WEBVTT 00:35.110 --> 00:36.270 Can you hear me? 00:48.710 --> 00:51.090 The slide looks a little bit like shit, but yeah. 00:51.690 --> 00:52.690 It is what it is. 00:52.690 --> 00:55.110 It is what it is, yes, unfortunately. 00:56.570 --> 01:00.810 Now, do I need to see you on a webcam here, or should we turn off... 01:00.810 --> 01:03.170 No, I have to do that, otherwise you can't stream me. 01:03.170 --> 01:04.490 Alright, alright, alright. 01:07.850 --> 01:10.110 Alright, so, and then we have... 01:12.030 --> 01:14.030 This there, and yeah, ok. 01:14.030 --> 01:16.750 Cool, ooh, look at the background, looks nice, brother. 01:17.930 --> 01:19.370 Man, you've been busy. 01:19.990 --> 01:21.670 And you've got a nice shirt on as well. 01:21.670 --> 01:24.050 I just put on a fucking t-shirt. 01:24.050 --> 01:25.610 You should have told me I could... 01:25.610 --> 01:30.010 I would have swapped to an RRG t-shirt here. 01:30.010 --> 01:32.170 Give me one second here. 01:36.190 --> 01:37.730 It is in the end of the slideshow. 01:37.730 --> 01:40.730 It's loads of crappy slides, but it shouldn't be there. 01:42.890 --> 01:46.930 Well, anyway, we just said goodbye anyway, so that's how it is. 01:47.090 --> 01:48.550 It's a part of life. 01:49.350 --> 01:52.850 We pushed this one a little bit too close. 01:52.850 --> 01:53.510 Dude. 01:54.250 --> 01:56.490 Yeah, so just so you know, we are... 01:57.170 --> 02:01.090 I'm streaming, but I don't think the event has started, so I don't think... 02:01.090 --> 02:03.210 I don't see anything live yet. 02:03.310 --> 02:06.730 Alright, because that's not live until 4 minutes 20 seconds, that's why. 02:06.730 --> 02:08.130 Yeah, yeah, yeah. 02:17.760 --> 02:19.820 Do-do-do-do. 02:20.640 --> 02:24.540 Na-na-na-na-na-na-na-na-na-na. 02:32.240 --> 02:36.740 Do-do-do-do-do-do-do-do-do-do. 02:37.960 --> 02:42.620 So we got the Zero Day Initiative up and running. 02:42.620 --> 02:43.480 Yep. 02:45.060 --> 02:46.220 Yeah. 02:46.220 --> 02:49.540 So basically after we new tools, it's demo time. 02:49.540 --> 02:51.140 Or how did you say? 02:51.140 --> 02:54.100 I think that's where we're going to squeeze it in. 02:55.700 --> 02:58.920 Because when we talked about everything, and then we just want to show it off. 02:58.920 --> 02:59.840 Pretty much. 03:00.220 --> 03:04.720 We show off standalone things first, I guess, and then we do Zero Day after that. 03:04.720 --> 03:06.520 And then we do Q&A. 03:07.180 --> 03:09.420 And if you want to have that in... 03:09.420 --> 03:13.580 I'm going to have Discord up and stuff like that, so I can see if there are... 03:13.580 --> 03:17.940 You know, if they keep track of any questions or stuff like that. 03:17.940 --> 03:18.660 I don't think so. 03:18.660 --> 03:22.100 What contact info do you want to use? 03:23.200 --> 03:27.900 Make Iceman at iuses.sc or something like that. 03:28.060 --> 03:29.700 iuseskill or something. 03:29.860 --> 03:31.980 Usually this one goes well. 03:36.300 --> 03:38.440 Yeah, that one works. 03:39.020 --> 03:40.260 Keybase. 03:42.760 --> 03:43.840 Bye. 03:44.730 --> 03:45.820 See ya. 03:57.330 --> 03:59.390 And I need to... 03:59.390 --> 04:00.970 take that one. 04:01.410 --> 04:02.070 Iceman. 04:02.070 --> 04:02.830 Ha! 04:02.830 --> 04:04.410 The Penguin, yay! 04:04.890 --> 04:07.790 I think they are listening in to us already, that's why. 04:07.950 --> 04:09.250 Oh, that's possible. 04:09.390 --> 04:10.950 That's possible, okay. 04:11.070 --> 04:13.690 Let's keep this one clean then. 04:14.770 --> 04:17.730 I mean, I don't know. 04:17.730 --> 04:19.310 I don't know if anyone can hear us. 04:19.310 --> 04:21.590 No one has been saying anything else. 04:21.590 --> 04:22.210 Yay! 04:22.930 --> 04:23.890 Yay! 04:25.970 --> 04:28.930 Turks, this should be... 04:44.720 --> 04:48.000 Alright, I take away Keybase. 04:48.000 --> 04:50.660 And I'm looking here on Turks. 04:57.500 --> 05:00.180 Yeah, you're live and visible. 05:00.180 --> 05:01.540 Alright, nice. 05:01.540 --> 05:03.060 Oh, okay. 05:03.080 --> 05:03.760 Cool. 05:03.760 --> 05:05.660 I've been doing this the whole time. 05:07.340 --> 05:09.060 I don't see it on YouTube. 05:09.060 --> 05:10.300 Ah, right. 05:10.300 --> 05:11.240 I don't either. 05:11.240 --> 05:12.400 That's probably for the best. 05:12.400 --> 05:13.580 I'll save the bandwidth. 05:15.820 --> 05:18.400 No, I meant I'm on the YouTube channel. 05:18.400 --> 05:20.180 I didn't see it there on that one. 05:20.180 --> 05:22.000 Oh, you can or can't see it? 05:22.000 --> 05:22.760 I can't see it. 05:22.760 --> 05:24.900 It's just RFHS logo. 05:24.900 --> 05:25.580 Okay. 05:25.580 --> 05:27.160 But it's live? 05:27.160 --> 05:28.400 Are we sure it's live? 05:28.560 --> 05:32.000 Yes, Zerus just said it on Discord. 05:32.000 --> 05:33.880 But we are both live and visible. 05:33.880 --> 05:35.400 So, hello. 05:35.980 --> 05:37.480 Hello, everyone. 05:37.520 --> 05:38.140 Yeah. 05:38.260 --> 05:39.220 Let's see. 05:39.220 --> 05:40.720 Let's double check. 05:41.120 --> 05:44.200 This is very odd now because now I'm confused. 05:44.420 --> 05:46.680 I gotta say, I'm looking... 05:48.400 --> 05:50.800 I'm looking at the YouTube link. 05:50.800 --> 05:52.800 It doesn't look live. 05:53.500 --> 05:54.280 Yeah, exactly. 05:54.280 --> 05:57.780 I'm on YouTube link and it doesn't look live. 05:59.160 --> 06:00.960 Let's check in with Zero. 06:00.960 --> 06:03.720 I don't want to start until we're sure we're good to go. 06:04.200 --> 06:05.040 We don't... 06:06.340 --> 06:12.120 If anyone can see us and hear us, thank you for standing by as a result. 06:12.120 --> 06:14.240 Potential technical difficulties. 06:16.420 --> 06:19.180 Yeah, because we don't know how this stuff works. 06:22.280 --> 06:23.960 All right. 06:25.280 --> 06:26.400 Okay. 06:27.400 --> 06:28.720 Maybe I should do that privately. 06:28.720 --> 06:29.280 Okay. 06:32.140 --> 06:32.540 So... 06:33.240 --> 06:35.120 Am I on the wrong YouTube channel? 06:35.120 --> 06:35.880 No, it can't be. 06:35.880 --> 06:36.980 It should be this one. 06:38.120 --> 06:40.760 It says 27 is waiting. 06:41.400 --> 06:42.740 Yeah, it does say waiting. 06:43.140 --> 06:43.920 Yeah. 06:43.940 --> 06:45.700 See, I don't think the stream has started. 06:45.700 --> 06:47.660 I think we need to click something in YouTube. 06:48.140 --> 06:49.420 Yeah, I think we need to... 06:49.420 --> 06:52.120 You have to enable it in YouTube. 06:52.120 --> 06:56.100 I think that's what Wasabi should do. 06:56.100 --> 06:57.840 If you, Zero, hear this... 06:57.840 --> 06:59.600 I wonder if the stream is still private. 06:59.600 --> 07:03.680 Wasabi set the stream to private, so it needs to be set un-private if that's the case. 07:03.940 --> 07:05.160 Yeah, yeah, yeah, yeah. 07:07.540 --> 07:09.740 Well, if they see us, maybe... 07:09.740 --> 07:10.660 I don't know. 07:11.260 --> 07:12.520 I have no idea. 07:22.970 --> 07:23.730 Boom. 07:24.810 --> 07:28.810 All right, let's see in the chat if someone can tell us if you actually see us here. 07:28.810 --> 07:32.290 And I mean in the YouTube chat, because we can't see ourselves on YouTube. 07:32.290 --> 07:33.250 That's why. 07:35.210 --> 07:36.010 I don't know. 07:38.430 --> 07:39.470 How about now? 07:39.470 --> 07:40.670 It's marked public now. 07:40.670 --> 07:41.710 Okay, let's see. 07:41.710 --> 07:44.270 All right, let's see if it kicks over. 07:45.430 --> 07:48.010 I'm refreshing it, and it says, waiting for... 07:49.270 --> 07:51.270 It might be on a delay. 07:52.590 --> 07:54.030 Yeah, maybe. 07:54.170 --> 07:56.130 So don't say anything stupid yet. 07:56.510 --> 07:58.590 Because it might be buffered. 07:59.030 --> 07:59.910 Oh. 08:02.530 --> 08:03.870 Oh my. 08:05.450 --> 08:07.590 So where's the live stream exactly? 08:07.590 --> 08:09.170 People are asking where it is. 08:09.170 --> 08:11.470 Yeah, I am curious as well. 08:11.470 --> 08:12.150 Yeah. 08:18.080 --> 08:18.720 So... 08:18.720 --> 08:20.200 It's marked private. 08:20.200 --> 08:22.880 You have to navigate straight to the live link. 08:22.880 --> 08:24.000 All right. 08:25.840 --> 08:30.340 Mine says, waiting for... 08:31.940 --> 08:32.340 Rfhf... 08:33.360 --> 08:33.760 Rfhacker... 08:33.760 --> 08:36.520 So here's... 08:36.520 --> 08:37.580 Oh, here's a different link. 08:37.580 --> 08:38.440 Ah, shit. 08:38.600 --> 08:39.660 Oh, look at that. 08:39.840 --> 08:40.240 Yeah. 08:40.240 --> 08:41.400 They gave us the wrong link. 08:41.400 --> 08:43.360 People have been watching this whole time. 08:45.860 --> 08:48.720 So that means people have the wrong link. 08:48.720 --> 08:50.400 We need to get the correct link. 08:50.400 --> 08:51.220 Yeah , okay. 08:52.360 --> 08:55.040 So I'm going to change back to the other one. 08:57.500 --> 08:58.300 And then... 08:58.300 --> 08:59.240 Oh man. 08:59.240 --> 09:00.540 That sucks. 09:02.840 --> 09:03.740 You can go... 09:03.740 --> 09:04.720 It's public now. 09:04.720 --> 09:05.860 Yeah, yeah, okay. 09:06.060 --> 09:08.740 The new link works. 09:09.820 --> 09:12.520 The one YouTube suggests. 09:20.200 --> 09:26.040 All right, let's go into this chat here and just... 09:26.040 --> 09:27.520 Here we go. 09:27.780 --> 09:28.580 This one, yeah? 09:28.580 --> 09:31.060 Let's go into this chat here and... 09:31.060 --> 09:32.240 No, this one. 09:33.080 --> 09:34.440 No, this one. 09:37.080 --> 09:38.580 Can I delete this one? 09:38.580 --> 09:39.080 No, I can't. 09:39.080 --> 09:40.580 Ah, well, the last one. 09:44.030 --> 09:45.510 All right, I don't know. 09:46.030 --> 09:47.770 So, Ferdy's waiting there. 09:48.050 --> 09:48.930 And , yeah. 09:49.410 --> 09:50.650 Eight is watching. 09:50.650 --> 09:52.950 Those eight who's here, hi, it's public. 09:53.430 --> 09:53.870 So... 09:53.870 --> 09:54.670 Yeah. 09:54.690 --> 09:56.770 But the problem is the talk description... 09:57.490 --> 09:58.550 Oh, come on. 09:58.550 --> 09:59.650 It's the other link. 09:59.650 --> 10:01.670 The other link needs to be set live. 10:02.130 --> 10:03.030 Yeah, but I will... 10:03.030 --> 10:05.390 Or I was given the wrong key. 10:05.390 --> 10:07.750 Or I was given the wrong stream key. 10:08.170 --> 10:08.830 I have no idea. 10:08.830 --> 10:13.870 But this one does not have a stream description or anything like that. 10:13.870 --> 10:15.730 So it looks like you have a new link. 10:17.030 --> 10:17.930 All right, yeah. 10:17.930 --> 10:19.490 So, sorry about that. 10:19.490 --> 10:20.670 It says Ferdy waiting. 