1
00:00:00,000 --> 00:00:02,100
supporting the Red Team Village.

2
00:00:02,140 --> 00:00:04,120
We're very honored to have you here.

3
00:00:04,120 --> 00:00:06,340
And with that said, take it away.

4
00:00:06,680 --> 00:00:10,400
Well, hello everybody, and good morning if you're just waking up.

5
00:00:10,400 --> 00:00:16,800
I am so happy to be giving this presentation at the Red Team Village at DEF CON Safe Mode this year.

6
00:00:16,800 --> 00:00:23,100
Coming to you live from my tiny little Amsterdam house.

7
00:00:23,220 --> 00:00:27,780
And hopefully I can bring some energy and wake some people up.

8
00:00:27,780 --> 00:00:29,860
So this is called Pwn the World.

9
00:00:30,360 --> 00:00:33,440
So if you don't know much about me, my name is Chris Kubeka.

10
00:00:33,440 --> 00:00:38,720
And I am the CEO of two companies, one in the UK and one in the Netherlands.

11
00:00:38,720 --> 00:00:43,360
It deals with critical infrastructure protection and high-level incident response.

12
00:00:43,360 --> 00:00:50,780
I'm also a Distinguished Non-Resident Fellow at the Middle East Institute for the Cyber Program, dealing with a lot of these issues in the Middle East.

13
00:00:50,960 --> 00:01:00,380
My areas of main concentration are critical infrastructure, lots of different ICS, industrial IoT, and especially cyber warfare.

14
00:01:00,380 --> 00:01:06,320
I've been involved with several high-level cases of cyber warfare in the past, and continue to do so.

15
00:01:06,340 --> 00:01:14,360
Previous to this, I headed the Information Protection Group and International Intelligence Group for the Aramco family.

16
00:01:14,760 --> 00:01:24,940
And not that many years ago, I won't date myself, I was an air crew member, and also with Space Command, dealing with command and control systems.

17
00:01:25,440 --> 00:01:29,940
So, let's briefly talk about what a control system is.

18
00:01:29,940 --> 00:01:46,040
Because this is my favorite part of technology, where you get to actually move things, or set things in motion, to where once you program something, it then has a set series of responses that it does.

19
00:01:46,040 --> 00:02:08,040
We see this everywhere, inside your home, inside power plants, inside aircraft, inside space assets, all sorts of industrial things, like the manufacture of masks, and even your coffee maker is, in and of itself, a control system.

20
00:02:08,040 --> 00:02:11,000
And hopefully everybody's had loads of coffee today.

21
00:02:11,000 --> 00:02:12,380
Believe it or not, I haven't.

22
00:02:12,380 --> 00:02:13,900
That's okay.

23
00:02:13,900 --> 00:02:17,300
So, some of the things that we have to remember is this.

24
00:02:17,880 --> 00:02:37,780
The previous speaker was talking about Zoom, and we're actually coming to you live over Zoom and Twitch, is that when we're talking about technology, we have to think of the fact that a lot of technology is pushed out there as quickly as possible to gain some sort of edge in the market.

25
00:02:37,780 --> 00:02:42,480
So, it's quite common to have what I call profits over vulnerabilities.

26
00:02:42,480 --> 00:02:50,220
And when we're dealing with control technology, there's also a lot of legacy devices.

27
00:02:50,440 --> 00:03:04,960
Good for instance is the BART public transport system inside and outside part of San Francisco has such old legacy equipment, they have to look on eBay to get any sort of replacements.

28
00:03:04,960 --> 00:03:11,140
And I've dealt with other public transport companies where they've got signaling systems that are almost 50 years old.

29
00:03:11,140 --> 00:03:16,560
Since they can no longer find these systems, they actually have to fabricate them.

30
00:03:16,560 --> 00:03:23,300
And they've been trying to update them and turn them into IoT systems, which has been extremely challenging.

31
00:03:23,600 --> 00:03:38,900
When you build a power plant, you expect that power plant, after you've spent millions, hundreds of millions sometimes, or if you're talking about nuclear power, billions, you expect that type of hardware and the software running it to last for quite some time.

32
00:03:38,900 --> 00:04:01,240
Of course, there's a mismatch because when we start integrating, as we have already in the past, say Windows systems into hardware that's meant to last 10, 20, 30 years sometimes, you obviously get this mismatch and vulnerabilities are introduced into this type of hardware.

33
00:04:02,280 --> 00:04:08,880
Now, the longer something is up and running, the more things end up getting plugged into it.

34
00:04:08,880 --> 00:04:12,020
And many companies, governments, etc.

35
00:04:12,060 --> 00:04:20,120
don't know that they've got orphan servers that are hanging out there, that they had some sort of connection that one person knew about.

36
00:04:20,120 --> 00:04:25,760
It could be anything from something stuck in a closet to run reports.

37
00:04:25,760 --> 00:04:42,200
There's one case where they only found out at one organization about this because they were renovating the office building and they found in the wall a couple of cables, a power cable and a network cable, broke the wall down and in there was a reporting server.

38
00:04:42,200 --> 00:04:44,540
So these types of things happen.

39
00:04:44,760 --> 00:04:54,400
But at the same time, we also have to remember that our modern world is most definitely driven on technology and digitization.

40
00:04:54,460 --> 00:05:01,000
And that can also come with a bit of a cost when we discuss geopolitics.

41
00:05:01,000 --> 00:05:05,920
Not everyone is friends and sometimes your friends are actually frenemies.

42
00:05:05,940 --> 00:05:16,700
And we have to realize that we have become as dependent on ICT systems as we have on oxygen at this point in time.

43
00:05:16,700 --> 00:05:22,080
Funny enough, oxygen is produced in a controlled system environment.

44
00:05:22,140 --> 00:05:27,900
Now, to make matters even worse, lots of different companies, organizations, etc.

45
00:05:27,900 --> 00:05:29,480
deal with third parties.

46
00:05:29,480 --> 00:05:34,160
You can't manufacture a program and do everything yourself in a closed bubble.

47
00:05:34,280 --> 00:05:43,940
And sometimes that means that there could be, like in the Target situation, an HVAC company who had access to Target.

48
00:05:43,940 --> 00:05:47,420
And unfortunately, they were used as a conduit for attack.

49
00:05:47,800 --> 00:05:55,820
So we have to think about these things when we think about some of the risks and security challenges with control systems and technology.

50
00:05:55,820 --> 00:05:59,380
So, I deal a lot with critical infrastructure.

51
00:05:59,380 --> 00:06:03,780
And that's the type of stuff that really keeps the modern world going.

