WEBVTT 00:00.000 --> 00:01.600 Okay, sounds good. 00:01.680 --> 00:03.560 My name is Matt. 00:03.700 --> 00:08.960 I put this all together because I... so basically... 00:10.940 --> 00:14.380 I guess, you know, brief who it is real quick. 00:15.180 --> 00:16.940 I'm from Louisville, Kentucky. 00:16.980 --> 00:19.420 I've been doing computers for a long time. 00:21.620 --> 00:23.220 I love it. 00:23.220 --> 00:27.480 And lately, the big thing I've been working on are Bogue Bounties. 00:29.020 --> 00:33.020 And that kind of actually got me into this. 00:33.420 --> 00:46.420 So basically, TLDR on this is Network-Based Unauthenticated Memory Disclosure on a SIFT phone. 00:46.880 --> 00:54.840 And I basically played with it and found there's some pretty interesting things that you can pull out of it. 00:54.900 --> 00:56.580 And I'm going to show you here. 00:56.580 --> 00:59.780 It's worked out pretty cool. 00:59.780 --> 01:06.260 The backstory actually goes back to basically DerbyCon 2019. 01:08.960 --> 01:17.420 So, you know, that was the last DerbyCon, of course, and being from Louisville, naturally, I was made sure I was there. 01:19.320 --> 01:23.400 And, you know, they always have a lineup of awesome speakers. 01:23.680 --> 01:43.980 But so the first I guess it must have been Saturday, I was on my way to the first talk of the day and I saw this sign over here across the way and I, you know, basically was like drawn to that thing like a bug is drawn to a zapper or something. 01:44.520 --> 01:51.000 And so I walked in there and literally did not leave for the rest of the day. 01:51.820 --> 01:58.620 And it's so cool, you know, we work on this stuff all the time and hear about the vulnerabilities and deal with them. 01:58.720 --> 02:13.720 But to see all the different stuff laid out there from basically, you know, NASs to routers to light bulbs really struck a chord with me, I guess. 02:13.720 --> 02:21.520 So I think in that sense, IOT Village really achieved what they were shooting for. 02:23.860 --> 02:30.420 So basically, that would have been in September of last year. 02:30.780 --> 02:46.760 And I kind of walked away from that with the notion that I wanted to spend some time in the next year hacking on that stuff, coming up with my own basically, you know, ODAs. 02:48.880 --> 03:01.800 And so about a month later, I was working on a bug bounty and had an interesting scope because it was basically like all IPs, which normally is like hosts and stuff. 03:01.980 --> 03:10.160 And so I thought I would do some recon, you know, follow all the steps, right? 03:10.160 --> 03:11.620 Passive recon first. 03:11.620 --> 03:17.660 And so I started with Shodan, mostly just to get familiar with it, because I hadn't really used it very much. 03:17.900 --> 03:24.800 And actually, I think I had done it wrong, because I didn't end up at the target that I thought I was wanting to end up at. 03:24.800 --> 03:29.940 But I basically ended up just browsing through Shodan for a few hours. 03:29.940 --> 03:37.340 And like, you know, I never was one to like, sit there and watch cat videos for hours. 03:38.880 --> 03:49.000 But once I came across Shodan and all the cool stuff that you can find on there, it's basically like my cat videos, I guess. 03:49.420 --> 03:54.700 And so basically, as I'm browsing through here, I 04:08.250 --> 04:11.830 I'm scrolling down and let's go back. 04:25.540 --> 04:27.680 Yeah, I guess. 04:38.570 --> 04:41.350 I imagine you guys probably can't see that very well. 04:42.410 --> 04:46.910 So I'm working on how I can make that look better. 04:46.910 --> 04:48.710 Give me just one second. 05:27.770 --> 05:28.810 Okay. 05:35.990 --> 05:37.590 There we go. 05:37.670 --> 05:39.550 That's what I was shooting for. 05:41.110 --> 05:42.370 Actually that. 05:42.470 --> 05:43.170 Okay. 05:43.910 --> 05:46.090 So I'm browsing on Shodan. 05:46.090 --> 05:47.050 I come across this. 05:47.050 --> 05:49.570 Obviously, I have a bunch of stuff marked out right now. 05:49.570 --> 05:51.330 So I apologize for that. 05:52.190 --> 05:55.490 But, you know, nothing too crazy here. 05:55.850 --> 05:58.130 And then I keep scrolling down. 06:09.310 --> 06:10.550 Okay. 06:15.010 --> 06:16.850 And basically come to this. 06:16.850 --> 06:27.970 So clearly what's happened here is, you know, the Shodan server is hitting this web server that's running on a phone over and over 401. 06:27.970 --> 06:37.270 And then basically, so they've implemented some security controls, like, you know, basically password lockout. 06:37.270 --> 06:42.990 And then it literally just pukes its guts up on you. 06:43.870 --> 06:45.810 It's like, oh, you failed your password. 06:46.050 --> 06:47.490 And here you go. 06:47.490 --> 06:55.310 So, you know, the first time I looked at this, I actually didn't see anything too interesting. 06:56.050 --> 06:57.910 You know, obviously, that's memory. 06:58.310 --> 06:59.930 Recognize that pretty quickly. 07:00.190 --> 07:05.010 But, you know, I didn't really see a whole lot of impact initially. 