10:20.670 --> 10:22.270 No, we need to... 10:22.270 --> 10:24.590 Yeah, those Ferdy there is going to be... 10:24.590 --> 10:25.290 Yeah. 10:25.290 --> 10:26.830 Because that's the correct link. 10:26.830 --> 10:30.730 I was either given the wrong stream key or something needs to be adjusted. 10:33.470 --> 10:38.550 For those who are watching this on the other stream, our apologies. 10:38.550 --> 10:41.410 We're trying to figure out exactly what's going on. 10:41.410 --> 10:43.130 Because we have people in two places. 10:44.730 --> 10:46.590 Sorry about that, sirs. 10:49.210 --> 10:50.590 And y'all. 10:55.200 --> 10:56.460 DefconInfoBooth has that link. 10:56.460 --> 10:57.520 We are working on it. 10:57.520 --> 10:58.100 All right. 10:58.100 --> 10:59.360 Here is Filip. 10:59.600 --> 11:00.700 All right. 11:05.220 --> 11:06.960 So he is there. 11:08.620 --> 11:09.340 All right. 11:09.920 --> 11:11.280 Yeah, all right. 11:15.640 --> 11:16.600 Yeah. 11:16.940 --> 11:18.420 All right, yeah. 11:20.060 --> 11:21.660 All right, that's sad. 11:21.660 --> 11:23.740 All right, see if we can get people in here. 11:24.140 --> 11:25.340 Okay, 15 watching. 11:25.340 --> 11:27.340 So everybody who is watching, say hi. 11:30.100 --> 11:38.480 Well, Iceman, the problem at the moment is I'm seeing the waiting count for the actual talk link go up. 11:38.480 --> 11:39.740 So people are still going to be... 11:39.740 --> 11:39.760 Yeah, I agree. 11:39.760 --> 11:41.260 So that needs to be resolved. 11:41.260 --> 11:42.360 Like, I can't... 11:42.360 --> 11:43.100 Yeah. 11:43.100 --> 11:47.560 If we just switch, people are going to miss the information. 11:47.820 --> 11:49.600 Yeah, a little bit upset about it as well. 11:49.600 --> 11:51.940 It's 32 waiting now. 11:52.300 --> 11:52.640 So... 11:52.640 --> 11:52.960 Yeah. 11:52.960 --> 11:54.820 I posted in the chat there. 11:57.360 --> 11:58.940 We're so sorry for this. 12:00.200 --> 12:01.500 Can you repost that link? 12:01.500 --> 12:02.340 All right, let's go... 12:04.360 --> 12:05.500 This one. 12:05.840 --> 12:06.680 Here you go. 12:07.880 --> 12:09.560 Can you post links? 12:10.240 --> 12:11.920 Yeah, I just did. 12:11.920 --> 12:13.120 No, they're being filtered. 12:13.120 --> 12:14.680 They're filtered out of our freaking chat. 12:14.680 --> 12:15.540 Thank you, YouTube. 12:16.680 --> 12:17.200 All right. 12:17.200 --> 12:18.400 You can't see it? 12:18.400 --> 12:19.460 No, I can't. 12:19.460 --> 12:19.960 I can't. 12:19.960 --> 12:21.560 I tried to paste it as well. 12:22.100 --> 12:23.160 Okay, okay. 12:23.160 --> 12:23.860 Shit. 12:24.400 --> 12:25.100 Okay. 12:27.340 --> 12:29.100 All right, all right, all right. 12:29.560 --> 12:31.340 So, if you go to my Twitter... 12:32.160 --> 12:32.940 What? 12:34.140 --> 12:35.940 I posted there. 12:36.680 --> 12:38.660 So, I'm going to do this. 12:38.960 --> 12:40.360 Is this something... 12:41.840 --> 12:43.600 Are you talking to Zero? 12:43.860 --> 12:47.880 Is this something they can resolve by giving us the correct stream key or something? 12:48.040 --> 12:50.040 I have no idea right now. 12:50.160 --> 12:51.500 Let's do this. 12:51.500 --> 12:54.920 And I'm going to see if I have him on Discord. 12:55.580 --> 12:56.380 All right. 12:56.380 --> 12:58.100 Both links works for Zero. 12:58.100 --> 12:59.640 He can see us on both. 13:00.640 --> 13:01.800 What do you want me to solve? 13:01.800 --> 13:02.620 Both links for me? 13:02.620 --> 13:02.980 Okay. 13:02.980 --> 13:04.860 Because only one link works for me. 13:04.860 --> 13:07.860 It's the last link you gave to me is working for me. 13:07.860 --> 13:09.640 The G-H-I. 13:09.760 --> 13:12.820 And the previous one with the stream description doesn't work. 13:12.820 --> 13:17.480 So, that one looks like it's private or... 13:17.480 --> 13:18.680 Yeah, so I... 13:19.820 --> 13:20.780 Okay. 13:21.180 --> 13:24.360 Because you are probably allowed. 13:25.500 --> 13:26.700 Yeah. 13:27.120 --> 13:28.320 Yeah. 13:32.440 --> 13:34.780 Okay, because we are chatting on the... 13:35.440 --> 13:37.940 Yeah, he's posted there now. 13:42.180 --> 13:43.380 Last link... 13:43.380 --> 13:44.420 Works. 13:49.710 --> 13:50.310 And... 13:54.520 --> 13:56.240 All right. 13:56.500 --> 13:57.640 How do I write the URL? 13:57.640 --> 13:59.160 Ah, the deviant is here. 13:59.160 --> 14:00.220 Mark is there. 14:00.220 --> 14:02.480 And Rick is there. 14:07.460 --> 14:12.220 And people to join the last link. 14:13.960 --> 14:14.820 All right. 14:14.820 --> 14:18.780 So, I don't know how they are able to resolve this anyway, so... 14:29.800 --> 14:31.860 All right, we're working on it. 14:31.860 --> 14:33.420 So, I texted Wasabi. 14:33.420 --> 14:36.840 I texted Zero in Discord. 14:39.820 --> 14:43.380 All right, it's like really far back lagging, so... 14:43.380 --> 14:46.260 Oh, wow, I'm not going to listen to myself on that stream. 14:47.080 --> 14:47.940 Oh, just mute it. 14:47.940 --> 14:49.180 Yeah, don't listen to yourself. 14:49.180 --> 14:49.440 Come on. 14:49.440 --> 14:51.740 Yeah, I'm not going to listen to myself. 14:52.380 --> 14:53.360 Oh, man. 14:53.720 --> 14:54.360 Come on. 14:54.360 --> 14:56.120 Okay, so the first link doesn't work. 14:56.120 --> 14:57.380 I'm so sorry for that. 15:01.880 --> 15:03.460 All right, so... 15:03.460 --> 15:05.240 Now it's 30 waiting, so... 15:05.240 --> 15:08.860 All right. 15:08.860 --> 15:09.380 Yeah. 15:10.300 --> 15:12.920 You want to have some girl from Ipanema? 15:16.760 --> 15:25.480 A little bit of Las Vegas elevator music, but, you know, it gives that vibe. 15:25.480 --> 15:26.920 Yeah, yeah. 15:28.600 --> 15:29.120 So... 15:30.400 --> 15:32.480 This seems silly. 15:33.280 --> 15:34.120 All right, so here's... 15:34.480 --> 15:36.400 I think here's going to be our plan. 15:36.400 --> 15:43.620 I will instruct people to click on the RFHS account to move over. 15:43.620 --> 15:44.100 Oh , yeah . 15:44.520 --> 15:45.600 Yeah, do that. 15:45.600 --> 15:47.600 I don't know if people are monitoring the chat. 15:47.600 --> 15:48.840 This is the problem. 15:49.660 --> 15:50.420 Yes. 15:50.420 --> 15:51.380 This is really... 15:51.380 --> 15:55.600 But I posted on Twitter and Discord, and so... 15:55.600 --> 15:56.460 Yeah. 15:57.560 --> 15:58.500 Yes. 15:58.500 --> 16:00.440 And other people have done that as well, so... 16:02.880 --> 16:03.720 Yeah. 16:03.720 --> 16:05.680 All right, let me type out a message here. 16:05.680 --> 16:07.120 Yeah, do it. 16:08.560 --> 16:10.620 Do that, do that, do that, do that. 16:10.620 --> 16:11.500 I'm going to do this. 16:11.500 --> 16:12.400 I'm going to do that. 16:12.640 --> 16:14.760 Oh, Zero says he just did something. 16:14.760 --> 16:16.100 Let's see if something changes. 16:16.680 --> 16:17.740 Fingers crossed. 16:23.980 --> 16:25.560 Well, maybe not. 16:25.560 --> 16:27.320 I'm going to keep typing instructions. 16:29.340 --> 16:31.260 Well, I don't see anything on that stream anymore. 16:31.260 --> 16:31.860 No , I don't either. 16:31.920 --> 16:33.900 I reloaded that one, and so... 16:33.900 --> 16:34.380 Yeah. 16:35.780 --> 16:38.820 29 waiting, so now I don't know if people have sent us... 16:38.820 --> 16:40.360 It happened to me before. 16:40.360 --> 16:43.140 You come in somewhere and don't get it. 16:43.300 --> 16:44.520 We're wasting time. 16:44.520 --> 16:46.220 It's 10 minutes into this. 16:46.220 --> 16:47.080 Well, we got this. 16:47.080 --> 16:48.060 It's fine. 16:48.360 --> 16:50.780 All right, so we've got 35 watching, at least. 16:57.000 --> 16:57.920 Ah. 17:00.400 --> 17:02.160 Tuta Denan. 17:02.280 --> 17:04.220 Carhackers Deluxe. 17:07.000 --> 17:07.800 Okay. 17:07.800 --> 17:14.160 I think if America's in them, it seems like those people, it works for them. 17:14.160 --> 17:15.560 I'm in the US. 17:15.560 --> 17:17.080 I don't see it. 17:17.180 --> 17:18.640 Ah, yeah, you're... 17:24.340 --> 17:25.460 Yeah. 17:25.820 --> 17:26.740 All right. 17:33.010 --> 17:33.930 All right. 17:33.930 --> 17:34.650 All right. 17:34.650 --> 17:36.090 Right, right, right. 17:43.120 --> 17:44.740 All right. 17:44.740 --> 17:51.840 So I'm going to give it 30 more seconds for people to hopefully see that message. 17:53.700 --> 17:55.140 Fingers crossed. 17:58.720 --> 18:00.080 Yep, yep, yep. 18:00.360 --> 18:01.580 Fingers crossed. 18:02.660 --> 18:03.940 Fingers crossed. 18:14.460 --> 18:14.960 Oh, yeah. 18:14.960 --> 18:15.840 Let's see. 18:17.940 --> 18:18.900 All right. 18:18.920 --> 18:21.300 So it's 30 still waiting on this one here. 18:21.300 --> 18:24.060 Well, so Wasabi did not have the link... 18:24.060 --> 18:27.900 Sorry, Xero did not have the link that Wasabi gave me, so I just forwarded him that. 18:28.480 --> 18:29.160 All right. 18:30.660 --> 18:31.460 Yay. 18:32.800 --> 18:34.440 So people's coming here, yeah. 18:34.440 --> 18:36.300 All right, so we're up in 44 here, so... 18:38.280 --> 18:39.080 Yep. 18:39.100 --> 18:41.120 So at least some people are moving over. 18:41.520 --> 18:42.200 Yeah, all right. 18:42.200 --> 18:43.180 So Olem is here. 18:43.180 --> 18:44.440 25 is waiting there, so... 18:46.840 --> 18:48.940 The links doesn't appear in the chat, no. 18:49.560 --> 18:51.200 No, it's filtered. 18:51.200 --> 18:52.600 So people aren't... 18:53.200 --> 18:54.060 Yeah. 18:54.160 --> 18:56.280 ...sending malicious links to each other. 18:56.640 --> 18:57.940 Yeah, exactly. 18:58.260 --> 18:59.560 Makes sense. 19:04.120 --> 19:06.400 It's almost like an online gaming. 19:06.400 --> 19:08.840 It's like, yeah, so are we going live now? 19:20.680 --> 19:22.400 Yeah, exactly. 19:23.320 --> 19:25.380 So, success. 19:26.600 --> 19:28.560 All right, all right, all right, all right. 19:30.540 --> 19:34.220 Haha, never took Babak as a standing desk student. 19:35.160 --> 19:36.180 Hey. 19:36.720 --> 19:37.820 Chris-man. 19:38.760 --> 19:40.240 Deviant-man. 19:44.810 --> 19:46.270 Yeah, Olem has the... 19:47.190 --> 19:50.570 Deviant has the power to make everybody follow. 19:52.450 --> 19:54.650 All right, so let's go ahead and kick it off. 19:54.650 --> 19:56.230 We did the best we could. 19:58.530 --> 19:59.050 And... 20:09.320 --> 20:11.540 Yep, yep. 20:24.520 --> 20:25.880 All right. 20:29.020 --> 20:31.500 So that's fully live. 20:35.430 --> 20:38.990 Okay, well, let's go ahead and get started. 