WEBVTT 00:00.060 --> 00:03.240 Our next talk comes from Turkey. 00:03.520 --> 00:15.550 It is with great pleasure to welcome and introduce you to Oskan Mustafa Akkus and his talk, The Vulnerability that Gmail Overlooked and Enabled Threat Hunting. 00:20.300 --> 00:22.140 Take it away, Oskan. 00:25.970 --> 00:29.170 Hello, I wish happy days to everyone. 00:29.170 --> 00:31.430 I am Oskan Mustafa Akkus. 00:31.470 --> 00:43.330 Today I'm going to talk about the threats that the SMTP protocol can pose and show you how large mail providers such as Gmail overlooked and enabled threat hunting. 00:43.330 --> 00:53.350 It makes me sad not to be in Vegas right now, but health is more important than anything, so please be careful and don't go out without a mask. 00:54.350 --> 00:57.710 First of all, I want to talk about myself. 00:57.950 --> 01:02.290 I'm a vulnerable researcher and penetration tester in Turkey. 01:02.290 --> 01:10.410 While studying sports science and technologies, I decided to leave the university and step into the world of cybersecurity. 01:10.690 --> 01:20.350 My purpose is to provide added value to the world of cybersecurity through the training I had given and the research I had conducted. 01:20.710 --> 01:27.430 I published security vulnerabilities on international platforms that I had discovered. 01:27.450 --> 01:31.110 I entries my exploit to CVE and EDP databases. 01:31.110 --> 01:37.770 You can also access my previous works on my personal blog pentes.com.tr. 01:38.370 --> 01:41.560 I would like to mention presentation schedule. 01:42.050 --> 01:47.710 First, we will focus on SMTP protocol structure and threats. 01:47.710 --> 01:59.230 We're going to analyze by sending training emails inspired by SMTP, and then we're going to review and result and scheme of the research. 01:59.230 --> 02:04.190 Finally, I'm going to share an explosive tool as a bonus with you. 02:04.910 --> 02:10.450 I don't have the DEF CON 28 badge today. 02:10.450 --> 02:15.350 Because of that, I am using DEF CON 26 and 27 badges. 02:16.110 --> 02:18.830 I miss it using them very much. 02:20.130 --> 02:22.590 So, let's start. 02:24.090 --> 02:26.510 Let's look at what SMTP is. 02:26.510 --> 02:32.350 Also, let's take a look at the structure of this protocol and examine the logic of operation. 02:32.350 --> 02:36.390 As everyone knows, SMTP is simple mail transfer protocol. 02:36.390 --> 02:39.190 As mentioned in the name, it's very simple protocol. 02:39.190 --> 02:43.690 We know that the simple structure can always pose a danger. 02:43.750 --> 02:49.170 So, new solutions and models contribute to the straightening of the simple structure. 02:49.170 --> 02:54.070 Different solutions were used for many security problems in SMTP. 02:54.070 --> 02:56.830 We're going to touch this issue again later. 02:57.690 --> 03:04.070 SMTP was published as IFC 788 by Postel in November 1981. 03:04.070 --> 03:14.610 This protocol structure was finalized as IFC 821, IFC 2821, and IFC 5321. 03:14.610 --> 03:20.410 IFC 5321 is the last standard published in 2008. 03:20.410 --> 03:35.990 Today, there are famous structures that high mail transfer agent is the use of the SMTP protocol such as Gmail, Postfix, Microsoft Exchange Server, Yandex, Mail.ru, Yahoo, and so on. 03:35.990 --> 03:44.030 You can examine the history and final version of the SMTP protocol in detail through the link below. 03:45.510 --> 03:53.530 According to Internet Engineering Task Force, the simple structure of the SMTP protocol can be shown as follows. 03:53.970 --> 03:59.150 Let's follow a path from the simple structure to complex structure. 03:59.150 --> 04:04.750 Below, we can see the structure that is not separated into its components. 04:04.750 --> 04:08.230 So, SMTP clients communicate via the internet. 04:08.690 --> 04:13.510 Let's continue the review by adding protocol components. 04:13.510 --> 04:19.170 If we move to from general to detail, it will be more memorable. 