07:05.570 --> 07:13.010 And then so I basically monitored it for a few days and started to see, like, some stiff traffic come across. 07:13.350 --> 07:26.410 And so basically, I looked for other devices of this make and model, and there were actually only, like, two or three on the internet. 07:26.770 --> 07:34.910 And they didn't always produce this output when you hit the 403. 07:34.910 --> 07:42.810 So it's kind of like on that particular day, I happened to just kind of stumble upon that particular device on the day that it was having a bad day. 07:43.310 --> 08:03.250 And because I'm, you know, we work on this stuff, and, you know, you're just kind of, you know, you're just kind of looking for some indication of a bug and followed up on it. 08:03.250 --> 08:05.190 And it ended up being kind of cool. 08:05.410 --> 08:18.680 So I actually just I actually watched that for probably, I don't know, a couple months. 08:18.680 --> 08:27.340 And then finally saw enough stuff come across there that I decided, okay, you know, this is obviously a legit vulnerability. 08:27.420 --> 08:32.140 But I want to confirm it first and also see, like, what's the impact. 08:33.240 --> 08:35.860 And so I went ahead and just bought one. 08:37.880 --> 08:39.320 Probably not, 08:44.050 --> 08:46.630 you know, the most efficient way of doing it. 08:46.630 --> 08:57.910 Certainly, you know, I could have tried to get the firmware and loaded it up on QEMU or Pi or something like that. 08:58.090 --> 09:04.610 But in this case, basically, having it already basically worked out for me. 09:05.250 --> 09:10.230 It was just kind of a matter of confirming. 09:10.350 --> 09:15.490 And so I figured I'll go ahead and just buy the device. 09:15.510 --> 09:17.830 I actually ended up so I got it. 09:17.830 --> 09:22.770 And, you know, I mean, I've been working on this here and there for a few months at this point. 09:24.350 --> 09:31.190 And so like, Amazon dropped it off while I was at work, and I came in and tore it open. 09:31.190 --> 09:35.970 And, you know, so within an hour, basically, I've got the thing bricked. 09:37.370 --> 09:44.010 You know, because I was thinking, well, let's make sure we have like the latest firmware on it. 09:44.090 --> 09:49.090 So we're not like reporting vulnerability on some already patched software. 09:49.270 --> 09:54.370 And, and yeah, that device basically never came back. 09:55.190 --> 10:00.710 And so that was a little bit discouraging, especially after, you know, spending like 150 bucks on it. 10:00.890 --> 10:07.490 But you know, I mean, that's, that's part of occupational hazard, I guess. 10:07.830 --> 10:14.790 And part of the fun, of course, you know, took it apart, see what I could do and ribbon cable started breaking. 10:14.790 --> 10:19.150 I was like, wow, okay, we'll revisit this. 10:19.230 --> 10:20.310 And so that's what I did. 10:20.310 --> 10:23.250 I waited probably, you know, a couple few more months. 10:23.590 --> 10:29.490 And, and then finally decided, okay, well, I'll just order another one. 10:29.490 --> 10:33.070 And fortunately, this one came with the latest firmware. 10:33.070 --> 10:36.290 So I didn't have to break it. 10:36.650 --> 10:41.670 And within an hour of opening that one, I had confirmed the bug. 10:41.730 --> 10:44.670 And I actually did it through the browser. 10:45.220 --> 10:56.130 I mean, as far as bugs go, super duper easy to find and to some degree to reproduce. 11:01.640 --> 11:08.500 I mean, so basically, like the first time I powered it up, I opened up Chrome, failed to log in a few times. 11:08.500 --> 11:10.500 And then and then we saw that. 11:10.720 --> 11:17.720 And so I quickly wrote it up, looked up like, hey, does Mitel have a bug bounty program? 11:17.720 --> 11:18.860 That would be cool. 11:19.080 --> 11:20.480 No, they didn't. 11:20.600 --> 11:27.200 But they did have a really good vulnerability disclosure presence, I guess. 11:27.200 --> 11:34.280 And, and clearly, like, you know, they have a program and a team that's handling only those things. 11:34.780 --> 11:37.600 So that worked out good. 11:37.880 --> 11:40.840 So I basically reported it to them immediately. 11:41.140 --> 11:45.260 And let's see, I don't want to get ahead of myself. 11:48.080 --> 11:51.360 And I'm not going to spend too much time on that, because I'm going to show you in person. 11:51.740 --> 11:53.460 Yeah, okay, we're on track here. 11:53.540 --> 12:03.100 So, so, you know, as far as I was concerned, I reproduced it, and I wrote it up, sent it off. 12:03.100 --> 12:06.800 And, and they were very, you know, prompt and professional. 12:06.800 --> 12:11.980 And within a few days, I had a response like, hey, thanks, we'll look into it. 12:12.200 --> 12:18.260 And a couple few weeks went by, and then they emailed me and like, hey, we can reproduce this. 12:18.760 --> 12:30.720 And so like, you know, for a bug bounty hunter, like not being able to reproduce your report is probably one of the worst possible things that could happen. 