20:38.990 --> 20:46.390 First of all, thank you everyone for your patience as we worked our way through these problems. 20:46.390 --> 20:54.030 This is definitely my first YouTube live stream, so always fun to learn that way. 20:54.150 --> 21:01.350 And apparently for the DEF CON Safe Mode Villages, we had some new learning experience as well, so no worries there. 21:03.010 --> 21:07.790 And I'm just going to set up the final setting for the slideshow and we'll kick that off. 21:14.630 --> 21:16.350 Yep, yeah. 21:16.350 --> 21:26.890 That would be an interesting conflict right now because the slides you're going to present is not going to be showing to me if I don't look at the live stream. 21:26.910 --> 21:29.230 No, you can look at it in the Jitsi. 21:29.370 --> 21:30.970 Ah, yeah, there it is. 21:31.250 --> 21:31.830 Perfect. 21:31.930 --> 21:33.230 You got the word there for it. 21:33.230 --> 21:35.350 Yeah, I know, I know, I know. 21:35.770 --> 21:37.050 Don't do that. 21:37.110 --> 21:37.490 I know. 21:37.490 --> 21:39.490 All right, all right. 21:39.490 --> 21:40.950 Thank you again, everyone. 21:41.290 --> 21:45.130 We are going to do our best to see how this goes. 21:45.610 --> 21:48.570 So we did a couple things. 21:48.570 --> 21:53.530 So as you all know, the best thing that you can do if you're a DEF CON talk is have a live demo. 21:54.430 --> 21:59.530 Because, you know, the demo gods always smile down upon you when you do stuff like that. 21:59.530 --> 22:04.590 So I was talking to Iceman over the past couple weeks and I said, let's not just do one demo. 22:04.590 --> 22:06.950 Let's do a crap ton of demos. 22:06.950 --> 22:16.310 So I have a wide variety of demos that I've been working 18 hours a day, getting all prepped for the last couple days to fit all this in. 22:16.310 --> 22:17.890 We're going to see how it goes. 22:17.890 --> 22:19.270 I'm not sure yet. 22:19.270 --> 22:22.770 The slides are also acceptable, but not great. 22:22.770 --> 22:28.570 So I want to appreciate everyone's, you know, understanding as we do a lot of firsts here. 22:28.570 --> 22:32.170 So without further ado, this is Ghosting the Paxman. 22:32.170 --> 22:38.990 And we're focusing on new tools and techniques for 2020 related to physical access control systems. 22:39.130 --> 22:43.430 To bring everyone up to speed, I am going to start the talk off with a little bit of context. 22:43.430 --> 22:47.490 So don't worry, it will get technical further towards the end. 22:47.490 --> 22:49.970 But let's go ahead and get started. 22:50.230 --> 22:54.110 So we have two people with us, including myself. 22:54.110 --> 22:56.110 So I'm Bhavik Jivadi. 22:56.170 --> 23:03.790 I'm a professional penetration tester and, you know, log picker, hardware hacker. 23:03.790 --> 23:08.210 Been instructing Cobra Methods of Entry for over 10 years. 23:08.350 --> 23:13.210 I'm a founder and partner at the Core Group, a consulting and research firm. 23:13.210 --> 23:20.370 Also a founding partner at the Red Team Alliance, a premier Red Team training firm as well. 23:20.370 --> 23:29.110 And I spent a lot of years, especially my earlier years in the scene, developing and building up the lockpicking community with Tool. 23:29.170 --> 23:40.670 So if any of you have ever visited the lockpicking village over the past years, you will have possibly seen me or seen some of the projects that I've been working on in the past. 23:40.970 --> 23:46.910 Deviant, big shout out to Deviant for all of his help, helping with some of the last minute slides. 23:46.910 --> 23:51.310 I see his comment there in the chat. 23:51.970 --> 24:03.290 Iceman is also here calling in remotely, just so everyone knows we're doing a really crazy thing where I have a Jitsi video stream with Iceman that's coming to me from Sweden. 24:03.290 --> 24:08.850 So we have Sweden to Phoenix, Arizona, and then we have from Phoenix out to YouTube again. 24:08.850 --> 24:12.590 So we got some fun traffic bouncing going on here. 24:12.590 --> 24:15.090 Iceman, do you want to talk a little bit about yourself? 24:15.090 --> 24:16.870 Well, yeah, sure. 24:16.910 --> 24:19.590 First of all, yeah, most excited to be here. 24:19.590 --> 24:22.530 And thank you for being able to do this today. 24:22.530 --> 24:28.190 And the technical uphill was a little bit more than I expected, but yeah, that's how it is. 24:28.190 --> 24:31.570 And it's a heatwave also in my country, in Europe right now. 24:31.570 --> 24:32.990 So yeah, I'm sweating. 24:32.990 --> 24:36.950 If you see me pounding, it's not just me being normally talkative. 24:36.950 --> 24:38.270 It's just, it's warm. 24:38.270 --> 24:39.470 It's really warm. 24:39.610 --> 24:41.130 Anyway, I'm Iceman. 24:41.170 --> 24:47.990 And most of you know me and have seen my Iceman channel and have seen me on Proxmog freely. 24:48.050 --> 24:55.550 So I'm an administrator, maintainer, developer, and you can call me an evangelist of Proxmog nowadays. 24:55.550 --> 25:09.030 I've been into that since 2013, and I've been lucky to learn this way and being able to meet people and talk to people and learn even more and to become the person I am today. 25:09.030 --> 25:17.750 But before that, and during that, and I'm not just spending all my time on this, is that I'm actually a certified MCPD Enterprise Architect in .NET development. 25:17.770 --> 25:24.510 And I've been running my own company since 2006, trying to do consultancy and stuff like that. 25:24.510 --> 25:26.870 And I like Proxmog more. 25:26.870 --> 25:28.230 I have more fun with that. 25:28.870 --> 25:42.870 And that led to something called ROG, where I co-founded it two and a half, three years ago, where we ended up with actually making something what you all know as a Rv4, where you all can see my little name on it. 25:42.870 --> 25:43.450 And that's me. 25:43.450 --> 25:47.770 I don't think you need any more introductions for me, because everybody knows who I am, usually. 25:48.390 --> 25:51.010 When it comes to Proxmogs, everybody knows who I am. 25:51.010 --> 25:51.890 That's true. 25:52.250 --> 25:55.890 And everybody who's new, I'm kind of okay with Proxmogs. 25:55.890 --> 25:56.650 All right? 25:57.850 --> 26:05.170 So, we have, like I said, we're going to provide everyone some brief overall context regarding access control. 26:05.170 --> 26:11.270 We're not going to dive too deep into traditional topics like cloning cards and stuff like that. 26:11.270 --> 26:17.610 But I do want to give everyone a nice holistic picture of what a physical access control actually looks like. 26:17.610 --> 26:27.550 Because as I try to remind people, when we talk about RFID as it relates to access control, RFID is just the very, very tip of the access control iceberg. 26:28.110 --> 26:29.770 It's easy to forget about that. 26:29.770 --> 26:30.370 Yes. 26:30.370 --> 26:31.110 Yes. 26:32.030 --> 26:37.030 So, what we're talking about with access control is normally this. 26:37.110 --> 26:41.110 So , this is what most people think of when they think of access control. 26:41.110 --> 26:45.330 They think of a door with a reader next to it, and they present a card of some kind. 26:45.330 --> 26:47.150 And I know the video is glitching. 26:47.150 --> 26:48.370 I apologize for that. 26:48.370 --> 26:49.890 We'll just move past it. 26:50.530 --> 26:53.210 You present a card of some kind, and you just pull open the door. 26:53.210 --> 26:53.710 Right? 26:53.710 --> 26:54.970 Simple as that. 26:56.610 --> 27:02.850 Oftentimes, there has to be a connector between the physical world and the electronic world. 27:02.850 --> 27:10.550 And when it comes to access control, that's usually in the form of an electrified strike or a magnetic lock. 27:10.550 --> 27:14.150 You might have seen a lot of mag locks around different doors in different facilities. 27:14.150 --> 27:26.030 There are also built-in handsets that have integrated electromechanical components that work all in a self-contained unit. 27:26.030 --> 27:27.770 So, you might not see an electric strike. 27:27.770 --> 27:29.390 You might not see a mag lock. 27:29.390 --> 27:33.550 But it still might be an electronically controlled door. 27:34.270 --> 27:37.790 What's happening here, and again, I want to emphasize this. 27:37.790 --> 27:43.710 In a lot of the analogies and examples that I use, we are intentionally very, very general. 27:43.710 --> 27:47.330 So, we're going to intentionally dumb it down considerably. 27:47.330 --> 27:49.290 This is not to insult your intelligence. 27:49.370 --> 27:57.430 It's to make sure that we're focusing on the actual concept and not let people get too lost in the finer details. 27:57.510 --> 28:03.950 So, generally speaking, these magnetic locks, these electrified strikes, there's a power source of some kind. 28:03.950 --> 28:06.670 So, there's a transformer of some kind powering it. 28:06.670 --> 28:09.590 Or, if power is out, there's a backup battery. 28:09.610 --> 28:13.150 But, of course, it's not just connected directly to a power source. 28:13.150 --> 28:15.970 Ultimately, it's connected to a door controller. 28:15.970 --> 28:36.830 The door controller is generally an embedded device of some kind, often runs on Linux, but not always, that has a series of power supplies, relays, and other microcontrollers to take in multiple inputs and make logical decisions based off of that, and then control certain outputs. 28:37.450 --> 28:41.310 So, credentials come in, and then something happens on the output. 28:41.310 --> 28:51.450 So, whether you have a prox card or a mag stripe or a weekend swipe card, which we'll talk about in a moment, those are all different types of inputs as far as the credential data is concerned. 28:51.570 --> 28:59.370 So, in terms of credentials, we are talking about a card, like something you have, or a pin, which is something you know. 28:59.370 --> 29:06.150 Or, in the case of biometrics, like a fingerprint or iris scan, facial recognition, what have you, something you are. 29:06.210 --> 29:10.850 But, ultimately, as we mentioned, it's just a panel making decisions based off of inputs. 29:10.850 --> 29:19.610 So, here is an example of one of the most common types of inputs that people might see. 29:19.610 --> 29:24.590 People have probably seen how to bypass doors using a can of air. 29:24.590 --> 29:27.670 Well, here's another kind of input that that relates to. 29:27.670 --> 29:33.710 So, here's our access control system, and we have a couple of players here. 29:33.710 --> 29:41.030 And imagine that the bellman here is a door stripe, so an electrified stripe. 