04:19.450 --> 04:29.750 In the diagram below, you can see that we have divided the SMTP client and SMTP server into two components such as mail transfer agent and user agent. 04:29.750 --> 04:33.850 The user agent creates the envelope then puts the message in the envelope. 04:33.850 --> 04:35.930 So, it prepares the message. 04:35.930 --> 04:40.610 The mail transfer agent transfers his prepared mail across the internet. 04:40.610 --> 04:47.050 This is done in the same way on the parties receiving the mail and delivering the mail. 04:47.050 --> 04:51.790 Up this time, the SMTP protocol was in a very simple state. 04:51.790 --> 04:54.690 Spring made trails with the simple structure. 04:54.690 --> 05:00.190 Therefore, different structures are included to strengthen the SMTP protocol. 05:00.190 --> 05:04.250 For example, extended SMTP has been released. 05:04.330 --> 05:18.170 Extended SMTP defines a framework for extending SMTP service by defining a means whereby a server SMTP can inform a client SMTP as to the server extension it supports. 05:18.290 --> 05:25.510 So, control has been added to DNS site which is used especially for email transfer. 05:25.510 --> 05:40.430 Authentication to SMTP server, domain case identification mail, domain-based message authentication, reporting and conformance, and standard policy framework are the controls provided on the DNS site. 05:40.430 --> 05:49.030 While many standards have been published to strengthen the SMTP protocol, the most important of this is the standard policy framework. 05:49.030 --> 05:52.490 This will be the point we will focus on today. 05:52.490 --> 05:57.590 At this point, we will review the Internet Engineering Task Force's documents again. 05:57.590 --> 06:08.210 According to Internet Engineering Task Force, IFC 7108 is version 1 for standard policy framework for authorizing use of domains in email. 06:08.350 --> 06:12.570 You can get detailed information from the link below. 06:12.570 --> 06:16.410 There's a sentence like this in the abstract description. 06:16.410 --> 06:19.130 This sentence is exactly like this. 06:19.130 --> 06:22.810 Email on the internet can be forgotten in a number of ways. 06:22.810 --> 06:33.870 In particular, existing protocols place no restriction on what a sending host can use as the mail from of a message or the domain given on the SMTP hello, hello comments. 06:33.870 --> 06:35.810 This part is very important. 06:35.810 --> 06:43.130 Existing protocols place no restriction on what a sending host can use as the mail from of a message or the domain. 06:43.130 --> 06:47.470 This means that the SMTP protocol is a very primitive structure. 06:47.470 --> 06:54.590 It's ironic that the millions of the servers are not using mail from control while using this protocol. 06:54.950 --> 07:03.250 Our main subject today is how famous mail transfer agent services can pause a trade event thought they use SPF. 07:03.250 --> 07:19.210 In fact, today I was gonna just share a situation related to Gmail, but it was March 3 when I applied for Package Hacking Village, so I continued my research and perform a test on other famous email providers. 07:19.290 --> 07:26.190 So today we will examine also other famous mail providers, not only the Gmail. 07:26.570 --> 07:35.790 These will be Gmail, Yandex Mail, Mail.ru, Outlook, Hotmail, Yahoo, Zoho Mail, Hi.com, and HubSpot. 07:35.810 --> 07:47.240 Because of that, it will be more correct to change the presentation title as the vulnerability that famous email providers overlooked at enabling trade hunting. 07:47.750 --> 07:53.210 Let's send emails that can pause trades and analyze the situation later. 07:53.210 --> 07:56.990 I worked on Exploit to send these training emails. 07:56.990 --> 08:03.770 I'm so sorry to say that, but I'm not gonna share the details of Exploit because it's so dangerous. 08:03.770 --> 08:06.930 However, I'm gonna show you with live examples. 