12:30.860 --> 12:39.280 And so I'm like, oh, man, you know, here I am just some schmuck on the internet, emailing these guys saying, hey, your stuff's broken. 12:39.280 --> 12:41.120 And they're like, no, it's not. 12:43.560 --> 12:48.380 So fortunately, for me, I guess, I was able to figure out what happened there. 12:48.380 --> 12:57.280 And as it turns out, like, I never did get it to reproduce in a browser again, which kind of makes sense, because it's basically just random memory. 12:57.280 --> 13:03.460 And you never really know, like, Chrome is not going to know what to do with a bunch of crazy stuff. 13:04.080 --> 13:09.500 And so like, the first time I did it, it just happened to work in the browser. 13:09.520 --> 13:13.340 But basically, every time after that, I had to use like Netcat. 13:13.340 --> 13:19.720 But using Netcat or Telnet or whatever, it is super duper reproducible. 13:19.720 --> 13:25.200 It's actually kind of impressive how much you can get from it. 13:26.460 --> 13:28.180 So that was pretty cool. 13:28.180 --> 13:32.100 They do have a GPG key or PGP, I guess. 13:32.960 --> 13:38.240 So like, I probably did it the hard way. 13:40.060 --> 13:44.420 But, you know, I literally just use like GPG command line. 13:44.480 --> 14:00.280 So for someone who's used to reporting stuff to companies through bounty program, where they have basically like, you know, a website, HTTPS, they provide all the to upload evidence and tutorials and all that stuff. 14:00.320 --> 14:13.500 So major kudos to Mitel for basically, you know, being willing to hear and having people and the resources dedicated to fixing these problems. 14:13.500 --> 14:18.580 Like, you know, that in and of itself is a huge thing. 14:18.820 --> 14:37.360 One of the takeaways for me, and not necessarily for me, but something that I would like to help some of these companies appreciate is, you know, the burden and really for them the potential for human error. 14:37.600 --> 14:50.140 Because, you know, when you are like manually doing all that, even even understanding asymmetric cryptography, you know, I still have to take a second like, okay, so I'm sending this to them. 14:50.870 --> 14:54.440 They need to be able to open so I got encrypted their public key. 14:54.820 --> 14:58.020 You know, I got a generated private key from their reply. 14:58.460 --> 15:07.720 So that's just a lot of logistical stuff that I think a lot of people may not have the patience or background for. 15:07.740 --> 15:20.460 And so, you know, that could could have some some pretty negative impacts if they basically just, you know, if someone else reporting a bug, failed to do that properly. 15:20.460 --> 15:25.280 And next thing you know, you're sending it over HTTPS or playing on HTTP. 15:26.340 --> 15:29.180 You know, not really cool. 15:29.400 --> 15:35.780 So it ended up actually being, you know, P1, I guess, in my terms. 15:39.640 --> 15:41.440 So pretty interesting. 15:41.700 --> 15:43.920 ModCell is a CVE naming authority. 15:44.240 --> 15:45.040 Oh, no. 15:45.240 --> 15:48.440 Oh, yeah, PowerPoint, corrected that for me again. 15:48.440 --> 15:56.660 So basically, one of the things that was cool for me in this experience was learning the process for CVE. 15:57.100 --> 16:05.180 And I actually had another program, another bug through a natural bounding program, pretty much simultaneously. 16:05.480 --> 16:12.080 And it was interesting because like there, that one was not a CNA, Mitel is a CNA. 16:12.080 --> 16:25.540 And so walking that path and understanding the different roles, and how you do it, and how you coordinate it, it's not very hard at all. 16:25.540 --> 16:30.780 And MITRE basically has like a PowerPoint that walks you through everything. 16:31.740 --> 16:36.040 But you know, it's kind of cool to go through the experience and understand it. 16:36.080 --> 16:36.920 Okay. 16:37.440 --> 16:40.880 So now we'll do some fun stuff. 16:46.940 --> 16:47.680 Okay. 16:59.870 --> 17:01.110 Okay, I'm sorry. 17:01.150 --> 17:02.150 I'm going to switch this off. 17:02.150 --> 17:02.850 My bad. 17:26.480 --> 17:28.440 I guess I have to maximize this window. 17:41.640 --> 17:42.440 There we 17:47.170 --> 17:49.790 go. 17:58.840 --> 17:59.640 Okay. 18:04.660 --> 18:05.860 We'll see how this goes. 18:05.860 --> 18:10.240 And if I get too annoying on top of it, I will swagger. 18:10.680 --> 18:17.360 Okay, so basically, I have like, have one of these phones right here. 18:17.500 --> 18:24.200 And so, okay. 18:26.490 --> 18:27.970 So if we just 18:32.700 --> 18:41.120 basically, okay, plain old as vanilla as you can get, HTTP request, write that to like a text file. 18:41.960 --> 18:45.740 And then cap that, type it to this 18:49.240 --> 18:50.580 non -porting. 18:51.300 --> 18:53.060 Okay, 401 unauthorized. 18:53.060 --> 18:56.720 That's perfectly acceptable, normal, expected. 18:56.940 --> 18:58.540 We'll do that a few times. 