
1760990	1767090	Um, so what I'll do is since we've done a bunch of stuff, I'm going to reboot this phone
1767730	1777810	and, uh, that basically will, uh, basically like wipe its, uh, RAM and, uh,
1777810	1786810	also let me get to the web interface to change this phone number while that's rebooting.
1787670	1822990	I'll talk about a couple of things here. Okay. Yeah. So obviously there's not a whole lot of
1822990	1833430	technical, uh, chops being, uh, put on display for finding this one. Let me kill this before it
1833430	1843890	locks out this phone again. Okay. Uh, so, but there, but what this did do was presents a lot
1843890	1849890	of opportunities, uh, to, for like, I guess, lessons that I already knew, but kind of reinforced
1849890	1854290	them and some insights about things that I had not really thought about. And so,
1854990	1859850	you know, we have all these sayings, like, you know, hacking stuff and funding for profit.
1860510	1866170	Um, and, and I've used that myself and, you know, sounds cool, but never really thought about it,
1866770	1874530	the actual words. And, um, but it kind of hit me the other day, I was reading some,
1874530	1880970	you know, someone's Twitter or something, and basically people just like going off and, uh,
1880970	1884630	you know, just really struck me, uh, that,
1886290	1890310	I think sometimes we need to step back and see where we're at, how we got here
1890310	1900810	and where we're going and really why we're doing what we're doing. Um, because not that long ago,
1900810	1906110	and even still today, you, you know, a security researcher would find something like this and
1906110	1917270	reach out to a company and either not get a response or get sued. And so for me to be able
1917270	1927830	to just reach out to them and, you know, basically just browse my way to a 10 and 9.8 CVSS bug on
1927830	1939250	Shodan with absolutely no intent, uh, and then find the company and they have a, uh, a disclosure
1939250	1944450	program. They want to hear about it. They're very friendly and professional. And, uh, and then they
1944450	1952730	fix it. And, uh, and it all just like went so swimmingly like that. That didn't just happen
1952730	1962710	out of nowhere. Uh, there was a whole like industry-wide, I don't know what you want to
1962710	1973330	call it, but you know, issue 10 years ago, maybe not that long ago. And, uh, okay.
1973970	1980170	Where like the whole question of vulnerability disclosure was a huge deal. And basically it
1980170	1984270	got to the point where, where researchers are like, well, you know, we all love technology
1984270	1989690	and we all want the technology that you're building. We all need it. I think like COVID
1989690	1999270	for example, just shows how important technology is to humankind at this point. And, you know,
1999270	2005370	I mean, as bad as it's been, how much worse would it have been, would it be, it's still going on,
2005370	2011610	obviously. Uh, you know, if, uh, if the people who are working from home couldn't work from home,
2012190	2016890	that's not to minimize the impact that it has had, but just to say like,
2017410	2024190	you know, I guess it could actually be worse. And so like these companies, you know,
2024190	2031030	SIP phones, for example, I mean, that is a key driver to the ability to work from home and have
2031210	2039050	a distributed workforce. And so like, we rely on not only these things working and not only them
2039050	2043510	being secure, but like the people's trust in them. Like that's the worst possible thing that
2043510	2051010	could happen is if people just stop trusting the internet, uh, that that's going to be a problem.
2051130	2060130	And no one is going to protect it or can protect it. So like it falls on this relatively tiny
2060130	2071150	community. And, uh, and so yeah, I mean, we, it's a very high paying industry and about bug
2071150	2077250	bounties. Like I was watching the, uh, interview between mayonnaise, I don't know his real name
2077250	2082510	and the homestead the other day. And like, so he started doing bug bounties late 2018
2082510	2089010	and has already made over a million dollars. I mean, that's amazing.
2090390	2096950	But at the same time, it's important to, uh, to understand where we came from and not be so
2096950	2102310	caught up in that stuff that we're basically going off on Twitter because somebody didn't
2102310	2106810	pay us as much as we thought they should pay us for above. And, and that doesn't help anybody.
2107230	2112770	Um, so I think like sometimes you got to do it for fun and sometimes you do it for profit.