52
00:06:03,780 --> 00:06:09,660
But interestingly enough, there's no international consensus as to what critical infrastructure is.

53
00:06:09,660 --> 00:06:14,180
I was on a recent call doing a presentation for the United Nations.

54
00:06:14,220 --> 00:06:21,780
And I brought up with one of the presenters that, because I live in the Netherlands, we're the second largest food exporter in the world.

55
00:06:21,780 --> 00:06:28,340
It's a tiny country, 17 million people, but we produce and export number two in the world.

56
00:06:28,340 --> 00:06:36,140
And the reason for that is our farmers have drones and robots, and it's highly sophisticated.

57
00:06:36,140 --> 00:06:42,100
So we've got a lot of industrial IoT systems and ICS systems that are mixed in.

58
00:06:42,540 --> 00:06:50,420
And I brought up the fact that for the Netherlands, for example, that agriculture should be considered part of critical infrastructure.

59
00:06:50,420 --> 00:06:54,200
Of course, this varies from country to country, region to region.

60
00:06:54,280 --> 00:07:07,460
I would not expect Mongolia to think of port security as critical infrastructure, but I would here in the Netherlands or the United States or any place that has a lot of different ports that they depend on.

61
00:07:07,740 --> 00:07:18,460
So, one of the reasons why some of this stuff is so insecure is the companies who make the hardware and or software are not in security.

62
00:07:18,460 --> 00:07:24,940
They're in it to make things interoperable so that they work together and produce what they're supposed to do.

63
00:07:24,980 --> 00:07:37,900
And another very interesting factor is when you're dealing with control systems, we've seen this triad, the triangle, excuse me, of CIA, where confidentiality is queen.

64
00:07:37,900 --> 00:07:42,260
However, in the industrial world, availability is.

65
00:07:42,260 --> 00:07:52,360
So, if you have to pile on things like encryption or lots of authentication, you can cause a latency to encrypt, decrypt, encrypt, decrypt, etc.

66
00:07:52,520 --> 00:07:59,500
And from the moment you press a button or send what's called a sec command, you want that to go through the system as quickly as possible.

67
00:07:59,500 --> 00:08:05,120
And unfortunately, that means that security is actually the bottom part.

68
00:08:05,120 --> 00:08:08,480
It's availability, integrity, and confidentiality.

69
00:08:08,480 --> 00:08:12,740
That's the order that it goes with critical infrastructure and control systems.

70
00:08:12,740 --> 00:08:21,640
Now, another major factor is that the vast majority of critical infrastructure and control systems are privately owned.

71
00:08:21,640 --> 00:08:32,780
So, there are limitations to what a government can regulate, legislate, and dictate to a company because there are going to be costs associated with securing this infrastructure.

72
00:08:32,980 --> 00:08:44,520
And we have to ask the question, how much does water cost right now versus less risky water infrastructure?

73
00:08:44,520 --> 00:08:56,320
Or are hospitals going to have to choose between tightening up and securing their ICT systems, which are included in a lot of medical IoT devices and built-in control systems?

74
00:08:56,320 --> 00:09:02,220
Or are they going to buy a ventilator or an MRI machine, etc.?

75
00:09:02,220 --> 00:09:06,860
So, there is an absolute cost associated with this.

76
00:09:06,860 --> 00:09:11,160
But at the same time, we're absolutely dependent on this stuff.

77
00:09:11,880 --> 00:09:21,140
So, the other day, for this presentation, what I did was I used Census to do a massive scan across the internet using their ZMap project.

78
00:09:21,140 --> 00:09:35,360
And I was trying to concentrate on things that I could immediately find that were related to industrial IoT, control systems, and things of that nature.

79
00:09:35,380 --> 00:09:38,740
And the problem is, I found a heck of a lot.

80
00:09:38,740 --> 00:09:41,140
And this was just the top ten things.

81
00:09:41,140 --> 00:09:54,080
As you'll notice, there's a lot of SCADA systems, which are Supervisory Control and Data Acquisition, which connect a lot of the backbone, so to speak, of ICS systems, built-in control systems.

82
00:09:54,080 --> 00:09:58,460
These can vary from security stations.

83
00:09:58,880 --> 00:10:03,420
A lot of police departments use these, especially in the United States and China.

84
00:10:04,080 --> 00:10:11,000
Also, HVAC, my personal favorite protocol for control systems, which is Modbus.

85
00:10:11,000 --> 00:10:12,680
I'll tell you why in a moment.

86
00:10:12,760 --> 00:10:17,120
So, there's a lot of these things that are exposed on the internet right now.

87
00:10:17,120 --> 00:10:24,260
And when I say, please hack me, the reason being is, even if you've got a modern system, yay!

88
00:10:24,260 --> 00:10:39,480
And when it comes to the point of, hey, we have a patch, we need to update this, a lot of organizations won't do that very quickly, because they're afraid that it will lose that interoperability function.

89
00:10:39,560 --> 00:10:47,880
And you don't want to do that in, I don't know, a water processing plant, and then knock out everybody's water for a short time.

90
00:10:48,840 --> 00:11:01,680
So, one of the reasons why I like Modbus is, when it was created, it was created a long time ago, there is no real, really, any authentication or security.

91
00:11:02,380 --> 00:11:09,340
And here, this protocol, because it was made open source, was adopted like crazy.

92
00:11:09,800 --> 00:11:16,560
As quickly adopted as Zoom was during the pandemic, basically, because it didn't cost any money to do so.

93
00:11:16,560 --> 00:11:20,420
And it communicates between different types of equipment.

94
00:11:20,420 --> 00:11:23,620
It's got to be on the same network, though.

95
00:11:23,780 --> 00:11:31,400
It will also transmit all sorts of data between a SCADA system and what's called a remote access terminal unit.

96
00:11:32,020 --> 00:11:37,580
One of my other favorite features is the fact that it uses ladder logic, very much like a firewall.

97
00:11:37,580 --> 00:12:04,440
And if any of you have seen a firewall with 2,000 plus different rules, you'll know that if part of that ladder logic is not done correctly, then your security settings in that firewall, just like the ladder logic, will actually moot and make the oncoming settings absolutely useless.

98
00:12:04,440 --> 00:12:11,220
And it also has a slave to master architecture.

99
00:12:11,320 --> 00:12:13,140
So it's kind of old school.

100
00:12:13,140 --> 00:12:20,620
Some of the things that you'll see using Modbus are PLCs, or programmable logic controllers, remote terminal units.

101
00:12:20,620 --> 00:12:30,650
There are actually some modems, industrial modems that still use this, as well as parts of some systems with certain types of SMS.