29:41.030 --> 29:46.570 Then we have our manager, our door controller, and then we have, sorry, not our card reader. 29:46.570 --> 29:50.570 We have a REX motion sensor, which we'll see a photo of shortly. 29:50.670 --> 30:00.770 So, whenever that motion sensor activates, depending on how the door controller is configured, that door controller is going to make a decision saying, hey, I should let that person out. 30:00.770 --> 30:02.550 Let's go ahead and open up that door. 30:02.550 --> 30:09.350 And this is something that, again, a lot of folks are going to be already familiar with, because these REX sensors are very, very easy to fool. 30:09.410 --> 30:12.530 So, here we have a double door. 30:13.390 --> 30:16.770 Someone's on the locked side, and they're just going to use 30:20.210 --> 30:28.250 a burst of air to trick that REX sensor into seeing a motion and then allowing you to open the door. 30:28.250 --> 30:31.670 And I'm seeing that some of the videos are not playing correctly in PowerPoint. 30:31.670 --> 30:37.750 I apologize for that, but we'll just kind of move past it and see if the next one does any better. 30:37.750 --> 30:39.570 So, we'll try again. 30:39.670 --> 30:46.670 So, here is a different lab, and we were showing one of my friends how this process works. 30:46.690 --> 30:51.730 And so, what he's going to try to do is, oh man, jumping all over the place. 30:51.730 --> 30:58.710 He's going to try to take that canned air, turn it upside down, insert it between the doors, and trip that motion sensor. 30:58.710 --> 31:00.070 Oh man, okay. 31:00.370 --> 31:02.550 Videos are bad for live streaming. 31:02.550 --> 31:03.570 That's what I'm learning. 31:03.570 --> 31:07.690 So, we are going to probably not play a whole lot more videos. 31:08.010 --> 31:10.370 But we're not going to focus on that topic too much. 31:10.370 --> 31:18.510 Suffice to say that there are different ways of manipulating different motion sensors as they relate to door controllers. 31:18.510 --> 31:20.250 So, that's the most common method. 31:20.290 --> 31:22.210 We're going to skip over a couple more videos. 31:22.370 --> 31:24.410 These are the sensors that we're talking about, right? 31:24.410 --> 31:26.490 So, these are normally mounted above doors. 31:26.490 --> 31:28.510 And they can be used in one of two ways. 31:28.510 --> 31:37.010 They can either be used for automatic egress, where simple motion will activate the electrified strike and allow you to exit. 31:37.110 --> 31:41.450 Or, it might be used for detecting forced entry. 31:41.450 --> 31:46.770 So, let me just see really quickly if those slides exist. 31:46.770 --> 31:48.690 So, pardon me one moment. 31:48.690 --> 31:53.230 I'm realizing that a couple of these slides might have been out of order. 31:53.230 --> 32:00.250 So, we will switch cameras briefly while we check that. 32:00.810 --> 32:07.590 Have you noticed the really sexy soldering station behind Babak? 32:07.590 --> 32:10.190 You know, I'm getting jealous. 32:12.990 --> 32:21.730 Okay, so yeah, I'll just explain it and talk through it since apparently I don't have the door contact slides in this deck. 32:21.730 --> 32:24.470 So, my apologies for that. 32:24.590 --> 32:28.570 One moment as we get the presentation spun back up. 32:30.780 --> 32:33.240 And then switching back. 32:33.240 --> 32:34.120 Alright. 32:35.680 --> 32:40.120 So, a lot of doors can have little door position switches. 32:40.120 --> 32:44.980 These are magnetic sensors built into the door and the door frame. 32:44.980 --> 32:48.540 And that allows the door controller to monitor the state of the door. 32:48.540 --> 33:08.040 So, basically there is some logic in the door controller that says if the door opens and it's not preceded by a valid card read, or it's not preceded by someone approaching the door and tripping one of these motion sensors, then it's going to assume a forced entry state and it's going to trigger an alarm. 33:08.040 --> 33:11.880 So, those are the two use cases for rec sensors, for example. 33:11.880 --> 33:13.640 There are other types of inputs. 33:13.640 --> 33:14.900 They're not as common. 33:14.900 --> 33:17.020 We're not going to talk about them in this talk. 33:17.020 --> 33:21.420 But if you're curious about that, definitely find me online or offline later. 33:21.420 --> 33:24.180 And I'm happy to go over extra stuff with you folks. 33:24.180 --> 33:26.920 So, we'll just go ahead and skip past more videos. 33:27.000 --> 33:32.420 But ultimately, enterprise access control systems contain a multitude of different components. 33:32.420 --> 33:34.200 So, we have our credentials. 33:34.200 --> 33:37.280 These are things that most folks are very familiar with. 33:37.280 --> 33:42.860 We have the readers, which come in a lot of different technologies, shapes, colors, sizes. 33:43.100 --> 33:44.580 We have the door hardware. 33:44.580 --> 33:47.000 That's what's actually securing the door. 33:47.000 --> 33:51.840 And then we have our motion sensors, our door position switches, etc. 33:52.020 --> 33:55.900 Our door controller, which actually handles all of the decision making. 33:55.900 --> 34:05.300 And then a server of some kind that actually contains the main primary user database that is synchronized across different door controllers. 34:05.340 --> 34:06.780 And these are all connected, right? 34:06.780 --> 34:08.000 They all play nice. 34:08.000 --> 34:17.420 Except, this is not a system that is connected in the way that some folks think it is. 34:17.420 --> 34:24.240 Each segment of an access control system operates independently of the other segments. 34:24.240 --> 34:31.140 And we can take advantage of gaps that exist between these different segments to manipulate the behavior of the system. 34:31.980 --> 34:45.560 So when we talk about RFID, when we talk about PROX, when we talk about MagStrike, what we're only talking about is that very, very first link between the credential itself and the card reader. 34:45.560 --> 34:48.820 It just has nothing to do with anything behind it. 34:48.820 --> 34:52.200 RFID operates independently of everything else. 34:52.200 --> 34:58.580 So when we talk about access control, we're not just talking about RFID, we're talking about everything. 34:59.360 --> 35:09.120 So first, to really understand a little bit of the history of RFID, I want to talk a little bit more about the history of credentials and cards in general. 35:09.120 --> 35:11.820 So a lot of folks have heard the term WIEGAND. 35:12.000 --> 35:19.320 WIEGAND is actually a man who moved and immigrated to the U.S. 35:19.320 --> 35:24.880 back in the early 1900s, originally to study music at Juilliard. 35:24.880 --> 35:43.460 And through his different experiences became very interested in audio amplifiers and ultimately became a wonderfully innovative researcher that came up with some really cool ideas and discoveries revolving around electromagnetics. 35:44.320 --> 35:47.900 Most people know him for his invention of the WIEGAND wire. 35:47.900 --> 35:55.400 And this is actually, even though it's very, very old technology, it's something that still permeates access control as it exists today. 35:55.760 --> 36:08.420 And understanding that this is where modern access control comes from is important because it informs a lot of the different weaknesses, limitations, and vulnerabilities that exist in access control still today. 36:08.860 --> 36:12.080 So let's talk a little bit about these WIEGAND wires. 36:12.440 --> 36:14.240 I'm going to skip a couple slides. 36:14.240 --> 36:20.400 I'm actually just going to switch to a downward-facing camera here. 36:20.400 --> 36:26.440 What I have here is an original WIEGAND swipe card. 36:26.440 --> 36:28.560 Let's move our camera down here. 36:28.560 --> 36:35.480 And I've actually also got an original WIEGAND reader. 36:36.300 --> 36:39.480 And we'll get this powered on as well. 36:42.640 --> 36:44.620 Adjust our camera. 36:45.200 --> 36:46.900 There we go. 36:46.900 --> 36:53.480 All right, so we have our display here that is connected to the card reader. 36:53.480 --> 36:56.780 This is kind of pretending to be a door controller of sorts, if you will. 36:56.780 --> 36:59.980 And I'm just going to swipe this card. 36:59.980 --> 37:01.300 And let's see if I do it right. 37:01.300 --> 37:02.160 There we go. 37:02.160 --> 37:03.640 So I got some data. 37:03.760 --> 37:09.320 This says Facility Code 40, card number 2115. 37:09.320 --> 37:11.020 Where did that data come from? 37:11.220 --> 37:12.820 These wires on the back. 37:12.820 --> 37:17.700 So I've actually taken a blade and I've removed a layer of the plastic from the card. 37:17.700 --> 37:19.860 So we can see these wires. 37:19.860 --> 37:22.220 These wires are very, very interesting. 37:22.220 --> 37:26.500 Because they exhibit a very peculiar electromagnetic property. 37:26.500 --> 37:39.400 As they pass over permanent magnets of a given polarity, the outside shell of the wire magnetizes at a different rate than the inside shell. 37:39.400 --> 37:44.100 And the reason that happens is because during manufacture, that wire is actually twisted. 37:44.180 --> 37:50.160 And so the outside of it is work-hardened in a way that makes it more brittle and more hard than the inside. 37:50.740 --> 37:54.880 When you do that to wire, something very interesting happens. 37:55.200 --> 37:57.980 So here we have a sense coil. 37:58.100 --> 38:01.880 And we have two permanent magnets oriented in opposite directions. 38:01.880 --> 38:20.060 As these weekend wires pass the first wire, and both the outside shell and the inner core of the wire are magnetized, and then you move that wire towards the second one, the center of the wire flips polarity faster and before the outside of the wire. 38:20.060 --> 38:28.200 And that results in a very interesting behavior that results in a field that can be picked up by this sense coil in the middle. 38:28.200 --> 38:37.160 So inside this reader here that you see on my small screen, there are actually multiple sense coils and multiple magnets. 38:37.160 --> 38:44.600 And what it's doing is as these wires are passing over it, those wires are briefly getting magnetized and demagnetized. 