08:06.930 --> 08:12.470 I'm gonna use an SMTP server as a gateway by authentication with user information. 08:12.470 --> 08:16.550 This server will be an SMTP server without open relay. 08:16.550 --> 08:26.850 In addition, this server must be a trusted server that has been previously approved by famous email providers and has no problem with mail delivery. 08:27.030 --> 08:32.570 The server I use in Exploit for this process will be my university's mail server. 08:32.590 --> 08:47.930 The servers of large companies and universities are in constant communication with famous email providers, so we can bypass most of the DNS-based controls. 08:47.930 --> 08:53.870 If you try to do this by creating a new server, you're gonna definitely fail. 08:54.110 --> 09:03.570 There's also another detail in the Exploit I wrote about that, but I'm not gonna share these details as I said before. 09:03.970 --> 09:09.890 We're gonna conduct internal and external tests on famous mail providers. 09:09.890 --> 09:17.810 In internal tests, we will try to send arbitrary mail via mail providers' own domain name, for example, gmail2gmail. 09:17.810 --> 09:26.090 In external tests, we will try to send arbitrary mail using the domain name walloffship.com. 09:26.630 --> 09:30.990 Let's analyze these training emails by sending them. 09:30.990 --> 09:34.610 I created a special account on all of the famous email providers. 09:34.610 --> 09:38.590 We're gonna perform internal and external tests throughout these accounts. 09:38.590 --> 09:49.170 We're gonna do tests on Gmail, Yamnix Mail, Mail.ru, Outlook, Yahoo Mail, Zoho Mail, Hai.com, and HubSpot. 09:49.170 --> 09:54.750 My Gmail account was forwarded to HubSpot. 09:55.450 --> 10:00.250 It's also forwarded to Hai.com too. 10:00.790 --> 10:08.810 Therefore, we're gonna also test Hai.com and HubSpot with email we sent to Gmail. 10:10.150 --> 10:18.230 In internal tests, we will try to send arbitrary mail via mail provider's own domain name. 10:18.230 --> 10:21.290 And then we're gonna analyze the results. 10:22.770 --> 10:32.610 We're gonna send the mail from defconn.gmail.com to defconn.pishui.gmail.com first. 10:32.930 --> 10:35.310 Let's start with Gmail. 10:40.180 --> 10:42.660 I'm gonna send it. 10:43.300 --> 10:44.960 It will be passed. 10:50.750 --> 10:52.220 We need to wait a little. 10:56.250 --> 10:58.510 And mail has been sent successfully. 10:58.830 --> 11:03.390 As you can see, the mail dropped on the inbox. 11:03.390 --> 11:10.370 However, there's a big warning that this mail could not be verified that it came from defconn.gmail.com. 11:12.330 --> 11:17.170 But when we look at Hai.com, there is no warning here. 11:17.850 --> 11:20.350 This is a very dangerous situation. 11:21.630 --> 11:30.750 Similarly, when we check the HubSpot, we see that the mail is successfully forwarded and does not contain any warning too. 11:31.870 --> 11:35.430 I'm gonna explain the source of this vulnerability to you later. 11:36.050 --> 11:39.230 Let's continue our test with Yandex Mail. 11:39.310 --> 11:45.890 Now I'm gonna send email from defconn.yandex.com to defconn.pishui.yandex.com. 11:45.890 --> 11:51.950 I'm passing information here. 11:52.270 --> 11:52.910 Yeah 11:58.210 --> 12:02.230 , mail has been sent successfully. 12:02.490 --> 12:04.650 I will check the inbox. 12:04.650 --> 12:08.710 And I reflect the page and check the inbox and spam box again. 12:10.710 --> 12:12.870 But no email came. 12:12.870 --> 12:16.470 Yandex didn't allow us to construct its own domain name. 12:17.050 --> 12:20.630 So let's continue the test with mail.ru. 12:20.630 --> 12:28.910 I'm gonna send email from defconn.mail.ru to defconn.pishui.mail.ru. 12:30.230 --> 12:32.550 I'm passing information. 12:40.750 --> 12:43.870 Mail has been sent successfully. 12:44.470 --> 12:46.150 I will check the inbox. 12:52.100 --> 12:55.000 I'm gonna check back again to make sure. 13:00.010 --> 13:02.010 No email came. 13:02.010 --> 13:07.090 Mail.ru didn't allow us to control its own domain name such as Yandex. 