18:58.560 --> 19:00.620 I don't remember exactly how many it is. 19:00.620 --> 19:03.600 Okay, probably about that many, five, something like that. 19:03.600 --> 19:17.340 Which really, so like, you know, this came about I always think it's interesting when you see like, multiple level deep failure of code. 19:17.400 --> 19:22.840 And so like, this one is especially interesting, because it's in an actual security control. 19:22.840 --> 19:27.700 And so like, I think there's really a lesson to be learned for all of us. 19:28.200 --> 19:59.820 You know, whether you're a penetration tester, or building a system, or software developer, or, you know, on like the IT security compliance side of things, you know, don't just check the box, push it a little bit, because no one would think to set up these particular circumstances to see what happens. 19:59.820 --> 20:06.720 But those are exactly the types of things that lead to some of the most impactful vulnerabilities. 20:07.000 --> 20:11.480 And, you know, I mean, there's all sorts of really good resources on that. 20:14.120 --> 20:23.100 Like, so the other day, I was like rewatching, I think, Sammy Kamkar's 2016 talk at AppSecCollege. 20:23.100 --> 20:31.860 And he basically, it's just very interesting to listen to someone with his level of experience, because he's explaining his thought process. 20:31.860 --> 20:35.940 And he's like, so I asked myself, what would happen if I did this? 20:35.940 --> 20:37.780 What would, what if I did this? 20:37.780 --> 20:39.280 Could I make it do that? 20:39.340 --> 21:00.100 And, and that's the kind of basically, like structured, but creative, and out of the box thinking that, that it takes to, to find impactful vulnerabilities, and not end up like with a whole bunch of duplicates and get frustrated with the whole process. 21:00.160 --> 21:04.980 Okay, so at this point, I've basically locked out the account, and it's locked up. 21:05.460 --> 21:05.940 Yeah. 21:06.480 --> 21:13.980 So, so I've written a script here at this point, make it real easy. 21:14.860 --> 21:15.760 Give me a second. 21:16.760 --> 21:18.160 See what that is. 21:21.140 --> 21:28.920 Okay, some of that has to do with being able to make it so people can call in. 21:28.920 --> 21:34.060 But basically, the key thing there, you can see, I guess you can see here, right? 21:35.420 --> 21:40.820 Same thing I just did, but we're doing it 20 million times or something like that. 21:41.020 --> 21:47.860 Okay, so what I'm going to do, this is the number here. 21:47.860 --> 21:50.200 Okay, so I'm going to fire that off. 21:50.820 --> 21:54.920 That should just basically start spilling its guts. 22:01.440 --> 22:03.540 Yeah, it's ringing right here. 22:11.190 --> 22:11.710 Okay. 22:11.710 --> 22:16.510 I mean, I have literally sacrificed one of these devices to the demo gods. 22:16.630 --> 22:22.650 So I fully expect that this is going to work right off the bat. 22:25.730 --> 22:26.990 Let's see. 22:31.390 --> 22:32.650 Obviously not. 22:42.270 --> 22:43.070 Okay. 22:48.560 --> 22:49.960 Maybe then we did. 22:50.060 --> 22:52.540 Let's just take another look at that real quick. 23:16.790 --> 23:18.830 Let's take a look and see. 23:20.770 --> 23:22.390 We're getting something. 23:24.210 --> 23:26.170 That should be good. 23:26.270 --> 23:26.930 Okay. 23:26.930 --> 23:33.230 Sometimes, you know, you totally mess up your shell. 23:36.740 --> 23:40.160 So let me just re-open the new shell today. 24:35.370 --> 24:39.250 You know, this wouldn't be fun if it worked immediately, I guess. 24:58.060 --> 25:00.020 We'll simplify it for a second. 25:14.160 --> 25:15.440 Oh my goodness. 25:15.440 --> 25:16.520 I'm such a doofus. 25:16.520 --> 25:17.660 I'm so sorry. 25:18.340 --> 25:20.700 It is literally doing exactly what it's supposed to. 25:20.700 --> 25:21.640 I apologize. 25:24.180 --> 25:29.520 I forgot that I changed it up. 25:29.520 --> 25:30.020 Okay. 25:30.400 --> 25:35.280 So that is, at this point, basically just pushing to a file. 25:37.750 --> 25:41.270 And I'm going to open another window and we're going to monitor that file. 26:00.010 --> 26:01.010 Cool. 26:01.690 --> 26:07.450 And, okay, so we will, this guy just created a script. 26:07.710 --> 26:09.030 It's going to sit there. 26:11.090 --> 26:12.090 So, 26:16.820 --> 26:19.580 just making sure I don't have anything where to go off. 26:19.580 --> 26:20.160 Okay. 26:20.580 --> 26:21.220 Okay. 26:21.220 --> 26:25.060 So if nothing is happening, it doesn't do anything. 26:25.060 --> 26:26.880 It just sits there and does nothing. 26:26.880 --> 26:35.650 So when I initially got it, basically, uh, how I confirmed it was just go in here and play with stuff. 26:35.790 --> 26:42.610 And it was kind of neat because I would start to see, kind of going to do a bunch of stuff. 27:35.390 --> 27:36.870 I didn't say a lot. 27:37.550 --> 27:38.130 Yeah. 27:38.130 --> 27:38.570 Wow. 27:38.570 --> 27:40.090 That's an incredible amount of stuff. 27:40.090 --> 27:40.570 Okay. 27:40.570 --> 27:40.830 Yeah. 27:40.830 --> 27:41.570 So there we go. 27:41.570 --> 27:42.690 That's what I was expecting. 