102
00:12:30,650 --> 00:12:36,890
And old school paging, which happens to be used in a lot of hospitals still.

103
00:12:37,430 --> 00:12:44,450
And there is some safety equipment that is actually used with Modbus, but less and less nowadays.

104
00:12:44,810 --> 00:12:47,970
So I'm going to start introducing you to some tools.

105
00:12:47,970 --> 00:13:03,910
Because see, Modbus, although some versions of it can run over TCP, IP4, it's not, say, directly translatable, meaning everything is in hexadecimal code.

106
00:13:03,910 --> 00:13:18,130
And also a lot of the regular IT-based hacker tools and scanners can't actually reach in really, really deep to see anything past, hey, this port's open.

107
00:13:18,330 --> 00:13:23,270
So we have to use some additional tools to get what we need.

108
00:13:23,270 --> 00:13:36,670
One of the things I like about the tools that I'll be showing you is the fact that they are absolutely legitimate tools that would not trigger, say, an antivirus alert or a potentially unwanted program.

109
00:13:36,750 --> 00:13:44,730
On the contrary, they would be expected to be used as a technician or engineer in many of these different environments.

110
00:13:46,810 --> 00:13:54,130
And all of the tools that I'll be showing are free as well if you want to get started.

111
00:13:54,990 --> 00:14:17,750
So Chipkin has this wonderful Modbus scanner and what you do is once you can find something that says, hey, I got port 502 open and my banner says Modbus, you go ahead and you plug in the IP address and it will then look even deeper and what it will show you is everything that's on its network behind that IP address.

112
00:14:17,750 --> 00:14:25,010
So in this particular case, it isn't just one thing that's at the IP address, it's multiple things that are at the IP address.

113
00:14:25,010 --> 00:14:30,330
And we'll also show you different things like functions, which are very important in Modbus.

114
00:14:31,350 --> 00:14:47,250
Now, another thing that I like, this one again is free from plcdatatools.com, is once you find an IP address, it will go ahead and scan it and tell you which type is actually running.

115
00:14:47,250 --> 00:14:54,270
And sometimes you can get even more information than just what you're seeing right now on your screen.

116
00:14:54,270 --> 00:15:12,450
So in this case, I took an IP address and went ahead and scanned and found the firmware version, if it's running, obviously it's running, what the code is, which is a manufacturer code, and also picked up the fact that it is running something called Siemens S7.

117
00:15:12,450 --> 00:15:16,890
And this is a proprietary protocol created by Siemens.

118
00:15:16,890 --> 00:15:30,110
If you've never heard of Siemens S7, this was the type that was running in the Iranian nuclear enrichment program when Spexnet hit it.

119
00:15:30,110 --> 00:15:35,640
So a PLC programmable logic controller running Siemens S7.

120
00:15:35,640 --> 00:15:50,780
And this is quite handy, too, because if you find things that have not been updated, which the vast majority have not been updated recently, you can also couple those with various exploits that are known and use them against them.

121
00:15:50,780 --> 00:16:08,040
And another thing is because it's kind of slow to do a lot of these security updates and also although Siemens does a lot nowadays for ICS security, you can use some of the exploits on multiple firmware and model numbers.

122
00:16:08,440 --> 00:16:12,840
So it's quite groovy to do this.

123
00:16:12,840 --> 00:16:14,560
Of course, only do it legally.

124
00:16:14,560 --> 00:16:29,580
And to show you, for instance, I ran across this when I was helping with some of the NATO and European Union member state cyber warfare exercises in Brussels not too long ago.

125
00:16:29,580 --> 00:16:41,640
And what I found was this is an actual power station that I found using Shodan and when I went to look further with various other tools and of course with permission.

126
00:16:42,000 --> 00:16:56,280
On that power plant and on the piece of Modbus hardware that they have, they also had, unfortunately, a remote access Trojan called Extreme RAT installed.

127
00:16:56,280 --> 00:17:02,720
And you can see the banner that shows for this particular version of Extreme RAT.

128
00:17:02,720 --> 00:17:10,440
So these things are already present and some power stations and water facilities and etc.

129
00:17:10,840 --> 00:17:22,620
Now, another very common control protocol is BACnet and many of us have various different types of thermostats that are digital.

130
00:17:22,620 --> 00:17:25,360
And this is just one way that you can use BACnet.

131
00:17:25,360 --> 00:17:27,920
It's used in a variety of different ways.

132
00:17:28,360 --> 00:17:37,260
And if we take a look at this simple thermostat, we can break down what some of the digits actually mean.

133
00:17:37,980 --> 00:17:45,600
And what we can do is flip that around and find some of these objects directly connected to the internet.

134
00:17:45,700 --> 00:17:51,820
And BACnet does have some security features, but not that many.

135
00:17:52,660 --> 00:18:14,260
So if I break down looking at census.io, these are the different types of BACnet fields that you can find, which is quite groovy because if you want to, for instance, look at only certain firmware revisions, or application software revisions, or model names,

136
00:18:14,260 --> 00:18:19,960
or vendor IDs, you can go ahead and zoom into these.

137
00:18:19,960 --> 00:18:27,740
Because every vendor that uses BACnet, similar to Modbus, has to have a registered vendor ID.

138
00:18:30,380 --> 00:18:39,500
So a groovy tool that I like to use with BACnet to look even further is from Contemporary Controls BACnet Discovery Tools.

139
00:18:39,500 --> 00:18:41,160
And again, this is free.

140
00:18:41,160 --> 00:18:44,660
Unfortunately, most of these tools require Windows.

141
00:18:44,660 --> 00:18:48,800
It's because there's a lot of Windows in control environments.

142
00:18:48,800 --> 00:19:02,140
And you can install this groovy tool, and it does something similar to the Modbus scanner tool from Chipkin, where it will show everything that's connected on the back end to the BACnet tool.

143
00:19:02,140 --> 00:19:08,700
And it will also show, for instance, those object names, which is temperature.

144
00:19:08,700 --> 00:19:11,560
And this is quite handy.

145
00:19:11,640 --> 00:19:20,950
Also, another thing to add is BACnet uses port 47808 and uses UDP predominantly.

146
00:19:22,360 --> 00:19:29,080
So this is a very interesting protocol because it has gotten very, very big.

147
00:19:29,080 --> 00:19:32,340
And it is used in all sorts of places.

148
00:19:32,340 --> 00:19:42,660
And it's also had some noted security issues where it's taken time for the people behind Tritium to actually issue patches.

149
00:19:43,220 --> 00:19:46,740
It is driven on Java, Java, Java.