13:07.690 --> 13:11.750 So let's continue the test with Hotmail. 13:12.450 --> 13:19.450 I'm gonna send email from defconn.hotmail.com to defconn.pishui.hotmail.com. 13:29.340 --> 13:31.720 Mail has been sent successfully. 13:32.580 --> 13:34.680 I'm checking the inbox. 13:35.400 --> 13:39.680 No email inbox, but as you can see it dropped into the spam box. 13:40.580 --> 13:42.420 The mail is here. 13:43.260 --> 13:46.020 And let's continue the test with Yahoo Mail. 13:46.320 --> 13:53.020 I'm gonna send email from defconn.yahoo.com to defconn.pishui.yahoo.com. 14:02.680 --> 14:05.020 Mail has been sent successfully. 14:05.880 --> 14:07.740 I'm checking the boxes. 14:20.160 --> 14:22.540 Oh, Trump came to his own mail. 14:25.020 --> 14:27.240 And no mail came. 14:27.240 --> 14:30.560 Yandex didn't allow us to control its own domain name too. 14:30.560 --> 14:32.940 Let's continue the test with Zoho Mail. 14:33.780 --> 14:40.500 I'm gonna send email from defconn.zohomail.com to defconn.pishui.zohomail.com. 14:52.430 --> 14:54.750 Mail has been sent successfully. 14:56.810 --> 14:59.130 Let's check the page by reflashing. 15:02.280 --> 15:04.000 I'm checking the boxes. 15:08.270 --> 15:09.590 No mail came. 15:09.590 --> 15:12.310 Zoho didn't allow us to control its own domain name too. 15:12.310 --> 15:13.770 So internal tests are over. 15:13.770 --> 15:15.910 We can pass to external tests. 15:16.210 --> 15:18.150 Time to external tests. 15:18.150 --> 15:23.430 I'm gonna use the email address mink at walloffship.com for external testing. 15:23.430 --> 15:28.270 We're gonna send email from mink at walloffship.com to other email addresses. 15:28.370 --> 15:29.730 Let's start with Gmail. 15:29.890 --> 15:31.450 I'm passing. 15:42.420 --> 15:44.700 Mail has been sent successfully. 15:44.760 --> 15:48.180 At the same time, the mail dropped into the inbox already. 15:48.300 --> 15:52.720 As you can see, we cannot see the warning here as internal tests. 15:52.720 --> 15:57.740 When you browse the first mail, you can see the difference, but there is a small detail. 15:57.740 --> 16:00.580 There is a question mark in the profile photo. 16:00.620 --> 16:06.500 When we move the cursor to this point, we notice that there is a warning again here. 16:06.500 --> 16:13.440 It says your mail could not verify that walloffship.com actually sent this message. 16:13.440 --> 16:17.740 But I don't know which user cares about this. 16:17.740 --> 16:21.320 I'm gonna show an example later on this situation. 16:22.060 --> 16:26.460 Let's check out hey.com and HubSpot now. 16:26.800 --> 16:32.940 As you can see, mail has been forwarded without any warning such as an internal test. 16:32.940 --> 16:36.480 The situation looks the same for HubSpot too. 16:37.100 --> 16:41.480 There is no warning and mail is cleanly forwarded. 16:41.480 --> 16:46.100 I also want to show you what's happening in the Gmail application. 16:47.640 --> 16:51.320 I'm gonna show you an older version. 16:51.420 --> 16:56.600 There is no warning even in the profile photo in the mobile application. 16:56.680 --> 17:03.840 However, until two months ago, it was affected by this weakness in the last version. 17:03.840 --> 17:08.180 I didn't report them, but they fixed the vulnerability. 17:08.180 --> 17:10.680 I don't know how they learned. 17:12.500 --> 17:15.460 Maybe my mails may be under review. 17:15.460 --> 17:16.760 I don't know. 17:17.140 --> 17:23.620 But still, I want you to know that the old versions are still vulnerable. 17:24.740 --> 17:27.900 Let's continue tasks with Yandex Mail. 17:28.220 --> 17:34.740 I'm gonna send email from mink at walloffship.com to defcomph3 at yandex.com. 17:36.580 --> 17:39.360 I will pass the information. 17:50.600 --> 17:52.560 Mail has been sent successfully. 17:54.160 --> 17:56.060 I will check inbox. 18:00.100 --> 18:03.680 As you can see, mail dropped directly into the inbox. 