27:42.690 --> 27:45.870 Like literally the thing is just puking its guts up. 27:46.430 --> 27:50.030 And, uh, you know, it's kind of neat. 27:50.030 --> 28:11.290 So like, you know, I've seen CVEs come across, like I subscribed to the RSS feed and, um, sometimes like memory disclosure can be tricky to, to exploit, to actually get something valuable because it's, you know, a lot of times you don't have control over exactly which, 28:11.290 --> 28:13.710 uh, memory space you're going to get. 28:13.710 --> 28:23.910 And so one thing that's kind of neat about this is, uh, just how easy it is to get stuff. 28:23.910 --> 28:24.650 It's kind of funny. 28:24.650 --> 28:26.030 That's why I named this talk. 28:26.030 --> 28:41.950 What I did, because it's like, basically other than me, like breaking the device, um, everything just like lined up the stars aligned and, you know, at the end of the day, the world's a safer place. 28:43.450 --> 28:48.870 So what, what I thought was really cool one time is I was sitting in here and I like changed the password. 28:48.870 --> 28:52.770 I'm in the admin portal and, uh, and I saw it right there. 28:52.870 --> 28:55.730 I'm like, okay, well, there's secrets right there. 28:56.010 --> 29:12.470 And, um, uh, one of my slides, you can't really read it very well, but basically, um, when you configure the SIP endpoint, uh, you had, you know, you have to give your credentials and, uh, I could see those in the dump as well. 29:12.990 --> 29:13.790 Okay. 29:14.010 --> 29:20.870 So at this point, what I'll do, so I've got a couple of numbers registered to this. 29:20.990 --> 29:46.810 Um, so what I'll do is since we've done a bunch of stuff, I'm going to reboot this phone and, uh, that basically will, uh, basically like wipe its, uh, RAM and, uh, also let me get to the web interface to change this phone number while that's rebooting. 29:47.670 --> 29:49.830 I'll talk about a couple of things here. 30:14.820 --> 30:15.460 Okay. 30:15.460 --> 30:15.940 Yeah. 30:16.300 --> 30:31.290 So obviously there's not a whole lot of technical, uh, chops being, uh, put on display for finding this one. 30:31.670 --> 30:35.130 Let me kill this before it locks out this phone again. 30:38.510 --> 30:39.450 Okay. 30:39.450 --> 30:53.630 Uh, so, but there, but what this did do was presents a lot of opportunities, uh, to, for like, I guess, lessons that I already knew, but kind of reinforced them and some insights about things that I had not really thought about. 30:53.630 --> 30:59.850 And so, you know, we have all these sayings, like, you know, hacking stuff and funding for profit. 31:00.510 --> 31:08.230 Um , and, and I've used that myself and, you know, sounds cool, but never really thought about it, the actual words. 31:08.330 --> 31:29.510 And, um, but it kind of hit me the other day, I was reading some, you know, someone's Twitter or something, and basically people just like going off and, uh, you know, just really struck me, uh, that, I think sometimes we need to step back and see where we're at, 31:29.510 --> 31:34.990 how we got here and where we're going and really why we're doing what we're doing. 31:35.350 --> 31:53.550 Um, because not that long ago, and even still today, you, you know, a security researcher would find something like this and reach out to a company and either not get a response or get sued. 31:53.830 --> 32:19.850 And so for me to be able to just reach out to them and, you know, basically just browse my way to a 10 and 9.8 CVSS bug on Shodan with absolutely no intent, uh, and then find the company and they have a, uh, a disclosure program. 32:19.850 --> 32:20.910 They want to hear about it. 32:20.910 --> 32:22.650 They're very friendly and professional. 32:23.230 --> 32:25.290 And, uh, and then they fix it. 32:25.290 --> 32:30.390 And, uh, and it all just like went so swimmingly like that. 32:31.150 --> 32:34.190 That didn't just happen out of nowhere. 32:34.210 --> 32:49.750 Uh, there was a whole like industry-wide, I don't know what you want to call it, but you know, issue 10 years ago, maybe not that long ago. 32:49.750 --> 32:53.330 And, uh, okay. 32:53.970 --> 32:58.230 Where like the whole question of vulnerability disclosure was a huge deal. 32:58.230 --> 33:08.090 And basically it got to the point where, where researchers are like, well, you know, we all love technology and we all want the technology that you're building. 33:08.090 --> 33:08.930 We all need it. 33:08.930 --> 33:16.570 I think like COVID for example, just shows how important technology is to humankind at this point. 33:17.370 --> 33:26.250 And, you know, I mean, as bad as it's been, how much worse would it have been, would it be, it's still going on, obviously. 33:26.470 --> 33:40.190 Uh, you know, if, uh, if the people who are working from home couldn't work from home, that's not to minimize the impact that it has had, but just to say like, you know, I guess it could actually be worse. 33:40.190 --> 33:52.450 And so like these companies, you know, SIP phones, for example, I mean, that is a key driver to the ability to work from home and have a distributed workforce. 