38:44.600 --> 38:49.200 And that sense coil is picking up these pulses coming back off of the wire. 38:49.320 --> 38:52.060 Now this was used in a lot of different applications. 38:52.060 --> 38:59.460 It was used in everything from anti-lock braking systems to machine automation in factories and such. 38:59.460 --> 39:03.840 It's in fact still used today in a lot of different mechanical applications. 39:03.840 --> 39:10.500 There are even casino chips that use weekend wires inside the chip to identify that the chip is authentic. 39:10.500 --> 39:15.180 Because weekend wires are historically very difficult to manufacture on your own. 39:15.180 --> 39:21.360 In fact, there's only one machine that I know of in the United States that still produces this type of wire. 39:21.360 --> 39:24.940 And it's not in operation very much. 39:24.960 --> 39:31.680 HID, which used to make weekend cards, some time ago sold their only machine to a company in Germany. 39:31.680 --> 39:35.340 So this is not something that is easy to do on your own. 39:35.340 --> 39:43.120 In fact, the only way that I can get my own weekend wire is dissolving it or harvesting it out of other weekend swipe cards. 39:45.960 --> 39:49.600 So, let me keep going here. 39:50.320 --> 39:54.200 And apologies if anyone's asking questions that I'm not seeing yet. 39:54.200 --> 39:56.600 I'm going to focus on questions during the Q&A. 39:56.600 --> 40:00.660 We have a lot of content, a lot of demos to get through, so I want to focus on getting through that. 40:00.660 --> 40:03.460 So I appreciate everyone's understanding with that. 40:03.500 --> 40:14.340 So weekend wires, as they're used in swipe card systems, they literally represent the 0 bits and the 1 bits of the credential data. 40:14.340 --> 40:15.780 What do I mean by that? 40:15.780 --> 40:20.000 Well, let's take a look at an example. 40:20.540 --> 40:26.400 I'm going to open up a notepad window here and walk people through. 40:29.560 --> 40:32.860 It is ultra cred for this old tech. 40:32.960 --> 40:36.160 It's the basics, it's the beginning of things. 40:36.160 --> 40:39.420 You see the red thread pretty soon. 40:45.070 --> 40:51.470 Alright, so what we're going to do is we're going to together decode... 40:52.550 --> 40:55.490 Well actually, for the sake of time, we won't do that. 40:55.490 --> 40:57.210 I'm just going to tell you how it all works. 40:57.210 --> 41:04.290 So here I have a real weekend card and here I have a fake one. 41:04.610 --> 41:09.450 So what I've done is I've just... I'm just going to switch this back here. 41:13.900 --> 41:15.720 Nope, not that one, that one. 41:15.720 --> 41:21.700 So what I've done here is I've just printed where the weekend wires would be on a card. 41:21.700 --> 41:24.820 To give you a little example here. 41:24.820 --> 41:28.860 So we're going to pretend that these are real wires on a card. 41:28.860 --> 41:33.300 And these top wires are the 0 bits, these bottom wires are the 1 bits. 41:33.360 --> 41:36.580 And the swipe direction is like this. 41:36.580 --> 41:43.920 So what that means is if we're flipping this over, these bits are at the beginning of the credential and these bits are at the end. 41:43.920 --> 41:53.790 Now, what I have here, and I'm going to switch windows here, is Notepad. 41:54.010 --> 41:54.490 And 42:00.470 --> 42:02.070 I'm going to copy this. 42:03.670 --> 42:05.890 And we're going to move Iceman down. 42:05.890 --> 42:07.090 Whoops, not that. 42:07.910 --> 42:09.250 Are you moving me down? 42:09.250 --> 42:10.470 Yeah, right? 42:11.950 --> 42:13.310 Alright. 42:14.190 --> 42:21.610 So, if you can see, I'm going to move this camera even closer. 42:22.830 --> 42:27.890 So, compare this binary string up here. 42:27.890 --> 42:33.170 If we compare it to this card from right to left, you'll see that it matches. 42:33.170 --> 42:34.610 So here's our 1. 42:34.750 --> 42:41.750 And then we have, I'm going to use a pencil as a pointer here to make my life a little bit easier. 42:41.750 --> 42:43.870 So we have a 1 and we have two 0s. 42:43.870 --> 42:50.130 We have 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, etc. 42:50.130 --> 42:52.250 And we have 26 of those wires. 42:52.250 --> 43:02.250 And that corresponds, in this particular example, with 26 bits that are read from the card by the reader and then sent onward to the door controller. 43:02.250 --> 43:10.970 So those original systems, developed in the early and mid 80s, just took that raw data and sent it to the door controller. 43:10.970 --> 43:16.550 And thus began the Wiegand communication protocol as a standard. 43:16.610 --> 43:21.050 Then there's this also here as a Wiegand bit format. 43:21.050 --> 43:24.430 So here we have the open 26-bit format. 43:24.490 --> 43:29.250 And if we take a look at this next slide here. 43:29.250 --> 43:34.270 This is just one example of a Wiegand bit format. 43:34.270 --> 43:35.330 Now, there are many. 43:35.330 --> 43:36.690 We're not going to talk about all of them. 43:36.690 --> 43:38.130 This is just one. 43:38.170 --> 43:52.170 The phrase Wiegand bit format refers to how you can decode a group of binary bits into something that we're going to arbitrarily call facility code and card number. 43:52.170 --> 43:56.670 So with the 26-bit format, for example, we have 26 bits. 43:56.830 --> 43:59.670 The first and last bits are parity. 43:59.830 --> 44:04.370 And then we have 8 bits used for the facility code and 16 for the card number. 44:04.370 --> 44:07.790 Again, that's just the open 26-bit format. 44:07.790 --> 44:17.510 So if we come back over here and pull up a little calculator here. 44:39.230 --> 44:40.430 There we go. 44:40.430 --> 44:41.150 Alright. 44:41.630 --> 44:44.510 Oh, Iceman is on top of my calculator. 44:46.730 --> 44:48.230 Crunching numbers, am I? 44:48.310 --> 44:50.110 Yeah, yeah, yeah. 44:50.430 --> 44:52.830 We're just going to move the calculator itself. 44:53.390 --> 44:54.430 There we go. 44:55.150 --> 44:57.750 Alright, so what do I mean by that? 44:57.750 --> 44:59.850 Here's those first 8 bits. 44:59.850 --> 45:06.850 If I copy that and convert from binary to hex, there's our decimal 42 value. 45:07.010 --> 45:16.130 And if I take this and I copy that and I convert it from binary to hex, or sorry, to decimal, there's our 16180 value. 45:16.130 --> 45:29.450 So the phrase facility code and card number really only refers to these little arbitrary values that we define as part of the whole PACS data stream that gets sent from the card reader to the door controller. 45:29.450 --> 45:32.590 If that doesn't fully make sense yet, that's okay. 45:32.590 --> 45:35.390 We can talk about it more in depth during Q&A. 45:35.390 --> 45:39.270 But just understanding that this is what the credential data itself is. 45:39.270 --> 45:42.250 This is your token that is actually granting you access. 45:42.250 --> 45:43.810 This is the important thing. 45:43.810 --> 45:46.030 Understanding that concept is important. 45:46.710 --> 45:51.010 So we have our WGAN data stream, and that's what's stored on the card. 45:51.270 --> 45:54.750 As technology progressed, we're going to switch back here. 45:55.630 --> 46:00.230 As technology progressed, oh, this is actually a cool link. 46:00.230 --> 46:02.390 I just forgot this slide was in this order. 46:02.390 --> 46:08.610 If you want to learn about more WGAN data formats, this is a great site that has some really wonderful tools. 46:08.610 --> 46:18.990 So if you go to cardinfo.barkweb.com.au, you'll actually see a bunch of different WGAN formats, some more popular ones. 46:18.990 --> 46:24.210 There are technically hundreds, if not thousands, of proprietary WGAN formats, and these are just some of them. 46:24.210 --> 46:34.790 But if you want to learn more about them, check out 0xFFFF's website there, and you'll see quite a few variety of formats. 46:35.770 --> 46:45.870 So inside a modern credential, when we're talking about prox cards, when we're talking about RFID, and I have actually an example here. 46:45.950 --> 46:54.790 So here we have a low-frequency card that is made of clear PVC rather than white plastic, so you can see what's inside. 46:55.650 --> 47:02.070 These are just containers that are different ways of holding that same WGAN data. 47:02.070 --> 47:20.130 What I mean by that is even when you present these different kinds of cards and credentials to the reader, the reader is just looking for that PAX data that it recognizes, and it's still converting that into that kind of somewhat ancient format that the door controller was expecting, 47:20.130 --> 47:26.050 because that's kind of the system that everyone agreed upon and everyone used for the sake of PAX compatibility. 47:28.970 --> 47:42.910 So when we talk about credential-to-reader communication, when we talk about RFID, when we talk about the signal between cards and readers, whether it's prox or I-class, what have you, these are all just different containers. 47:43.170 --> 47:46.550 So I'm going to give you another analogy to kind of get this point across. 47:46.550 --> 47:54.830 So we have, again, our RFID credential, we have our RFID reader, we have our door controller, and then we have our door hardware, right? 47:54.830 --> 48:00.610 So we're going to look at the access control system as if it's all people having a conversation. 48:02.710 --> 48:07.770 So that card reader is always looking for a credential, it's always interrogating, right? 48:07.770 --> 48:11.770 So here's our card reader saying, hello, hello, hello. 48:11.930 --> 48:19.730 Eventually, a credential comes along and it says, hello, I am 43-1048. 48:19.950 --> 48:24.490 The card reader says, oh yes, 43-1048, I will send that on. 48:24.490 --> 48:30.850 Door controller gets that information, they recognize the user, they go ahead and activate the electrified strike. 48:32.570 --> 48:34.670 Another user comes along. 48:35.070 --> 48:37.910 Maybe this is a different credential. 48:37.910 --> 48:39.110 It doesn't matter. 48:39.110 --> 48:41.910 Its conversation might be simpler. 48:41.910 --> 48:49.870 It might not have all of this extra syntax and structure or preamble, but the data is still formatted the same way. 48:49.870 --> 49:01.790 So that older, dumber credential, if you will, will still provide information the reader translates into a standard format that the door controller is expecting. 