18:03.680 --> 18:06.880 Also, there is no warning in the mail content. 18:06.920 --> 18:09.220 It's a very dangerous situation. 18:09.280 --> 18:12.440 I'm not Mink, but it doesn't matter for Yandex. 18:13.000 --> 18:17.720 Therefore, we can say that Yandex is affected by this situation. 18:18.240 --> 18:24.660 I'm taking note of this and let's continue tasks with mail.ru. 18:25.220 --> 18:32.180 I'm gonna send email from mink at walloffship.com to defcomph3 at mail.ru. 18:44.110 --> 18:47.130 Mail has been sent successfully. 18:47.530 --> 18:51.360 As you can see, the mail has arrived quickly. 18:51.920 --> 18:57.300 Just like Yandex, mail.ru didn't check if I was Mink or not. 18:57.300 --> 19:02.860 Therefore, we can say that Yandex is affected by this situation too. 19:03.160 --> 19:05.880 Let's continue tasks with Hotmail. 19:06.060 --> 19:14.060 Now is I'm gonna send email from mink at walloffship.com to defcomph3 at hotmail.com. 19:28.090 --> 19:30.290 Mail has been sent successfully. 19:30.750 --> 19:34.650 Now I will check. 19:35.590 --> 19:40.510 And no mail inbox, but as you can see, it dropped into the spam box. 19:40.610 --> 19:45.500 Hotmail sent this message to the spam box because it couldn't verify its owner. 19:45.910 --> 19:48.470 So I am taking note of this. 19:48.790 --> 19:51.260 Let's continue tasks with Yahoo mail. 19:51.690 --> 19:57.510 I'm gonna send email from mink at walloffship.com to defcomph3 at yahoo. 19:57.530 --> 19:58.510 com. 20:14.310 --> 20:15.890 Mail has been sent successfully. 20:17.270 --> 20:19.270 I'm checking the boxes. 20:28.710 --> 20:31.470 I'll tramp again, I think tramp is after me. 20:31.870 --> 20:34.730 I will check boxes a few times to be sure. 20:39.810 --> 20:41.850 No mail has been received. 20:42.350 --> 20:45.050 Yahoo is very strict about this. 20:45.050 --> 20:50.210 I take note of this and pass the final external test of Zaha mail. 20:50.210 --> 20:57.830 I'm gonna send email from mink at walloffship.com to defcomph3 at zahomail.com 21:09.370 --> 21:09.970 . 21:10.010 --> 21:12.130 Mail has been sent successfully. 21:12.610 --> 21:14.310 I'm checking the boxes. 21:18.850 --> 21:24.250 And no mail has been received, so Zaha mail is very strict about this, such as Yahoo. 21:24.770 --> 21:27.250 This was our last test. 21:27.250 --> 21:30.030 It's time to analyze the information we collect. 21:31.090 --> 21:35.210 As an example of my research, I caught a very interesting example. 21:35.230 --> 21:37.590 I want to present this to you. 21:37.830 --> 21:41.210 My friend was accepted by defcom Red Team Village. 21:41.210 --> 21:48.670 This news came to him from omar at redteamvillage.io. 21:48.750 --> 21:56.050 When I review this email, there's a warning in the Gmail proper photo area, just like our external test. 21:56.050 --> 22:01.290 My friend did not pay attention to this situation and answered this email. 22:01.930 --> 22:08.770 Fortunately, the mail really came from Omar, but this could be a fake mail. 22:08.910 --> 22:16.570 Now I'm gonna send an email from omar at redteamvillage.io to my friend gmail artist. 22:17.230 --> 22:27.630 We're gonna also carry out internal and external testing and look at the response of the email application on the Apple Mac device to this vulnerability. 22:28.570 --> 22:30.970 Let's send the mails. 22:30.970 --> 22:35.430 I'm gonna send these test mails from my second screen. 22:41.450 --> 22:50.390 As you can see, the mail from defcom at gmail.com also cancels a warning in the Gmail web application. 22:51.070 --> 23:00.830 However, in the email application of the Mac operating system, this mail does not cancels any warnings. 23:00.830 --> 23:03.290 This is a very interesting finding, too. 23:03.730 --> 23:14.890 In addition, the mail I sent from Omar successfully reached the application allowed me to pass whether I was Omar or not. 23:14.890 --> 23:20.670 Now, time to examine where this vulnerability is caused. 