33:52.450 --> 34:01.930 And so like, we rely on not only these things working and not only them being secure, but like the people's trust in them. 34:01.930 --> 34:11.010 Like that's the worst possible thing that could happen is if people just stop trusting the internet, uh, that that's going to be a problem. 34:11.130 --> 34:17.230 And no one is going to protect it or can protect it. 34:17.230 --> 34:21.310 So like it falls on this relatively tiny community. 34:21.910 --> 34:31.650 And, uh, and so yeah, I mean, we, it's a very high paying industry and about bug bounties. 34:31.650 --> 34:38.950 Like I was watching the, uh, interview between mayonnaise, I don't know his real name and the homestead the other day. 34:38.950 --> 34:45.590 And like, so he started doing bug bounties late 2018 and has already made over a million dollars. 34:45.630 --> 34:49.010 I mean, that's amazing. 34:50.390 --> 35:04.550 But at the same time, it's important to, uh, to understand where we came from and not be so caught up in that stuff that we're basically going off on Twitter because somebody didn't pay us as much as we thought they should pay us for above. 35:04.790 --> 35:06.810 And, and that doesn't help anybody. 35:07.230 --> 35:12.770 Um, so I think like sometimes you got to do it for fun and sometimes you do it for profit. 35:12.930 --> 35:15.110 In this case, I did it for fun. 35:15.210 --> 35:20.990 And, uh, you know, the other day I was basically just like, what else can I do with this? 35:21.150 --> 35:23.850 And I thought this might be kind of cool. 35:23.850 --> 35:31.350 So actually the biggest issue I had with it was my internet connection is going through carrier grade NAT. 35:31.350 --> 35:33.710 So my public IP is not actually public. 35:33.710 --> 35:37.610 So getting the SIP traffic to me has been a debacle. 35:37.810 --> 35:52.390 Uh, but I actually, uh, applied something I picked up from the, uh, so hopelessly broken lab I was doing like last year with, uh, you know, tunneling stuff through SSH. 35:52.390 --> 36:06.770 And so that's what I'm doing right now is basically UDP SIP traffic is hitting a Twilio and going to AWS through an SSH session that I created outbound and getting forwarded all to this phone. 36:06.770 --> 36:10.270 So, uh, basically let 36:17.300 --> 36:18.780 me get a couple of things set up. 36:19.180 --> 36:23.640 What I was going to do is, uh, I'll post a number. 36:23.640 --> 36:30.160 I've got like scripts and everything, just grepping stuff out to mask phone numbers and stuff. 36:30.300 --> 36:41.780 But, uh, if you call and, uh, you saw how fast that's coming up here, it's grabbing the phone numbers and, uh, it's going to show the last four digits. 36:41.780 --> 36:44.320 And I think like the first one or something. 36:44.320 --> 37:00.160 And so, uh, if you call this number, I put up there and your number shows up on this board over here somewhere, uh, ping me after this and just tell me the remaining digits and your email address. 37:00.160 --> 37:07.960 And I'll send you a, uh, Kindle, like a redemption code for IOT hackers handbook. 37:08.440 --> 37:11.260 Um, okay. 37:15.030 --> 37:16.890 So I'm going to turn that off for one second. 37:17.050 --> 37:25.050 I'm going to mute myself so you don't hear me like clacking these keys and then, uh, just get a couple of things set up here and we'll be all set. 37:37.200 --> 37:37.700 Yeah. 37:37.760 --> 37:44.660 So I think I put this out there, but like only like the first five people can I do that for. 37:44.940 --> 37:45.580 Yeah. 37:46.020 --> 37:47.340 I'm not making any sense. 38:10.420 --> 38:10.420 Okay. 38:33.750 --> 38:34.650 There we go. 38:34.650 --> 38:37.570 At least nine, like you see what I'm doing here. 38:37.710 --> 38:38.750 Nothing crazy. 38:40.670 --> 38:41.190 Okay. 38:41.190 --> 38:42.730 It's going to clear up this one. 38:42.730 --> 38:43.410 Okay. 39:15.650 --> 39:15.850 My 39:29.990 --> 39:45.950 bad. 39:50.790 --> 39:54.110 You ever have yourself like double muted on a meeting or something? 39:54.110 --> 39:55.790 I basically just did that to myself. 39:55.790 --> 39:56.770 I'm sitting here talking to you. 39:56.770 --> 39:57.670 My bad. 40:12.450 --> 40:15.670 So I do have it on just basically ready to fire off. 40:50.330 --> 40:52.310 Well, 41:51.470 --> 41:53.610 that's actually the one we care about anyway. 41:53.710 --> 41:56.890 So that 42:02.500 --> 42:05.840 should work. 43:16.650 --> 43:18.250 Okay. 44:44.610 --> 44:53.530 And if anybody is watching that window, they probably realize it's literally not doing anything. 45:02.540 --> 45:02.940 Let 45:25.720 --> 45:32.940 me just hide that window so I don't dump people's phone numbers out. 47:02.770 --> 47:04.430 It looks like we're close. 47:04.430 --> 47:05.890 We're at the time here. 47:05.890 --> 47:09.990 So Sam, I guess you just let me know if you want to stop. 47:09.990 --> 47:12.090 But basically, we've got 47:18.690 --> 47:19.650 Yeah. 47:23.550 --> 47:24.030 So 47:33.360 --> 47:35.480 No, Matt, you're all good. 47:35.480 --> 47:38.340 If you want to sort of show anything off. 47:38.340 --> 47:39.640 I mean, like you're the last talk. 47:39.640 --> 47:41.400 So don't worry. 