2112930	2118390	In this case, I did it for fun. And, uh, you know, the other day I was basically just like,
2119030	2125870	what else can I do with this? And I thought this might be kind of cool. So actually the biggest
2125870	2131870	issue I had with it was my internet connection is going through carrier grade NAT. So my public
2131870	2138710	IP is not actually public. So getting the SIP traffic to me has been a debacle. Uh, but
2139590	2146470	I actually, uh, applied something I picked up from the, uh,
2146470	2151630	so hopelessly broken lab I was doing like last year with, uh, you know, tunneling stuff through
2151630	2159330	SSH. And so that's what I'm doing right now is basically UDP SIP traffic is hitting a Twilio
2159330	2165750	and going to AWS through an SSH session that I created outbound and getting forwarded all
2165750	2180300	to this phone. So, uh, basically let me get a couple of things set up. What I was going to do
2182040	2188460	is, uh, I'll post a number. I've got like scripts and everything, just grepping stuff out to mask
2188980	2196200	phone numbers and stuff. But, uh, if you call and, uh, you saw how fast that's coming up here,
2196200	2202140	it's grabbing the phone numbers and, uh, it's going to show the last four digits. And I think
2202140	2209380	like the first one or something. And so, uh, if you call this number, I put up there and your
2209380	2218440	number shows up on this board over here somewhere, uh, ping me after this and just tell me the
2218440	2225220	remaining digits and your email address. And I'll send you a, uh, Kindle, like a redemption code for
2226340	2237830	IOT hackers handbook. Um, okay. So I'm going to turn that off for one second. I'm going to mute
2237830	2243490	myself so you don't hear me like clacking these keys and then, uh, just get a couple of things
2243490	2262360	set up here and we'll be all set. Yeah. So I think I put this out there, but like only like the first
2262360	2314870	five people can I do that for. Yeah. I'm not making any sense. Okay. There we go. At least
2314870	2322730	nine, like you see what I'm doing here. Nothing crazy. Okay. It's going to clear up this one.
2322730	2395010	Okay. My bad. You ever have yourself like double muted on a meeting or something? I basically just
2395010	2414190	did that to myself. I'm sitting here talking to you. My bad. So I do have it on just basically
2414190	2525840	ready to fire off. Well, that's actually the one we care about anyway. So that should work.
2596650	2693050	Okay. And if anybody is watching that window, they probably realize it's literally not doing
2693050	2732940	anything. Let me just hide that window so I don't dump people's phone numbers out.
2822770	2828010	It looks like we're close. We're at the time here. So Sam, I guess you just let me know if you want
2829050	2832090	to stop. But basically, we've got
2838690	2844030	Yeah. So
2853360	2858560	No, Matt, you're all good. If you want to sort of show anything off. I mean,
2858560	2863740	like you're the last talk. So don't worry. I can keep going for a while. I mean, there's
2864220	2873600	people there and you get time. That's cool. So I do. I mean, I can see this person's called right
2873600	2881900	now. So, you know, I think I'm not in the discord at this moment. I was having some problem with it.
2882000	2888040	But just ping me. I'll hop on there as soon as we get off here and give me your email address
2888040	2902170	and I'll shoot that over to you. Yeah. 06275 might be the only one. Let's see.
2903930	2923100	That would explain. 57702. So if these numbers are your phone numbers, you know,
2923100	2955480	ping me. So that was that 293310. It's kind of funny. So like, because of the way I had to get
2955480	2964240	that stuff working through SSH tunnels, it's basically does not understand that you hung up.
2975350	2982990	Well, that was three. I'll go through here. And if there are two more unique ones,
2985810	3000660	I will post that. There's one right there. 25120. And actually, I thought this may happen
3001360	3006140	if you are actually using like a SIP trunk that's not PSTN source.
3008740	3017320	So yeah, yeah, I put it together kind of cheap and fast. And you know how they say you can have
3017320	3029430	things like cheap, fast and good pick two. This is cheap and fast. One second. If that's legit
3030910	3126130	it. I believe that's anonymous. So I mean, if that is legitimately you, that's cool.
3127030	3149300	Well, okay. 60918. I think that's five. So if any of those ring a bell to you,
3149300	3156500	then just ping me after this. I'll send those codes over to you. And if that ends up being six,
3156500	3174150	that's cool too. Okay. So let's switch. But actually, it was a little bit, I'm kind of glad
3174150	3180290	it worked out like that, even though it was a little unplanned. I was, you know, based on what
3180290	3186030	my testing, I was a little afraid like five people will call just like that. We wouldn't even be able
3186030	3194290	to find them. So, okay. So I think I went through some of this already, most of this.
3197970	3204650	But show Dan dorking. And someone mentioned a similar service to me the other day and I can't
3204650	3212270	remember it. But a lot of times I think we go and we use these tools when we have found a
3212270	3221190	vulnerability and we want to see the scale of the impact. I propose that you could,
3221190	3226310	well, I mean, what this demonstrates is like, there's a lot of untapped data out there.
3228490	3238630	And they have an API. And so it's like, if you're wanting to get into IoT, and don't want to go
3238630	3243690	spend $142 on a phone and then break it and buy another one, which is completely understandable.
3244630	3253370	One potential way to pick a target would be to use these APIs and, you know, structure a search
3254230	3261140	that maybe, you know, searches for something like a bunch of 401s and then something unexpected. Or,
3261140	3269120	you know, if you know a particular request, you know, the results for a certain type of device
3269120	3277120	are typically of a certain size, search for things that are outside that realm. Excuse me.