150
00:19:46,740 --> 00:19:50,380
And it could be in your elevator.

151
00:19:50,380 --> 00:19:54,540
It could be in a private or police security station.

152
00:19:54,940 --> 00:19:56,980
It could be in your airport.

153
00:19:56,980 --> 00:19:59,600
Luckily, not many of us can fly, right?

154
00:19:59,600 --> 00:20:02,820
It can be in a bit of everywhere.

155
00:20:02,940 --> 00:20:08,980
And think about some of the mayhem that could be done if you were able to get into some of these different devices.

156
00:20:10,640 --> 00:20:14,820
So it goes kind of by two names, Tritium or Fox Protocol.

157
00:20:14,960 --> 00:20:18,580
And on Census, here's some of the things you can pick up on.

158
00:20:18,840 --> 00:20:24,900
You can pick up on the application version, so you can go ahead and map that to any known exploits.

159
00:20:24,900 --> 00:20:33,800
Or actually download the package yourself and then in your home lab, of course, with permission.

160
00:20:34,040 --> 00:20:38,860
You can start fooling around with some of this stuff to see what else you can find.

161
00:20:38,860 --> 00:20:47,200
You can do the host ID, which is quite handy in many different ways, the ID version, station name, etc.

162
00:20:47,520 --> 00:20:53,700
And you can do a lot with this particular profile, excuse me, protocol.

163
00:20:53,700 --> 00:20:56,620
So I like to have a lot of fun with Fox.

164
00:20:57,640 --> 00:21:05,980
And one of the ways that you can look at some of these systems, with permission, of course, is there is a free product for download.

165
00:21:05,980 --> 00:21:07,940
This will also run on Linux.

166
00:21:08,980 --> 00:21:18,660
And what it does is it's open source, Java based, and it will basically connect to any embedded system that's running it.

167
00:21:18,660 --> 00:21:26,920
And it tries to keep it vendor neutral, so it won't just be vendor A, B, and C, but not D.

168
00:21:26,920 --> 00:21:29,480
It will basically connect to anything.

169
00:21:29,620 --> 00:21:37,860
And even though there are some security settings, a lot of organizations have not actually set them up.

170
00:21:37,860 --> 00:21:38,820
Yay!

171
00:21:39,240 --> 00:21:40,980
Please help me.

172
00:21:41,720 --> 00:21:47,200
And in addition to that, I wanted to list a few more tools that might interest you.

173
00:21:47,200 --> 00:21:48,900
And these are free.

174
00:21:48,940 --> 00:22:01,640
Chipkin is an organization that does a lot with technicians that deal with MacNet, Modbus, and a few other, we'll say, more industrial IoT and control systems.

175
00:22:01,640 --> 00:22:08,620
And they've got a bevy of tools, which is fantastic, because they also do not security test their tools.

176
00:22:08,620 --> 00:22:16,620
And you can weaponize them even further, if you would like, in a controlled manner, legally only.

177
00:22:17,460 --> 00:22:18,820
I am not a lawyer.

178
00:22:18,820 --> 00:22:20,000
Remember that.

179
00:22:21,000 --> 00:22:27,000
So, not long ago, I got this very interesting offer.

180
00:22:27,300 --> 00:22:33,500
And one thing to remember about control systems, it's similar to what you may have heard of with cars.

181
00:22:33,560 --> 00:22:35,500
A can bus is a can bus.

182
00:22:35,500 --> 00:22:38,100
Well, a control system is also a control system.

183
00:22:38,100 --> 00:22:41,340
So even boats have these different things.

184
00:22:41,340 --> 00:22:49,640
So when I talk about a boat, it's a really big boat, like liquid gas transport or cargo ships.

185
00:22:50,140 --> 00:22:59,700
And there was an organization I was working with as an advisor that specialized in maritime security.

186
00:23:00,200 --> 00:23:03,340
And they were trying to get the cyber part started.

187
00:23:03,340 --> 00:23:21,800
The majority of the stuff they did was maritime intelligence, trying to find ships that go dark on purpose, turning off their identification transponders so they can, I don't know, smuggle arms, people, refuse to rescue people in the Mediterranean, if they're refugees,

188
00:23:21,800 --> 00:23:23,580
little things like that.

189
00:23:23,580 --> 00:23:34,760
So we got an offer to hack a very, very large boat worth almost 200 million pounds.

190
00:23:35,240 --> 00:23:44,080
And of course, me thinking, hmm, what are all of the lovely things that could go wrong with a very, very large boat?

191
00:23:44,480 --> 00:23:46,940
So I made a few conditions.

192
00:23:46,940 --> 00:23:52,620
One of them was when we stole the boat, I got to wear an eyepatch.

193
00:23:52,620 --> 00:24:02,720
Secondly, I got to say, once the boat was, I should say, liberated, I got to say, look at me, look at me.

194
00:24:02,720 --> 00:24:06,460
I am the captain now, wearing my eyepatch.

195
00:24:06,460 --> 00:24:18,200
And one of the things you have to remember about maritime is there's a lot of legacy stuff, just like industrial protection systems.

196
00:24:18,200 --> 00:24:30,580
So fun fact, really big ships, their control mechanism is actually controlled via the civilian band of GPS.

197
00:24:30,580 --> 00:24:36,360
And there are already known ways to exploit the civilian band.

198
00:24:36,360 --> 00:24:39,800
These are not tied to the military GPS control.

199
00:24:39,800 --> 00:24:44,420
So the captain of a ship does control the ship.

200
00:24:44,420 --> 00:24:52,970
However, the majority of where the ship goes is actually controlled with the civilian GPS control system.

201
00:24:53,520 --> 00:25:21,800
Another thing about maritime is a lot of them use different forms of something called Windows CE, which depending on the age of the ship and the last time it's been retrofitted, it could be using versions that are based off of Windows XP, Windows 7, and only the newest and greatest stuff is going to be based off of Windows 10.

202
00:25:21,960 --> 00:25:34,020
And one of the things that concerns many people about Windows CE is it is for embedded systems and it's in compact edition.

203
00:25:34,020 --> 00:25:36,980
It doesn't have all the bells and whistles.

204
00:25:37,180 --> 00:25:44,900
So out of the box, it's not going to be logging everything that you would expect with professional edition.

205
00:25:44,920 --> 00:25:53,060
It's also going to be slower to patch from Microsoft because they know that a lot of industrial systems use these.

206
00:25:54,540 --> 00:26:02,240
And there's a bevy of wonderful mayhem that can be done with various different types of Windows CE.

207
00:26:02,240 --> 00:26:11,040
Another thing to consider when we're talking about maritime is there are multiple entry and exit points on a large ship.