47:41.400 --> 47:42.960 I can keep going for a while. 47:42.960 --> 47:49.480 I mean, there's people there and you get time. 47:49.500 --> 47:50.280 That's cool. 47:51.240 --> 47:52.140 So I do. 47:52.140 --> 47:54.040 I mean, I can see this person's called right now. 47:54.040 --> 47:59.920 So, you know, I think I'm not in the discord at this moment. 47:59.920 --> 48:01.900 I was having some problem with it. 48:02.000 --> 48:03.120 But just ping me. 48:03.120 --> 48:10.280 I'll hop on there as soon as we get off here and give me your email address and I'll shoot that over to you. 48:11.700 --> 48:12.580 Yeah. 48:14.920 --> 48:15.360 06275 48:18.450 --> 48:21.430 might be the only one. 48:21.490 --> 48:22.170 Let's see. 48:23.930 --> 48:25.010 That would explain. 48:37.080 --> 48:37.960 57702. 48:39.700 --> 48:44.860 So if these numbers are your phone numbers, you know, ping me. 48:44.860 --> 48:50.540 So that was that 293310. 49:12.180 --> 49:13.460 It's kind of funny. 49:13.460 --> 49:24.240 So like, because of the way I had to get that stuff working through SSH tunnels, it's basically does not understand that you hung up. 49:35.350 --> 49:38.570 Well, that was three. 49:38.570 --> 49:39.790 I'll go through here. 49:39.790 --> 49:48.830 And if there are two more unique ones, I will post that. 49:49.250 --> 49:49.970 There's one right there. 49:50.010 --> 49:51.090 25120. 49:58.220 --> 50:06.140 And actually, I thought this may happen if you are actually using like a SIP trunk that's not PSTN source. 50:08.740 --> 50:14.580 So yeah, yeah, I put it together kind of cheap and fast. 50:15.560 --> 50:20.040 And you know how they say you can have things like cheap, fast and good pick two. 50:20.040 --> 50:21.860 This is cheap and fast. 50:26.450 --> 50:27.930 One second. 50:28.030 --> 50:32.310 If that's legit it. 51:59.530 --> 52:02.490 I believe that's anonymous. 52:03.010 --> 52:06.130 So I mean, if that is legitimately you, that's cool. 52:07.030 --> 52:09.490 Well, okay. 52:21.960 --> 52:22.920 60918. 52:24.100 --> 52:25.640 I think that's five. 52:26.580 --> 52:30.920 So if any of those ring a bell to you, then just ping me after this. 52:31.560 --> 52:33.920 I'll send those codes over to you. 52:34.060 --> 52:37.460 And if that ends up being six, that's cool too. 52:38.100 --> 52:38.720 Okay. 52:42.240 --> 52:44.040 So let's switch. 52:46.700 --> 52:58.590 But actually, it was a little bit, I'm kind of glad it worked out like that, even though it was a little unplanned. 52:59.070 --> 53:05.050 I was, you know, based on what my testing, I was a little afraid like five people will call just like that. 53:05.190 --> 53:07.170 We wouldn't even be able to find them. 53:07.170 --> 53:08.670 So, okay. 53:10.210 --> 53:14.290 So I think I went through some of this already, most of this. 53:17.970 --> 53:20.270 But show Dan dorking. 53:20.450 --> 53:25.750 And someone mentioned a similar service to me the other day and I can't remember it. 53:26.010 --> 53:36.870 But a lot of times I think we go and we use these tools when we have found a vulnerability and we want to see the scale of the impact. 53:38.350 --> 53:46.310 I propose that you could, well, I mean, what this demonstrates is like, there's a lot of untapped data out there. 53:48.490 --> 53:50.510 And they have an API. 53:51.170 --> 54:03.690 And so it's like, if you're wanting to get into IoT, and don't want to go spend $142 on a phone and then break it and buy another one, which is completely understandable. 54:04.630 --> 54:20.590 One potential way to pick a target would be to use these APIs and, you know, structure a search that maybe, you know, searches for something like a bunch of 401s and then something unexpected. 54:20.590 --> 54:34.840 Or, you know, if you know a particular request, you know, the results for a certain type of device are typically of a certain size, search for things that are outside that realm. 54:35.780 --> 54:37.120 Excuse me. 54:42.620 --> 54:43.740 Okay. 54:43.980 --> 54:49.480 So yeah, this is kind of something like, I've just applied. 54:49.480 --> 54:53.280 So I've been doing computers professionally for 20 something years. 54:53.540 --> 54:56.280 And, you know, my whole life, I'm a geek at heart, I love it. 54:56.280 --> 54:57.660 And I do it because I love it. 54:57.660 --> 55:00.260 And I would be doing it even if I wasn't getting paid. 55:02.480 --> 55:29.940 And I've noticed over the years, whether it's in selling hardware, software, networking, or services, when you are invested in something, because you care about it, and, traditional salesperson, and just having fun, you know, money follows that, and it builds trust. 55:29.960 --> 55:42.060 So I would propose to people, like, especially people who are trying to get into the industry, and maybe see like, wow, look at all these people doing all this cool stuff, making all this money, this is so cool, I want to get me some of that. 55:43.640 --> 55:48.560 There's a whole lot behind the scenes that you're not seeing when you see that. 55:49.020 --> 55:56.520 And so it's very easy to get frustrated if you have like the wrong, you know, you're focusing on the wrong thing. 