23:20.670 --> 23:24.470 Now I'm gonna show where the vulnerability originated. 23:24.470 --> 23:37.930 As I have shown before, we're gonna examine why third-party applications cannot detect this little warning in the profile photo area and why are they receiving this training mail cleanly from Gmail. 23:38.030 --> 23:40.250 Let's look at what's happening again. 23:40.250 --> 23:42.590 Hair.com does not have any warning. 23:43.430 --> 23:50.330 Also, HubSpot does not have any warning, too, as you can see. 23:51.050 --> 23:58.290 Mail that is perceived as dangerous in Gmail looks completely clean on these platforms. 23:58.290 --> 24:02.230 To show that, I'm gonna use Python library writing for the Gmail API. 24:02.230 --> 24:08.380 With this library, we're gonna check the email contents by making a request to the Gmail API. 24:09.130 --> 24:14.750 First, we need to learn the ID value of the message we want to link. 24:16.890 --> 24:20.190 And I think that should be it. 24:20.710 --> 24:24.010 I need to put this ID value into the library properly. 24:24.010 --> 24:26.950 We also need to use GET instead of LIST. 24:29.560 --> 24:31.450 It is now ready to make request again. 24:32.700 --> 24:37.000 As you can see, all the details of the mail are here. 24:37.120 --> 24:48.110 After a little examination, we realized that the warning in the Gmail web application is not among the information received with the Gmail API. 24:48.110 --> 25:01.810 Therefore, we have proved that third-party applications such as Hair.com, HubSpot, and Apple email applications cannot detect this warning because they use the Gmail API. 25:01.910 --> 25:11.490 There are dozens of applications using the Gmail API, so this vulnerability caused by Gmail affects them all. 25:11.490 --> 25:17.150 In this case, it leaves millions of people directly in danger. 25:17.710 --> 25:25.790 These applications which can connect with Gmail need to make a new update considering this situation. 25:25.890 --> 25:33.970 Once and for all, let's examine the result of our internal and external test again. 25:33.970 --> 25:37.330 Let's take a brief look at the result of our test. 25:37.330 --> 25:39.930 I'm going to summarize this part quickly. 25:40.010 --> 25:42.390 The meaning of the signs are here. 25:43.270 --> 26:08.530 In internal tests, training mails drops into the inbox with warning in Gmail and doesn't drop into any box in Yandex and doesn't drop into any box in Mail.ru and drops into the spam box in Outlook and doesn't drop into any box in Yahoo and doesn't drop into any box in Zahoomail too. 26:08.670 --> 26:36.730 In external tests, the training mails drops into the inbox without warning in Gmail and drops into inbox without warning in Yandex and drops into the inbox without warning in Mail.ru and drops into the spam box in Outlook and doesn't drop into any box in Yahoo and doesn't drop into any box in Zahoomail too. 26:36.770 --> 26:44.510 Unfortunately, third-party applications using APIs of famous mail providers cannot reflect warnings. 26:44.510 --> 26:49.450 Initially, the incoming email is forwarded directly without an error message. 26:49.750 --> 26:56.090 So, Hide.com forwarded training mails and mails dropped into the inbox without warning. 26:56.090 --> 27:03.610 Also, HubSpot forwarded training mails and mails dropped into the inbox without any warning too. 27:03.610 --> 27:06.370 This was the test result with it. 27:06.370 --> 27:11.170 I'm sharing an exclusive tool with you at the last stage of my presentation. 27:11.170 --> 27:13.490 Its name is DraftChat. 27:13.490 --> 27:17.170 DraftChat allows persons to chat throughout mail providers. 27:17.170 --> 27:23.570 You can access the GOD chat module, which is the first module and uses the Gmail API. 27:24.130 --> 27:32.350 DraftChat allows persons to chat throughout a single Gmail account in the Gmail that does not record drafts. 