208
00:26:11,040 --> 00:26:15,740
They have to keep in contact with a lot of different things.

209
00:26:15,740 --> 00:26:28,200
There's something called the AIS system, two different forms that was mandated for larger ships to use to avoid hitting other ships, which is kind of nice.

210
00:26:28,200 --> 00:26:36,480
But it also automatically has contacts with things like buoys, land stations, and other things.

211
00:26:36,480 --> 00:26:48,160
And the AIS protocol... background, I've been building a few tools because I know that there are various security issues with that particular protocol.

212
00:26:48,160 --> 00:26:55,320
And that's one of the ways that the ship in question was liberated.

213
00:26:56,240 --> 00:27:03,640
Then you also have VSAT systems, UHF systems sometimes, and different other types of communications.

214
00:27:04,780 --> 00:27:12,900
And one of the problems with these is, again, they might be legacy, but also the manufacturers are not in the security business.

215
00:27:12,900 --> 00:27:24,620
So I can find, for instance, VSAT systems directly connected to the internet that's giving way too much information that could then be turned around and remotely controlled.

216
00:27:24,620 --> 00:27:27,890
Because they're exploitable in many cases.

217
00:27:28,340 --> 00:27:47,910
And even where there is security, several of the major manufacturers for some of these, including some of the 3G, 4G modems that are also in use with the larger ships, is they'll use what's called known private keys, which equals, I tried to encrypt, but not really.

218
00:27:48,240 --> 00:27:51,580
So even boats can be yours.

219
00:27:51,580 --> 00:27:54,780
Now, many of us are not in Vegas.

220
00:27:54,780 --> 00:27:56,840
I'm in my tiny house in Amsterdam.

221
00:27:57,260 --> 00:28:00,880
And we've done a lot of increased teleworking.

222
00:28:00,880 --> 00:28:03,420
Everything is remote now.

223
00:28:03,420 --> 00:28:06,340
Here's a new hashtag, bring your own house.

224
00:28:06,340 --> 00:28:17,440
Because the regular, say, office or power plant security is now in your living room or in your home office.

225
00:28:17,440 --> 00:28:33,360
Many people have to share their home network with their partners, their Roomba, in my case, my partner, children, or especially if you're stealing your neighbor's Wi-Fi to watch this presentation right now.

226
00:28:33,400 --> 00:28:37,340
But when you have to do work, let's say you're doing sensitive stuff.

227
00:28:37,340 --> 00:28:44,800
Let's say you are a process engineer that can't go into your place of work and have to do things more and more remote.

228
00:28:44,800 --> 00:28:46,360
Guess what?

229
00:28:46,360 --> 00:28:48,800
Your infrastructure could be mine.

230
00:28:49,240 --> 00:28:59,520
Because one of the problems is when things are rapidly set up, especially during a pandemic, they might not be using the newest, greatest, most patched and updated things.

231
00:29:00,320 --> 00:29:12,500
And another thing to consider is a lot of production and industrial systems, the manufacturers will just pick one out of the air, Honeywell, for example, they'll say, hey, we have all this equipment at your plant.

232
00:29:12,680 --> 00:29:28,180
But to maintain the warranty on the service agreement, when you paid all this money for this plant, we need a direct connection to constantly pull data and look at the infrastructure to make sure everything is working correctly.

233
00:29:28,640 --> 00:29:32,800
By the way, we're going to use a really old version of BNC.

234
00:29:32,800 --> 00:29:39,580
And all of our technicians use the same exact credentials to connect to all of our worldwide customers.

235
00:29:39,580 --> 00:29:40,380
Yay!

236
00:29:40,820 --> 00:29:44,180
Otherwise known as a technician backdoor in these cases.

237
00:29:44,180 --> 00:29:47,980
And if you say, hey, Honeywell, you know, that's not very secure.

238
00:29:47,980 --> 00:29:50,580
And they're like, hey, you know what's even less secure?

239
00:29:51,300 --> 00:29:55,060
Not having a warranty on all of your hardware.

240
00:29:55,260 --> 00:30:00,060
And you're like, oh, yeah, we'll be using that old version of BNC.

241
00:30:02,080 --> 00:30:16,240
So with this wonderful 2020 trying to kill this pandemic really hit, I went ahead and scanned the Internet and took the top 10 countries with assets that say hello to the Internet.

242
00:30:16,440 --> 00:30:18,780
And that's in the yellowish.

243
00:30:18,900 --> 00:30:23,400
I'm not sure how much you can see because of the big DEF CON logo.

244
00:30:23,400 --> 00:30:34,060
And in the orangish bar, those are remote only access protocols that I was looking for and also certain versions.

245
00:30:34,060 --> 00:30:41,600
Like older versions of SSH, FTP, remote desktop protocol, etc.

246
00:30:41,720 --> 00:30:49,700
So what I found was, for instance, the United States has 47,500,000 assets.

247
00:30:49,700 --> 00:31:04,640
Out of those assets, when I was looking only for known exploitable remote access vulnerabilities, there were almost 12.5 million ones that I could find for the United States, which is not a great ratio.

248
00:31:04,680 --> 00:31:10,400
However, I will say that some of the assets that I scanned, they can have multiple vulnerabilities.

249
00:31:11,360 --> 00:31:13,700
Looking at between the U.S.

250
00:31:13,700 --> 00:31:26,640
and China, China has almost 8.5 million assets on the Internet that say hello, but almost 5 million of those are remotable with no exploits and vulnerabilities in them.

251
00:31:27,300 --> 00:31:38,880
The one country that did fairly well was actually the United Kingdom with their ratio between assets and exploitable vulnerabilities.

252
00:31:38,880 --> 00:31:45,540
And one of the reasons for that was several years ago, they did something very fantastic.

253
00:31:45,540 --> 00:31:53,800
They instituted this thing, a cyber program for anyone doing business with the U.K.

254
00:31:53,800 --> 00:32:08,200
and also critical infrastructure, had to really take a look at their stuff and go ahead and pass an audit, in most cases a self-audit, depending on your level of access with the government and also critical infrastructure.

255
00:32:08,200 --> 00:32:17,540
And they were able to get a head start and so they actually are doing fairly well in comparison to the rest of the top tenors.

256
00:32:18,560 --> 00:32:33,940
So another thing that we have to consider is because things are now industrial IoT devices or IoT devices, this means that you can have a control system that is IoT enabled.

257
00:32:33,940 --> 00:32:39,220
Now in this case, I like to take a look at Tesla stuff because I just do.