55:56.520 --> 56:02.460 And so hack for fun, and the profits will come. 56:02.460 --> 56:04.220 I truly believe that. 56:04.320 --> 56:14.220 And the only other thing on here that I want to point out is we really do need to praise these companies like Mitel. 56:14.320 --> 56:21.640 And there was someone else this week who gave a talk, and he's like, you know, this company was spectacular. 56:22.480 --> 56:25.320 I mean, that's not nothing. 56:25.600 --> 56:37.140 And really, like, you could put companies on like the, my goodness, the grief scale, right? 56:37.140 --> 56:40.160 Like, over here, you have denial, over here, you have acceptance. 56:40.160 --> 56:42.860 And 10 years ago, everyone was in denial. 56:42.860 --> 56:50.900 And if you went to them with it, they just preemptively sued you out of fear and denial. 56:51.280 --> 56:54.260 And there's still people there, still companies at that place. 56:54.260 --> 56:58.960 And then you have companies who are like, hey, you know, come hack us. 56:58.960 --> 57:03.020 And if you write us a good report, we'll pay you even if you don't find bugs. 57:03.720 --> 57:06.680 Because we care, and we want our stuff to work right. 57:07.820 --> 57:10.480 And you know, there's people everywhere in between. 57:10.480 --> 57:24.220 And while we as, you know, even if you're not in this for like bug bounties, but you're in it for whether it's just the good of the internet, or pen testing as a career, whatever it may be. 57:25.520 --> 57:41.580 There are some elements that are similar to like traditional IT jobs, where like, you don't just walk into a company and be like, hey, you know, let's replace all your computers and Windows upgraded to 2019. 57:41.580 --> 57:49.560 And all this, you know, exchange in the cloud tomorrow, you have to build a relationship and trust and understand them. 57:49.700 --> 57:53.120 And there's a whole bunch of stuff that goes into that. 57:53.120 --> 58:05.380 And I think if you approach this industry with that same attitude, where we'll get to a place where we understand that like, software vulnerabilities are going to happen. 58:05.620 --> 58:14.200 It doesn't matter, like what controls you have in place, human beings are writing it, and it is only human to make mistakes. 58:14.420 --> 58:19.180 And we don't want to like stigmatize it. 58:19.180 --> 58:22.160 Actually, I think we should praise people who are doing it. 58:22.260 --> 58:31.340 And, and really where we're at right now is there's basically like a set of companies who are like subsidizing this, this burgeoning industry. 58:31.340 --> 58:37.040 I realize it's, you know, quite a several years old, but in the grand scheme of things, it's still pretty new. 58:38.260 --> 58:44.200 And so we need to move these companies from over here to over here. 58:44.200 --> 58:45.940 And that's going to take time. 58:46.140 --> 58:57.600 And I can, I can think of one scenario, in my own experience, where basically, like I reported something to a company, clearly was an impactful bug. 58:58.040 --> 58:59.940 They didn't see it that way. 59:00.380 --> 59:02.640 You know, I didn't, I was like, okay, cool. 59:02.640 --> 59:03.680 You know, that's cool. 59:04.380 --> 59:05.980 Yeah, I didn't push it. 59:06.120 --> 59:09.280 I haven't returned to their program since then. 59:09.280 --> 59:19.040 But I actually noticed like a few weeks ago, maybe a month ago, you know, now they're doing things to try to attract researchers to their program. 59:19.040 --> 59:25.140 So what I think is happening there is like they probably realize yeah, we're not getting much traffic. 59:26.220 --> 59:31.260 And so they're slowly moving over in this way. 59:31.420 --> 59:33.280 And, you know, it takes time. 59:33.280 --> 59:44.360 And if you're getting upset going off on Twitter, or, you know, just being unprofessional, not only is that going to hurt you, but that's going to hurt the whole industry. 59:44.420 --> 59:49.900 Because, I mean, you represent this industry to those people. 59:49.900 --> 59:59.180 And, and that's that can be dangerous for us all, because really, at the end of the day, we do need all this stuff to work. 59:59.540 --> 01:00:08.400 And I mean, like, the Great Firewall of America is now a topic of discussion. 01:00:08.400 --> 01:00:11.160 I mean, that that's like a vote of no confidence in the internet. 01:00:11.200 --> 01:00:13.000 That's concerning. 01:00:13.000 --> 01:00:17.160 And we need to not let that happen. 01:00:17.220 --> 01:00:19.300 And okay. 01:00:20.180 --> 01:00:22.540 So I'm 15 over. 01:00:22.540 --> 01:00:23.680 So that's cool. 01:00:23.940 --> 01:00:25.460 Thanks for the extra time. 01:00:25.460 --> 01:00:29.760 Ping me afterwards if any of those numbers were yours. 01:00:30.020 --> 01:00:31.680 Thanks for your time. 01:00:31.960 --> 01:00:33.200 Happy DEF CON.