49:03.470 --> 49:06.390 So the syntax and preamble can vary. 49:06.390 --> 49:15.370 So for example, here is a different user and they might say the information in a different way. 49:15.370 --> 49:20.170 It might use a different communication language, so to speak. 49:20.170 --> 49:31.130 But that card reader, again, is still going to convert that into a sanitized standard format and send that to the door controller, which the door controller sees and does its thing. 49:31.130 --> 49:41.570 Notice that in all of these examples that we have discussed so far, the door controller doesn't have any idea about the rest of the conversation that is happening between the card and the reader. 49:41.570 --> 49:45.310 It doesn't matter if the card is prox or andala. 49:45.310 --> 49:49.610 It doesn't matter if it's a high security card or a low security card. 49:49.610 --> 49:56.350 Because when the data goes from the card reader to the door controller, it's still going to be formatted in that same standard way. 49:57.570 --> 49:59.470 So apologies for the sake of time. 49:59.470 --> 50:01.890 You're going to see me skipping over a couple of slides. 50:01.890 --> 50:02.970 That's okay. 50:03.130 --> 50:06.430 Some credentials, we're going to say, speak other languages. 50:06.430 --> 50:12.790 What I mean by that is that they might present the data in a way that initially doesn't make sense. 50:13.030 --> 50:19.030 So there's, you know, instead of prox, maybe that's like an EM card. 50:19.590 --> 50:23.770 I'll give you an example of what I think an andala conversation will look like. 50:23.770 --> 50:31.710 So andala is notorious for scrambling the order of how the bits are sent from the card to the reader. 50:31.710 --> 50:39.750 Iceman is laughing because we spent way too many hours debugging andala encoding and decoding problems a few months ago. 50:40.630 --> 50:46.250 So here's an example of a conversation between a card reader and, say, an andala credential. 50:46.250 --> 50:55.170 So instead of providing everything in a nice, easy-to-understand format, that andala credential might say, Oh, yes, here's a bunch of numbers. 50:55.170 --> 51:06.110 And if you understand the correct way to parse my sentence, then you will also know that this is the format that it actually wants and it sends that to the door controller. 51:06.210 --> 51:09.030 Again, this is really, really dumbed down. 51:09.030 --> 51:12.470 That is intentional because this is not the thing that we're learning about. 51:12.470 --> 51:19.770 What we're learning about right now is the foundation of the card reader is going to send sanitized data to the door controller. 51:19.770 --> 51:24.270 And that's important for understanding all the other demos and stuff that we're going to end up showing you. 51:27.150 --> 51:30.830 Then there's the difference between low frequency and high frequency. 51:30.890 --> 51:34.170 That's a very commonly misunderstood difference. 51:34.170 --> 51:38.130 So we're going to, again, use really, really simple analogies. 51:38.190 --> 51:42.970 So remember that that credential reader is looking to talk. 51:44.130 --> 51:45.850 So here is. 51:47.550 --> 51:51.670 Here is a example of a contactless smart card, right? 51:51.670 --> 51:59.810 So instead of just providing the information without any authentication, there is something that takes place between the card and the reader called mutual authentication. 51:59.850 --> 52:14.590 There is a secret handshake that takes place between the card and the reader that has to be mutually authenticated by both sides before that card data can be read from the card and then transmitted to the door controller. 52:14.670 --> 52:23.870 So if you are trying to, say, get this card's data and you don't understand that handshake protocol, you won't be able to actually get that credential information. 52:27.530 --> 52:30.350 So how many languages does your reader speak? 52:30.350 --> 52:35.730 I'm going to be showing you a couple of demos today using what are called migration or transition readers. 52:35.730 --> 52:42.390 Some readers will only work with one type of credential, meaning they only speak one language. 52:42.390 --> 52:45.330 Some readers will read multiple credential technologies. 52:45.330 --> 52:52.210 They might read Prox and Mandala and also some high-frequency stuff like MyFair or iClass or Desfire. 52:52.210 --> 53:04.410 So your card reader might speak multiple different languages and have the ability to read multiple credential technologies, but again, door controller does not care. 53:04.410 --> 53:09.170 Door controller is still, again, getting sanitized data from the card reader. 53:09.630 --> 53:11.570 We're going to skip ahead a little bit. 53:13.130 --> 53:18.570 So when you are cloning, you need to know the same language that the reader is speaking, right? 53:18.570 --> 53:23.630 So here's our attacker. 53:23.630 --> 53:28.270 Our attacker knows how to talk to the card and it records that information. 53:28.270 --> 53:35.970 And then when we approach the reader, we're going to speak the same language as the original card, right? 53:37.770 --> 53:40.330 What if you don't know the language? 53:40.330 --> 53:45.810 And what I mean by this, and we're going to do demos about all this, so I apologize if I'm going a little bit fast. 53:45.810 --> 53:48.170 I want to make sure that we have time to cover everything. 53:48.630 --> 53:50.390 What if you don't know the language? 53:50.390 --> 53:58.310 What if you have an encrypted credential or contactless smart card that you don't know the key or the password to? 53:58.310 --> 53:59.830 Or you don't know the protocol. 53:59.830 --> 54:01.370 How do you deal with that? 54:01.370 --> 54:08.430 Well, remember, the thing that we actually care about is the credential data itself, not necessarily the card. 54:08.430 --> 54:10.330 The card is just a container. 54:10.770 --> 54:21.360 So here, as an attacker, we're looking at a credential in a reader and we're like, man, they have a secret handshake. 54:21.360 --> 54:26.140 I don't know how to replicate that secret handshake. 54:26.180 --> 54:31.080 So instead, what we're going to do is we're going to take that reader off the wall. 54:34.310 --> 54:36.190 We're going to borrow him, right? 54:36.190 --> 54:37.910 So we're going to borrow the reader. 54:37.910 --> 54:40.170 We're not even going to connect it to a real door controller. 54:40.170 --> 54:42.850 We're just going to connect it to our own data logger. 54:43.330 --> 54:46.390 And we're going to give it some power and we're going to read a credential. 54:46.390 --> 54:50.010 So that card reader knows the secret handshake. 54:50.010 --> 54:53.890 It's able to talk to that credential and get that PAX data. 54:53.890 --> 54:55.610 And now we have it as well. 54:56.210 --> 55:02.970 If we can find another way of getting that PAX data to the door controller, then that's all we need. 55:02.970 --> 55:04.230 The game is over. 55:09.260 --> 55:23.980 So in this example where the card reader can speak multiple languages, so to speak, we can just provide that card information in a format that the reader understands and then the system will operate as if it was the original card. 55:26.920 --> 55:32.220 I'm going to give you one more analogy just to really kind of seal in the flavor, so to speak. 55:32.220 --> 55:37.040 Think of low frequency credentials like PROXX, Andala, IO, EM, and others. 55:37.040 --> 55:43.240 Think of them as just a file folder that all you have to do is open it and there's your WGAN data. 55:43.240 --> 55:44.640 It's just right there. 55:44.640 --> 55:52.600 You don't necessarily have to understand what all the ones and zeros mean, but you can just take that piece of paper, stick it in a copy machine, and now you have a duplicate. 55:54.160 --> 56:08.300 With smart cards, with high frequency credentials, what we're talking about is taking that credential information, locking it in a bag, and then putting that bag in a safe with a unique combination that only the reader knows. 56:08.920 --> 56:13.180 That's what we're talking about when we talk about MyFair, when we talk about iClass. 56:13.340 --> 56:17.380 Again, we're not going to get too deep into technical details because we don't have time for that. 56:17.380 --> 56:21.700 We have a lot of demos we want to show you, so we'll skip over these slides here. 56:22.840 --> 56:29.560 So, now that you understand that, you understand the building blocks of what I call a technology downgrade attack. 56:29.680 --> 56:37.640 This is a slide that anyone who has seen any of our trainings that we've done over the past 10 years or so may have seen. 56:37.640 --> 56:42.140 It shows an iClass SEOS card next to a Prox card. 56:42.400 --> 56:49.100 And what I explain is that as far as the door controller is concerned, these two cards are equal. 56:49.100 --> 56:50.600 Well, how can that be? 56:50.600 --> 56:59.900 What we're talking about is a situation where the card reader can read multiple credential technologies, but the PAX data on both cards is the same. 56:59.900 --> 57:03.160 That will make more sense once I start doing the demo. 57:07.430 --> 57:22.370 So, just to give you an example of readers that can speak multiple languages, so to speak, I have here an example of what we call a migration or transition reader. 57:22.430 --> 57:27.950 I'm going to try to get this to focus. 57:32.460 --> 57:35.080 All right, it's focused-ish. 57:35.560 --> 57:36.620 Let's see. 57:39.290 --> 57:41.850 Come on, camera, you can do it. 57:41.850 --> 57:44.190 A little bit up. 57:44.770 --> 57:52.730 Yeah , it really doesn't want to be focused. 57:53.610 --> 57:55.270 All right, it's close enough. 57:55.270 --> 57:57.250 We can see that that word says secured. 57:57.390 --> 57:59.930 So, this is an example of a migration reader. 58:00.070 --> 58:05.490 This is a reader that is used for customers that are upgrading from an older technology to a newer one. 58:05.490 --> 58:13.530 So, let's say you have a facility that is still using Prox or still using Andala, and you're like, man, we've got to upgrade, but we've got thousands of doors. 58:13.530 --> 58:15.170 We can't do all that in one weekend. 58:15.170 --> 58:18.250 That's unrealistic and sounds very expensive. 58:18.370 --> 58:21.290 So, instead, what you do is you use a migration reader. 