258
00:32:39,560 --> 00:32:50,100
And you can actually use census.io, what I call census.org, to find various Tesla power walls.

259
00:32:50,100 --> 00:32:57,820
And what's interesting about this is even though Tesla has some security, it's still single factor authentication.

260
00:32:57,820 --> 00:33:00,040
There's still a web interface.

261
00:33:00,040 --> 00:33:04,160
The customer doesn't necessarily have to set up any real security.

262
00:33:04,160 --> 00:33:10,120
So there's admin-admin kind of stuff, depending on the version of the software.

263
00:33:10,120 --> 00:33:20,280
Tesla does not force down updates like Windows 10 or their cars, so there are a lot of old versions.

264
00:33:20,280 --> 00:33:25,640
And what you can actually pull back is the configuration of the power walls.

265
00:33:25,780 --> 00:33:34,920
Versions, timestamps, showing the last login, how long it's been up, if it's updating or not, and a bevy of other diagnostic information.

266
00:33:35,200 --> 00:33:47,560
And what's unfortunate is if you're able to get into some of these systems, which you can, you can do more nefarious things.

267
00:33:47,560 --> 00:33:55,360
Like imagine a region of power walls that suddenly all of their electricity got dumped on the energy grid.

268
00:33:55,360 --> 00:33:57,320
That would be a very bad thing.

269
00:33:57,320 --> 00:34:05,600
Or if it was connected to some sort of crucial hardware, that would be a bad thing.

270
00:34:05,600 --> 00:34:10,200
And in this particular case, this one was connected to a crane.

271
00:34:10,200 --> 00:34:12,600
Who doesn't want to own their own crane?

272
00:34:12,600 --> 00:34:14,260
Well, you can too.

273
00:34:14,260 --> 00:34:27,720
So, you have to understand that if it's running a web server, I don't care if it's a power bank or a piece of industrial equipment or whatever, you can hack it like a web server.

274
00:34:27,720 --> 00:34:28,920
Remember that.

275
00:34:29,720 --> 00:34:32,760
So, I do a lot in aviation.

276
00:34:33,200 --> 00:34:37,700
Sometimes that's good, sometimes they hate me.

277
00:34:38,580 --> 00:34:45,560
So, either way, you know, so there are various ways to get into various things.

278
00:34:45,560 --> 00:34:50,660
And one of the dangers that we have is a lot of remote desktop protocol.

279
00:34:50,660 --> 00:35:02,940
You can actually buy exploited systems on the scary dark web from a dollar to ten dollars a piece if they have RDP.

280
00:35:02,940 --> 00:35:05,380
Ten dollars is for typically U.S.

281
00:35:05,380 --> 00:35:07,400
military assets that are found.

282
00:35:07,400 --> 00:35:15,060
In this case, this one belongs to Airbus, where luckily the admin happens to be logged in.

283
00:35:15,060 --> 00:35:17,840
I wonder what the password might be.

284
00:35:18,260 --> 00:35:24,900
And the CN is actually the certificate, which I could match up to absolutely belonging to Airbus.

285
00:35:25,040 --> 00:35:33,860
Another fun fact is depending on the aircraft, some Airbus aircraft actually use Windows CE in their aircraft.

286
00:35:33,860 --> 00:35:34,980
Yay!

287
00:35:36,360 --> 00:35:46,440
So, I'm not sure you may or may not have heard much about Boeing other than some of their planes like to fall from the sky because they have software issues.

288
00:35:46,660 --> 00:36:00,700
And starting last year, one of the things I did, and by the way, hi Boeing, I know you still want to put me in jail, was that I took a look around some of their infrastructure and found that it was incredibly bad.

289
00:36:00,700 --> 00:36:09,980
For instance, at the time, Boeing.com and its websites didn't even use HTTPS or any encryption for their websites.

290
00:36:09,980 --> 00:36:12,040
And this included login systems.

291
00:36:12,040 --> 00:36:12,960
Yay!

292
00:36:13,640 --> 00:36:34,360
I was able to get into the R&D section of their flight control software, which also included the 737 MAX aircraft, because to authenticate, I was using Firefox with no script running, and the website had a message, you are not running scripts, please press this button.

293
00:36:34,360 --> 00:36:35,500
Press the button.

294
00:36:35,500 --> 00:36:36,640
I was in!

295
00:36:36,640 --> 00:36:38,540
How awesome is that?

296
00:36:38,660 --> 00:36:48,040
There were, you know, six cross-site scripting vulnerabilities in the live in-production flight control aviation ID system.

297
00:36:48,040 --> 00:36:48,820
Woo-hoo-hoo!

298
00:36:48,820 --> 00:36:49,440
Right?

299
00:36:49,440 --> 00:37:09,100
And the interesting thing about this is, if you can get into the flight control system or software, and you know what you are doing, the process is, the technician will download what's needed for their aircraft, put it on a maintenance laptop, that maintenance laptop then plugs into the aircraft itself,

300
00:37:09,100 --> 00:37:11,360
into the flight control system.

301
00:37:11,360 --> 00:37:21,680
So imagine some of the mayhem that you could do, because Boeing had zero effort and zero knowledge in security.

302
00:37:21,980 --> 00:37:29,860
Funny enough, they do sell cyber security services as consultants to the U.S.

303
00:37:29,860 --> 00:37:30,760
government.

304
00:37:30,760 --> 00:37:35,340
However, I guess they never ate their own dog food and looked at their own stuff.

305
00:37:35,340 --> 00:37:41,640
There were even hard-coded credentials in an older version of SAML that you could easily decode.

306
00:37:41,960 --> 00:37:49,540
The response from Boeing was, you're a criminal, harassment, no bug bounty.

307
00:37:50,460 --> 00:38:07,060
And it was only after my 59-page report went through and it got media attention after a disclosure period that they were forced to start their first vulnerability disclosure program, which they said it was based on my report.

308
00:38:07,060 --> 00:38:13,820
However, as far as I'm aware, Boeing still gives zero bug bounty awards.

309
00:38:15,100 --> 00:38:19,360
So agriculture is nice, because I think all of us like to eat.

310
00:38:19,360 --> 00:38:33,500
This is an instance where it's a control system that is now an industrial IoT system that is hanging on the Internet, that has a web server that has never been security tested, with no authentication.

311
00:38:33,700 --> 00:38:41,540
And it happens to be a European fish farm, a salmon farm to be exact.

312
00:38:41,540 --> 00:38:48,760
And you can actually, in real life, press the buttons, and you can modify the operations of this.

313
00:38:49,920 --> 00:38:52,680
So, we like water.