3282620	3290600	Okay. So yeah, this is kind of something like, I've just applied. So I've been doing computers
3290600	3295760	professionally for 20 something years. And, you know, my whole life, I'm a geek at heart,
3295760	3300260	I love it. And I do it because I love it. And I would be doing it even if I wasn't getting paid.
3302480	3309180	And I've noticed over the years, whether it's in selling hardware, software, networking,
3309180	3319320	or services, when you are invested in something, because you care about it, and,
3319320	3329940	traditional salesperson, and just having fun, you know, money follows that, and it builds trust.
3329960	3335680	So I would propose to people, like, especially people who are trying to get into the industry,
3335680	3339900	and maybe see like, wow, look at all these people doing all this cool stuff, making all this money,
3339900	3346580	this is so cool, I want to get me some of that. There's a whole lot behind the scenes that you're
3346580	3354800	not seeing when you see that. And so it's very easy to get frustrated if you have like the wrong,
3354800	3356860	you know, you're focusing on the wrong thing. And so
3359740	3366900	hack for fun, and the profits will come. I truly believe that. And the only other thing on here
3366900	3375620	that I want to point out is we really do need to praise these companies like Mitel. And there was
3375620	3381640	someone else this week who gave a talk, and he's like, you know, this company was spectacular.
3382480	3389680	I mean, that's not nothing. And really, like, you could put companies on like the,
3392620	3399320	my goodness, the grief scale, right? Like, over here, you have denial, over here, you have
3399320	3404440	acceptance. And 10 years ago, everyone was in denial. And if you went to them with it, they just
3405600	3412780	preemptively sued you out of fear and denial. And there's still people there,
3412780	3417620	still companies at that place. And then you have companies who are like, hey, you know,
3417620	3423020	come hack us. And if you write us a good report, we'll pay you even if you don't find bugs.
3423720	3429700	Because we care, and we want our stuff to work right. And you know, there's people everywhere
3429700	3435400	in between. And while we as, you know, even if you're not in this for like bug bounties,
3435400	3442880	but you're in it for whether it's just the good of the internet, or pen testing as a career,
3442880	3452200	whatever it may be. There are some elements that are similar to like traditional IT jobs,
3452200	3457940	where like, you don't just walk into a company and be like, hey, you know, let's replace all your
3458480	3465020	computers and Windows upgraded to 2019. And all this, you know, exchange in the cloud tomorrow,
3465020	3471200	you have to build a relationship and trust and understand them. And there's a whole bunch of
3471200	3478900	stuff that goes into that. And I think if you approach this industry with that same attitude,
3478900	3484520	where we'll get to a place where we understand that like, software vulnerabilities are going to
3484520	3491440	happen. It doesn't matter, like what controls you have in place, human beings are writing it,
3491440	3499560	and it is only human to make mistakes. And we don't want to like stigmatize it. Actually,
3499560	3504680	I think we should praise people who are doing it. And, and really where we're at right now is
3504680	3511340	there's basically like a set of companies who are like subsidizing this, this burgeoning industry.
3511340	3515780	I realize it's, you know, quite a several years old, but in the grand scheme of things,
3515780	3524200	it's still pretty new. And so we need to move these companies from over here to over here.
3524200	3531460	And that's going to take time. And I can, I can think of one scenario, in my own experience,
3531460	3537600	where basically, like I reported something to a company, clearly was an impactful bug.
3538040	3543680	They didn't see it that way. You know, I didn't, I was like, okay, cool. You know, that's cool.
3544380	3550560	Yeah, I didn't push it. I haven't returned to their program since then. But I actually noticed
3550560	3556500	like a few weeks ago, maybe a month ago, you know, now they're doing things to try to attract
3557700	3562440	researchers to their program. So what I think is happening there is like they probably realize
3562440	3571660	yeah, we're not getting much traffic. And so they're slowly moving over in this way. And,
3571660	3577260	you know, it takes time. And if you're getting upset going off on Twitter, or, you know,
3577260	3582100	just being unprofessional, not only is that going to hurt you, but that's going to hurt
3583340	3589900	the whole industry. Because, I mean, you represent this industry to those people.
3589900	3595980	And, and that's that can be dangerous for us all, because really, at the end of the day,
3596620	3607520	we do need all this stuff to work. And I mean, like, the Great Firewall of America is now a
3607520	3611640	topic of discussion. I mean, that that's like a vote of no confidence in the internet. That's
3611640	3623680	concerning. And we need to not let that happen. And okay. So I'm 15 over. So that's cool.
3623940	3629760	Thanks for the extra time. Ping me afterwards if any of those numbers were yours.
3630020	3633200	Thanks for your time. Happy DEF CON.