58:21.290 --> 58:26.310 The migration reader can read both older credential technologies and new ones. 58:26.370 --> 58:39.350 So, at your own pace, your integrator can go out and upgrade readers in the building, and when an entire site has all the readers changed, then you can start upgrading credentials. 58:39.350 --> 58:47.970 So, while you're doing the upgrade, everyone who still has old cards, their cards still work, because those new readers speak multiple languages, right? 58:48.090 --> 58:57.230 Once all the readers have been replaced, then we can take people's old cards away and show them newer, secure credentials, which the readers also understand. 58:57.310 --> 59:09.250 However, what is not always done, a step that is often missed, is disabling that older credential technology in the reader and preventing those old cards from working. 59:09.330 --> 59:15.790 That's important, because if you don't do that, then you're susceptible to what's called a format downgrade attack. 59:16.030 --> 59:18.970 Not format, technology downgrade attack. 59:18.970 --> 59:21.970 This slide had a typo there. 59:21.990 --> 59:31.530 So, I'm going to show you multiple cards that are going to show up as the same credential, but they are different technologies. 59:31.770 --> 59:35.810 So, we have here a prox card. 59:35.810 --> 59:39.710 So, we're going to present that prox card, and that gives us access granted. 59:39.710 --> 59:48.410 Our WGAN data represented in hex, for the sake of simplicity, is 2547EC068. 59:48.570 --> 59:49.990 Here's a different card. 59:49.990 --> 59:51.950 This is an Indala card, right? 59:51.950 --> 59:57.190 Different card technology, but it's encoded with the same PAX data. 59:57.190 --> 01:00:02.830 When I present that credential, we can see the same data, 2547EC068. 01:00:02.870 --> 01:00:08.170 Again, for those of you who might have gotten lost, when I switched from binary to hex, it's the same data. 01:00:08.170 --> 01:00:11.370 We're just representing it in a different base. 01:00:11.370 --> 01:00:14.970 So, it's base 16, instead of base 2 or base 10. 01:00:15.410 --> 01:00:20.810 So, as far as the door controller is concerned, these two cards are the same. 01:00:20.810 --> 01:00:25.690 It's seeing the same data, because this reader speaks multiple languages. 01:00:25.690 --> 01:00:27.610 Here's a different example. 01:00:27.670 --> 01:00:30.850 Here is a I-class credential, right? 01:00:30.850 --> 01:00:34.310 And again, the same data is on the card. 01:00:34.390 --> 01:00:42.350 So, now you're beginning to understand that the card technology itself doesn't matter, because the card is just a container. 01:00:42.350 --> 01:00:47.650 It's what's inside that card that matters to both the reader and to the door controller. 01:00:50.920 --> 01:00:53.180 So, let's see here. 01:00:53.180 --> 01:00:56.600 Let me see if the live demos are coming up now or next. 01:00:57.420 --> 01:01:00.780 We're going to do all the live demos at once, so I'm going to get through all of this content. 01:01:00.780 --> 01:01:01.620 Iceman, what do you think? 01:01:01.620 --> 01:01:04.640 Should we get through all the slides and just do all the live demos at once? 01:01:05.140 --> 01:01:08.480 Let's go all the slides and then we'll take the live demos afterwards. 01:01:08.480 --> 01:01:09.740 Yeah, I like that idea. 01:01:09.920 --> 01:01:12.000 I like that concept. 01:01:12.680 --> 01:01:15.540 So, remember, technology downgrade attack. 01:01:17.980 --> 01:01:22.840 So, now we talked about cards to reader communication. 01:01:22.940 --> 01:01:27.400 Let's talk briefly about reader to panel communication. 01:01:27.400 --> 01:01:30.820 What does it look like after the reader has read the credential? 01:01:30.960 --> 01:01:37.000 Well, here is that visual representation of WGAN data on the wire, but I can do you one better. 01:01:37.000 --> 01:01:38.660 I can actually show you. 01:01:39.780 --> 01:01:44.720 What I'm going to do is I'm actually just going to remove this reader. 01:01:44.720 --> 01:01:52.060 So, here's that reader that we were just using, and I am going to connect it to 01:01:56.400 --> 01:01:57.900 a logic analyzer. 01:02:01.360 --> 01:02:03.160 So, there's our card. 01:02:25.000 --> 01:02:31.600 Alright, so, again, we have our reader, which is currently covered up by Iceman's beautiful face. 01:02:31.600 --> 01:02:34.880 So, I'm just going to move this down here. 01:02:35.260 --> 01:02:36.560 So, here's our reader. 01:02:36.740 --> 01:02:38.440 Good, our video is still working. 01:02:38.740 --> 01:02:43.200 And what I'm going to do is I already have my channels set up. 01:02:43.200 --> 01:02:50.540 So, this channel 0, channel 1 is actually directly connected to those WGAN data lines coming out of the reader. 01:02:50.540 --> 01:02:54.840 So, this is the electrical signals that the door controller would be seeing. 01:02:55.460 --> 01:02:58.540 And I'm going to take that same I-class credential. 01:02:59.420 --> 01:03:01.920 So, here's an I-class credential, right? 01:03:01.920 --> 01:03:05.660 And I'm going to start recording, and I'm going to present it to the reader. 01:03:05.660 --> 01:03:07.580 And you just saw a blip go by really fast. 01:03:07.580 --> 01:03:10.660 Let's go ahead and zoom out and zoom back in. 01:03:11.660 --> 01:03:14.940 And we have the data represented in two different ways here, actually. 01:03:14.940 --> 01:03:17.440 So, we have, here's the digital representation up here. 01:03:17.440 --> 01:03:20.660 So, we have the line pulled high, the line pulled low. 01:03:20.660 --> 01:03:24.240 And here we can see what that actually looks like from an analog perspective. 01:03:24.240 --> 01:03:30.660 So, normally those data lines are held at 5 volts, and then they're pulsed briefly to 0 volts, and then released again. 01:03:30.780 --> 01:03:38.860 Now, what I really love about this particular example, and I'm going to try to zoom this so it all fits on the screen. 01:03:38.860 --> 01:03:39.560 Perfect. 01:03:39.560 --> 01:03:43.180 Alright, remember this fake Wigan card that we made? 01:03:43.180 --> 01:03:44.760 Let's take another look. 01:03:45.000 --> 01:03:47.850 I told you that all those cards have the same data. 01:03:49.800 --> 01:04:03.670 If you look at the data represented in the logic analyzer, you'll notice that all the ones and zeros line right up. 01:04:03.670 --> 01:04:13.050 So, here we have 1, 0, 0, 1, 0, 1, and here we have 1, 0, 0, 1, 0, 1, and so on and so forth. 01:04:13.050 --> 01:04:14.670 It's literally that simple. 01:04:14.670 --> 01:04:24.690 As the data comes out of the reader, it's being converted into these very, very basic electrical signals that the door controller interprets as logical ones and zeros. 01:04:24.810 --> 01:04:30.310 So, there's no extra layers on top of it beyond that. 01:04:30.310 --> 01:04:44.550 We just scanned an I-class credential, but we can see by connecting to the wires that we're still just seeing the same data as if it was still a Wigan credential from the 1980s. 01:04:44.690 --> 01:04:51.350 And that is a really important piece of context that I think is important to be aware of. 01:04:51.610 --> 01:04:55.230 So, we'll go ahead and move that back out of the way, 01:05:03.320 --> 01:05:04.980 and we'll switch here. 01:05:05.700 --> 01:05:12.000 So, again, no matter what you're talking about as it relates to the credential, that's just talking about the first link. 01:05:12.000 --> 01:05:16.660 It has nothing to do with that second piece of the communication. 01:05:16.660 --> 01:05:18.720 That is usually Wigan. 01:05:18.720 --> 01:05:19.880 Not always. 01:05:19.880 --> 01:05:24.260 There are a couple of data protocols and communication protocols that exist. 01:05:24.280 --> 01:05:26.260 Most of them are unencrypted. 01:05:26.260 --> 01:05:34.900 OSDP version 2 has something called secure channel protocol, which can encrypt the data between the card reader and the door controller. 01:05:34.900 --> 01:05:41.480 It does have to be set up correctly for it to work reliably, but that is the only way that that credential information is encrypted. 01:05:41.480 --> 01:05:50.120 And it's one of the mitigations that we will discuss at the end for ways that you can defend your access control system against malicious manipulation. 01:05:51.540 --> 01:06:01.100 That Wigan communication, that signal that you all just saw on the logic analyzer, is something that we can intercept, and we can take advantage of how simple it is. 01:06:01.100 --> 01:06:03.680 There have been a number of tools over the years that do this. 01:06:03.820 --> 01:06:10.400 Years and years ago, Zach Franken and Adam Lloyd built a beautiful tool called the Gecko, and then later on the Chameleon. 01:06:10.400 --> 01:06:16.720 And its only job was to sit on those Wigan wires, intercept that data, and then allow you to come back and replay it. 01:06:16.720 --> 01:06:20.760 In recent years, there have been a number of open source projects that do the same thing. 01:06:20.760 --> 01:06:33.540 A few years ago, Mark Visaggio and Eric Evinchik released the BLE key, which is a little battery-powered tool that you punch down behind the reader and it just monitors those Wigan data lines and records credential information. 01:06:33.920 --> 01:06:48.800 And then a little bit more recently, also still a few years ago, one of our other friends, Kenny McElroy, he developed the ESP key, which was powered off the bus rather than the battery, and used Wi-Fi instead of Bluetooth. 01:06:48.800 --> 01:06:50.560 But the concept was the same. 01:06:50.640 --> 01:06:58.540 This is something that you can install behind the reader, and intercept that credential information, and then just come back and replay it. 01:06:58.540 --> 01:07:04.300 If we have time, after all of our other cooler demos, in my opinion, we can do a demo of that as well. 01:07:04.300 --> 01:07:12.220 But I just wanted to cover this as something that is a completely valid attack still today on any systems that are running Wigan. 01:07:14.930 --> 01:07:29.630 So what we're doing with an ESP key is, again, if we think about our analogy, when that credential data is read from the card and transmitted from the reader to the door controller, the ESP key or the Gecko or the BLE key, it's listening and it's able to record that information. 01:07:29.730 --> 01:07:34.970 Then when we as an attacker approach the door, we don't actually deal with the card reader at all. 01:07:34.970 --> 01:07:37.330 We don't have a card even, necessarily. 