314
00:38:52,680 --> 00:39:02,920
Mexichem is actually a major bottled water provider, manufacturer, amongst other things, in Latin America and South Africa.

315
00:39:02,920 --> 00:39:05,400
They do a lot of stuff.

316
00:39:05,480 --> 00:39:10,400
So, I was looking around, because I get curious and bored.

317
00:39:10,400 --> 00:39:33,860
And I was very quickly able to find, because they allowed LDAP to be exposed to the Internet, I found 24 pages of assets from the IT side on the business level, all the way down to on the control level for their Windows-based SCADA systems.

318
00:39:33,860 --> 00:39:51,720
And this was rather unfortunate, because some of the systems that I was able to find was this wonderful, what's called HMI, Human Machine Interface, the same exact version that was vulnerable to some of the black energy attacks.

319
00:39:51,920 --> 00:39:56,580
And you didn't actually have to log in, because it was never set up correctly.

320
00:39:56,580 --> 00:40:00,920
I could access the drives that it was attached to.

321
00:40:00,920 --> 00:40:12,420
I could import and delete recipes, which is actually the production recipe of what the machinery will be doing.

322
00:40:12,420 --> 00:40:17,240
And I could just click as many buttons as I wanted to.

323
00:40:17,240 --> 00:40:28,420
I could even export the administration data, all at the touch of my fingertips from my comfortable, small Amsterdam house.

324
00:40:29,200 --> 00:40:42,740
And MexiChem also produces various different types of chemicals, some of which are more controlled, so that they don't fall in the hands of really bad people who want to make things go boom.

325
00:40:43,840 --> 00:40:50,360
So another thing to consider is we're talking about IoT systems.

326
00:40:50,360 --> 00:40:53,720
They can be anywhere.

327
00:40:53,760 --> 00:40:55,960
They could be inside a hospital.

328
00:40:55,960 --> 00:40:57,640
They could be on sensitive networks.

329
00:40:57,640 --> 00:41:02,480
They could be at nuclear physics labs in Russia.

330
00:41:03,400 --> 00:41:11,280
And they could also be inside control systems, so that you can actually, you know, use a printer.

331
00:41:11,280 --> 00:41:18,960
And so I was able to have a bit of fun, again, being bored.

332
00:41:18,960 --> 00:41:20,680
Don't ever let me get bored.

333
00:41:20,680 --> 00:41:29,540
And use Census and a few other scanning tools to quickly find as many particular printers as possible.

334
00:41:30,160 --> 00:41:39,940
It stemmed from the fact I was having a problem with my printer, and I downloaded the Brother admin tool, which covers almost all of their models.

335
00:41:39,940 --> 00:41:43,800
And I noticed that it had never been security tested.

336
00:41:43,800 --> 00:41:51,420
So I went ahead and flipped it around and turned it into a dual-use weaponized piece of admin tool.

337
00:41:51,640 --> 00:41:58,580
And a lot of these printers will have web interfaces.

338
00:41:58,580 --> 00:42:05,420
So I had a lot of fun with cross-site scripting, but most of my fun came from using the admin tool.

339
00:42:05,420 --> 00:42:20,120
See, once you find one of these printers, it's not that difficult to find, you can use the free Brother admin tool, go ahead and put in the IP address, and then connect to somebody else's printer anywhere in the world.

340
00:42:20,120 --> 00:42:32,260
You can see how much ink they have, you can even order, if it's set up in their printer, ink and toner supplies, because, hey, toner's worth more than platinum.

341
00:42:32,980 --> 00:42:39,080
And you can also send files directly to the printer.

342
00:42:39,260 --> 00:42:51,200
So I had a lot of fun with this, but unfortunately, Brother, like most printer manufacturers, do not have a vulnerability disclosure program.

343
00:42:51,200 --> 00:43:02,660
Nor did they ever think that you could use this lovely free tool, available now to download, and you can weaponize it and really make printers' lives uncomfortable.

344
00:43:03,140 --> 00:43:26,820
Bonus item, if it's a multifunctional printer that's more of the commercial variety that has a hard drive installed, and, say, Human Resources uses it as a scanner for different types of identification systems, you can even access the hard drive where it saves those scans and get all sorts of personally identifiable information and health data just by using this tool.

345
00:43:27,320 --> 00:43:42,520
So, I like space, and one of the things that is a bit problematic is, just like regular industrial systems, once you put something in space, it's expected to last a while.

346
00:43:42,520 --> 00:43:50,960
There's even a space satellite that is in a very interesting orbit that is up there for over 50 years.

347
00:43:50,960 --> 00:43:53,400
There's a lot of legacy stuff.

348
00:43:53,800 --> 00:43:57,380
Once you put something up there, it's not like you can go, hey, guess what?

349
00:43:57,380 --> 00:43:59,180
We've got this new type of encryption.

350
00:43:59,340 --> 00:43:59,820
You know what?

351
00:43:59,820 --> 00:44:02,180
It needs a chip to be able to process it.

352
00:44:02,180 --> 00:44:06,000
We're just going to replace that chip in the satellite.

353
00:44:06,000 --> 00:44:07,320
That doesn't happen.

354
00:44:08,860 --> 00:44:32,880
And what we did last year was, in the United Kingdom, thanks to Oxford, who funded it, and De Montfort University, we held the first space hackathon at Royal Holloway University to discuss these things with cleared PhD students who were given a lot of information by myself and others on some of the problems with current and new space assets,

355
00:44:32,880 --> 00:44:39,740
because they're really industrial IoT devices, and how to combat some of those problems.

356
00:44:39,740 --> 00:44:42,140
Because encryption might not be there.

357
00:44:42,140 --> 00:44:51,060
I believe it was only the year before last that the FTC mandated that new space assets actually had to have the ability to use encryption.

358
00:44:51,060 --> 00:45:06,880
And we've seen some satellite systems being used in various cyber crime attacks and malware, because if you can put one of your hops and traceability on a satellite, it kind of makes it a bit hard to see who's actually behind different things.

359
00:45:06,880 --> 00:45:09,720
So a lot of cool stuff came out of this hackathon.

360
00:45:09,720 --> 00:45:13,460
PhD students were absolutely fantastic and energetic.

361
00:45:13,580 --> 00:45:26,660
They listed a lot of very pertinent risks that we had to consider, such as the current UN space treaties do not cover private companies when it comes to warfare.

362
00:45:26,760 --> 00:45:29,840
It only covers nation states.

363
00:45:29,840 --> 00:45:55,060
And the fact that some major players in the market, if you want to watch a great older movie, I believe it's called Moonraker, it's a James Bond movie, where a really rich guy with way too much money decides to go into space and then try to take over the world by going to war in space as a private company.