27:32.350 --> 27:43.790 It encrypts the sent message first with DES and then with the AES algorithm and writes them to the created draft. 27:43.830 --> 27:49.490 The message of person I've written in encrypted form on the same draft. 27:49.490 --> 27:54.850 Message can only be read with the correct case to be determined. 27:54.850 --> 27:59.230 In this way, a completely hidden chatroom is created with a single Gmail account. 27:59.230 --> 28:08.870 Therefore, DraftChat makes person-hundred private communication opportunity by turning a non-URL mail server into a chat server. 28:09.050 --> 28:13.510 You need to set up a common Gmail account to chat with your partner. 28:13.550 --> 28:17.650 Remember, you will only perform this operation once. 28:17.650 --> 28:22.350 You will not have to do this configuration every time you chat. 28:22.490 --> 28:26.870 Let's do the installation pace in a practical way. 28:26.870 --> 28:29.590 First step is turn on the Gmail API. 28:29.590 --> 28:35.430 First of all, we need to allow for quick start from our Gmail account, because we are using fighting quick start. 28:35.430 --> 28:38.090 Click on enable the Gmail API button. 28:38.090 --> 28:42.230 In this section, you should choose the desktop. 28:43.070 --> 28:51.310 In zone link dialog, click download client configuration and save the file credentials.json to your DraftChat directory. 28:51.310 --> 28:57.890 After running DraftChat, it will first ask you for your nickname. 28:58.030 --> 29:05.350 Once you have determined your nickname, you must determine whether you want to be a server or a client. 29:05.350 --> 29:08.090 Client-server relationship is very simple. 29:08.090 --> 29:15.090 If you want to be a server, the DES and AES keys that you determine will be used. 29:15.090 --> 29:21.910 If you choose to be a client, you have to get keys for these algorithms from your server partner. 29:21.910 --> 29:24.330 Let's say you choose the server option. 29:24.790 --> 29:40.690 After the retirement and 8-digit DES key, DraftChat generates a 16-digit random AES key for you and a new draft is created for the chat rooms that your client partner is expected. 29:40.690 --> 29:44.330 So you need to pass this case over to your partner. 29:45.070 --> 29:48.470 Let's take a look at the client option. 29:48.470 --> 29:51.590 In this case, I have taken an entrant from the server partner. 29:51.590 --> 29:58.090 If the keys are wrong, there is no server rating for the client, the program will give an error. 29:58.750 --> 30:02.430 The taken keys were entered and the information was verified. 30:02.430 --> 30:06.910 So you can communicate with your partner in peace of mind. 30:06.910 --> 30:14.830 When the draft box of our Gmail account is checked, you can see that a new draft has been created here. 30:14.990 --> 30:22.770 All messages are written here and the draft is continuously encrypted with algorithms. 30:22.770 --> 30:26.290 We can test this by writing a new message. 30:28.450 --> 30:30.330 It's for grids. 30:30.770 --> 30:40.030 The fact that you are offered a private chat room does not mean that the communication you provide while using this tool may be illegal. 30:40.110 --> 30:44.250 Remember that all the responsibility belongs to you. 30:44.490 --> 30:46.850 You can download DraftChat from GitHub. 30:46.850 --> 30:48.990 It also opened the development. 30:48.990 --> 30:53.110 You can contribute to this tool if you wish. 30:53.110 --> 30:55.010 Yes guys, now it's over. 30:55.010 --> 30:56.670 Thank you so much for listening to me. 30:56.670 --> 31:02.230 You can contact me from my social media accounts and you can ask your question whenever you want. 31:02.230 --> 31:06.550 I was honored to be here at DEF CON 28 Package Hacking Village. 31:06.550 --> 31:12.350 I hope to present my research at that best hacking conference in the world next year again. 31:12.370 --> 31:14.270 I wish healthy days to everyone. 31:14.270 --> 31:15.110 Best regards. 31:15.110 --> 31:15.950 Goodbye.