364
00:45:55,060 --> 00:46:10,460
And so some of the risks listed were, for example, Elon Musk and his program, because anyone can turn evil and he already thinks that the pyramids were created by aliens.

365
00:46:10,460 --> 00:46:16,540
So to give a brief example, you can actually find some of these systems.

366
00:46:16,540 --> 00:46:21,860
Now, there's different ways that you can find various space IoT systems.

367
00:46:21,860 --> 00:46:30,620
A lot of them you'll find are actually land systems that then communicate up, but those land systems, they can actually unfortunately be hacked.

368
00:46:30,620 --> 00:46:37,300
In this particular case, I was able to find a relay connection up to a satellite.

369
00:46:37,880 --> 00:46:43,480
And I didn't want to give away too much information because they have not gotten back to me.

370
00:46:43,660 --> 00:46:49,900
I was able to find this particular device was running my favorite protocol Modbus with no authentication.

371
00:46:50,000 --> 00:46:54,340
It could give the device ID, function codes, and all sorts of information about it.

372
00:46:54,340 --> 00:47:04,720
And by looking into various user manuals that are freely available, I was able to find that it was called a sunny string monitor that was attached to the satellite.

373
00:47:04,720 --> 00:47:20,460
And what it does is it looks for sun and goes ahead and opens a solar array on a satellite system to give a power or closes it down when there's nothing available or can move it around a little bit.

374
00:47:20,460 --> 00:47:22,720
So imagine what you could do with that.

375
00:47:24,500 --> 00:47:26,980
Why is this kind of important?

376
00:47:26,980 --> 00:47:38,760
Last month, the United Nations Institute for Disarmament Research asked me to give a presentation, a closed dialogue session to permanent member states with other member states as observers.

377
00:47:38,760 --> 00:47:44,540
And I brought up the fact that we need to be a lot more proactive.

378
00:47:45,240 --> 00:47:59,460
And although the United Nations in 2015 established that member states are responsible for securing their ICT cyberspace, that also includes space assets, that also includes industrial systems, etc.

379
00:48:00,920 --> 00:48:05,120
They agreed to establish a computer emergency response team.

380
00:48:05,240 --> 00:48:06,520
And that's well and good.

381
00:48:06,520 --> 00:48:07,320
It's fantastic.

382
00:48:07,320 --> 00:48:08,260
It's much needed.

383
00:48:08,260 --> 00:48:13,300
But that also is very, very reactive and constantly you're putting out fires.

384
00:48:13,360 --> 00:48:16,420
So it's very difficult for you to be proactive.

385
00:48:16,420 --> 00:48:29,560
So I brought up with them that I'm currently working with part of the European Union to actually establish their first proactive computer emergency protection team, a CEPT.

386
00:48:29,560 --> 00:48:41,500
And CERT step one, step two, to try to alleviate some of the burden and also try to catch things as quickly as possible before they become major incidents.

387
00:48:41,500 --> 00:48:54,480
Now back in 2009, this is also another reason why it's kind of important, is I detected a cyber warfare attack, the second wave of such attacks caused by malware that the North Koreans created.

388
00:48:54,480 --> 00:49:10,240
One of the things they did was they leveraged higher speed bandwidth in Northern Europe to go ahead and have those various devices aim at the South Korean infrastructure and also part of the infrastructure of the United States.

389
00:49:10,240 --> 00:49:14,500
So they attacked the South Korean version of the White House and also the U.S.

390
00:49:14,500 --> 00:49:16,080
version of the White House.

391
00:49:16,080 --> 00:49:22,820
They tried to affect the New York Stock Exchange and a lot of other very important places.

392
00:49:22,820 --> 00:49:43,200
And because we were also monitoring in my shop ICS systems that had internet connectivity, we found that some of the Windows-based stuff actually was also affected and was trying to take down part of South Korea and the U.S.

393
00:49:43,200 --> 00:49:51,280
So you can actually, unfortunately, weaponize with various types of malware, IT, IoT, and ICS as we keep seeing.

394
00:49:51,280 --> 00:49:57,080
But even in 2009, 11 years ago, we were seeing this type of stuff.

395
00:49:57,080 --> 00:50:06,200
So we need to take it much more seriously with the vendors as well as the critical infrastructure operators and get the tech community involved.

396
00:50:06,200 --> 00:50:22,320
Because academia is great, government experts are fantastic, but it's us and you watching this that have that hacker mentality and can actually express it and find ways in and out that others can't.

397
00:50:22,320 --> 00:50:28,120
So with that, I will be available on Discord for questions.

398
00:50:28,520 --> 00:50:31,000
Hopefully I get the right Discord channel.

399
00:50:31,000 --> 00:50:38,360
I wanted to give a huge shout out to Omar at Santo Omar and the Red Team Village for inviting me.

400
00:50:38,520 --> 00:50:48,300
If you also would like to contact me about things that are going on in the Middle East, I believe my contact information is now on the Middle East Institute's website.

401
00:50:48,300 --> 00:50:52,940
And feel free to contact me on Twitter and I take DMs.

402
00:50:52,940 --> 00:50:54,380
Just no weird pictures.

403
00:50:54,580 --> 00:50:56,360
No weird sexy time pictures.

404
00:50:56,360 --> 00:50:57,360
Let me stress that.

405
00:50:57,360 --> 00:50:59,000
I love pictures of cats.

406
00:50:59,000 --> 00:51:01,820
So thank you very, very much, Red Team Village.

407
00:51:01,820 --> 00:51:03,880
It is greatly appreciated.

408
00:51:04,480 --> 00:51:08,240
Thank you so much for supporting us and for the great presentation.

409
00:51:08,240 --> 00:51:10,640
You're getting a lot of kudos in Discord.

410
00:51:10,640 --> 00:51:15,640
So talking about Discord, if you're joining us, you can see the link in the bottom of the screen.

411
00:51:15,640 --> 00:51:26,880
There's a link to a website where it has a lot of other information about speakers along with all the activities that are happening, of course, in DEF CON.

412
00:51:26,880 --> 00:51:34,960
So with that said, we're going to go on a break for a few minutes and then the next presentation will be up in probably about 15 to 20 minutes.

413
00:51:35,020 --> 00:51:36,400
So thank you again, Chris.

414
00:51:36,400 --> 00:51:37,780
Great presentation.

415
00:51:37,960 --> 00:51:39,000
Have a nice one.

416
00:51:39,000 --> 00:51:39,360
All right.

417
00:51:39,360 --> 00:51:40,040
Cheers.