01:07:37.330 --> 01:07:45.490 What we do is we interact directly with the ESP key, check to see if there's any credentials recorded, and then tell the ESP key to replay it. 01:07:45.490 --> 01:07:53.150 The door controller, not knowing that there's another device connected to the line, will see the same data and process the transaction the same way. 01:07:56.160 --> 01:07:58.100 Just a couple of photos of the install. 01:07:58.100 --> 01:08:00.000 We'll skip over the video. 01:08:00.000 --> 01:08:03.900 The last piece, panel to server communication. 01:08:04.040 --> 01:08:08.680 And we have a special surprise demo with this one as well that hopefully we have time for. 01:08:10.300 --> 01:08:16.180 Remember, these door controllers often do run on Ethernet, especially today. 01:08:16.180 --> 01:08:24.040 And remember how I said they are basically embedded Linux devices that maybe aren't always super protected? 01:08:24.040 --> 01:08:33.000 So both the software and the door controllers themselves have to be protected properly on a segmented network. 01:08:33.000 --> 01:08:35.480 Otherwise, interesting things can happen. 01:08:35.520 --> 01:08:46.460 Because these door controllers are usually Linux devices or other embedded hardware that are not part of the normal IT infrastructure, they're not part of the normal patch cycle. 01:08:46.460 --> 01:09:01.020 In fact, a lot of vendors specifically call out in the instructions that you don't have to tell IT about this because this is just a physical security appliance. 01:09:01.020 --> 01:09:04.540 This is not a computer, even though it actually is a computer. 01:09:04.660 --> 01:09:20.240 And so you often times run into situations where libraries, open source libraries used by Linux hardware are criminally out of date or they have security holes or other bugs or whatnot in the system, in the firmware that can be exploited. 01:09:20.500 --> 01:09:27.380 And door controllers are also not something that most users update because they don't want their system to go down. 01:09:27.420 --> 01:09:32.920 So the only time that you update your firmware on a door controller in practice is when there is a problem. 01:09:33.220 --> 01:09:40.300 I don't know of any of my clients, actually, that routinely update the software, rather the firmware, on their door controllers. 01:09:40.700 --> 01:09:43.860 And you'll see why that can be a problem here in a moment. 01:09:43.860 --> 01:09:50.100 And actually, there was a few years ago, there was a really great toolkit called Concierge. 01:09:50.100 --> 01:09:55.480 If people have trouble finding it on GitHub, I'll post the link during the Q&A. 01:09:55.580 --> 01:10:09.280 Concierge was a collection of exploits that were patched, but then released, that allows you to directly scan for and then compromise different brands and models of door controllers. 01:10:09.280 --> 01:10:20.340 So instead of attacking the card or attacking the reader, you can attack the door controller itself and either tell it to open a door or add new users to the local database, etc. 01:10:20.340 --> 01:10:21.540 Stuff like that. 01:10:22.960 --> 01:10:24.240 How can you target it? 01:10:24.240 --> 01:10:26.020 Well, you've got to be on the same network. 01:10:26.100 --> 01:10:28.960 And initially, you're like, OK, well, that's a little hard, right? 01:10:28.960 --> 01:10:32.800 I've got to either break their Wi-Fi or find a port to plug into. 01:10:32.800 --> 01:10:34.320 Not necessarily. 01:10:34.380 --> 01:10:51.020 You can actually find a lot of door controllers directly connected to the Internet using Google or using Shodan, and you will find different door controllers that, again, are running outdated software that are directly connected to the Internet. 01:10:51.380 --> 01:10:52.740 How outdated? 01:10:52.740 --> 01:11:01.920 Well, the couple that we found, when we tried to connect to it, the version of SSL was so old, all the modern browsers we used wouldn't let us try to talk to it. 01:11:03.560 --> 01:11:10.120 Instead, we had to manually turn off SSL and connect to it over HTTP. 01:11:10.440 --> 01:11:15.720 And then, of course, you have default credentials, admin, admin, used to log in. 01:11:15.720 --> 01:11:24.380 Again, that's an example of what not to do with your door controller and why it's so important to be mindful of how integrators are deploying and installing hardware. 01:11:26.540 --> 01:11:29.420 This is where the slides go a little bit sideways. 01:11:29.420 --> 01:11:32.740 And I appreciate everyone being very forgiving here. 01:11:32.740 --> 01:11:41.340 We have a lot of topics that we were trying to cram into this, and we have now just about 55 minutes left for demos, so we're just going to get through a couple more slides. 01:11:42.060 --> 01:11:48.100 I mentioned that different card readers can have different configurations. 01:11:48.580 --> 01:11:50.660 They can read different technologies. 01:11:50.660 --> 01:11:59.700 And I mentioned that a best practice is to turn off those older technologies in order to protect the system from being manipulated. 01:11:59.760 --> 01:12:00.960 How do you do that? 01:12:00.960 --> 01:12:03.560 If weekend is one way, how do you do that? 01:12:03.560 --> 01:12:05.360 There's no Ethernet port on it. 01:12:05.360 --> 01:12:08.840 Well, there are things called configuration cards. 01:12:08.840 --> 01:12:11.720 Configuration cards are not unique to one vendor. 01:12:11.780 --> 01:12:22.980 Many vendors support different types of configuration cards that are special cards that the reader will only read during its boot-up cycle, and it will reconfigure how that reader operates. 01:12:22.980 --> 01:12:31.920 That can change things like the key that's stored on the reader, so if the customer wants a special or a custom or a unique key, they can do that. 01:12:31.920 --> 01:12:38.900 They can also change which card technologies are supported by the reader, so you can turn different technologies on and off. 01:12:39.980 --> 01:12:42.240 There's a lot of other behaviors you can change as well. 01:12:42.240 --> 01:12:47.380 You can change the LED color, you can change whether or not it beeps, how long it beeps for, all that stuff. 01:12:47.380 --> 01:12:51.040 All that can be changed through the use of configuration cards. 01:12:51.040 --> 01:12:54.220 That's important to keep in mind once we get to our demos. 01:12:55.800 --> 01:13:02.860 So using configuration cards, you can do a couple of interesting things, and we're going to show you demos of all this stuff. 01:13:03.900 --> 01:13:20.820 A new exploit, a topic that is not completely brand new, but no one has really talked about, is a method of doing a denial-of-service attack against certain older readers that prevent valid users from using the facility. 01:13:20.920 --> 01:13:24.340 We're also going to do a live demo of a tech downgrade attack that I mentioned. 01:13:24.340 --> 01:13:30.640 We're going to take secure, high-security credentials that, as far as we know, there's no public thing on Defeat. 01:13:30.640 --> 01:13:34.340 People don't know how to break DESFire, EV1, EV2. 01:13:34.580 --> 01:13:37.620 People don't really know how to break CEOS currently. 01:13:37.700 --> 01:13:44.940 But depending on how the rest of the system is configured, we'll see how we don't even need to do that to necessarily create a working clone. 01:13:45.200 --> 01:13:47.560 And then we're also going to do an example of key recovery. 01:13:47.560 --> 01:13:52.980 This is related to the low-class attack, or leak key extraction, that was released many years ago. 01:13:53.180 --> 01:13:59.820 But Iceman has written some new tools for the Proxmark 3 to make that even easier and even faster. 01:14:00.160 --> 01:14:05.920 And we spent a lot of time testing it and debugging it over the past couple of weeks, and it's so freaking awesome. 01:14:05.920 --> 01:14:07.760 I'm really excited to share it with you all. 01:14:11.410 --> 01:14:19.730 So, before we get to demos, Iceman, you want to talk a little bit about some of the new tools that have come out within the past six months regarding RFID? 01:14:20.730 --> 01:14:22.250 Yes, I do, actually. 01:14:22.250 --> 01:14:26.710 And that was an amazing crunching of the old PAX background. 01:14:27.110 --> 01:14:29.270 Defeating the PAX man ghost. 01:14:29.670 --> 01:14:35.190 And yes, you got a lot of info about what's the setup now. 01:14:35.190 --> 01:14:37.650 So what is the tools that we use? 01:14:38.010 --> 01:14:41.130 What are we using today when we do this stuff? 01:14:41.210 --> 01:14:44.010 I need to just move a little bit here on the slideshow. 01:14:44.010 --> 01:14:44.630 Sure. 01:14:46.110 --> 01:14:49.710 And let's see, I'm on almost the same part of you. 01:14:50.830 --> 01:14:51.990 And there we go. 01:14:52.490 --> 01:14:57.970 It's because the screens I get from Parvac is very blurry, so I can't see what it says on it. 01:14:58.450 --> 01:15:00.050 Even if I know it by heart. 01:15:00.450 --> 01:15:02.470 So, the new tools of 2020. 01:15:02.470 --> 01:15:07.950 We talked about the BLE key and ASP key, and of course, everybody knows the Proxmark. 01:15:08.350 --> 01:15:22.630 There was... Adam Lorre is a famous name, he's also called as RFIDidiot, and he's an amazing RFID researcher, slash hacker, and DEFCON quarter manager, quarter major? 01:15:22.630 --> 01:15:23.290 Quarter master. 01:15:23.530 --> 01:15:25.930 Quarter master, okay, right, sorry. 01:15:26.570 --> 01:15:28.450 Got to get the titles correct. 01:15:29.410 --> 01:15:38.330 And he has just recently released and made something for NFC tools, the LibNFC-based version. 01:15:38.330 --> 01:15:54.590 It is called NFC iClass, and that's a software that gives the possibility to use your old other readers, PM53532 or 5333, and you can now communicate with iClass. 01:15:54.590 --> 01:15:56.670 It wasn't possible before. 01:15:56.670 --> 01:16:15.190 You have to see, iClass has been like a little bit of a separate world, because it's been a little bit special, and the crypto involved with it, it wasn't adapted to different tools, and also about keys, of course, and HRD being known as a little bit hard hands. 01:16:16.150 --> 01:16:23.290 So, this is a major step that he did with this software, because it enables us to do things. 01:16:23.490 --> 01:16:33.110 And the other one is the Proxmark, which you all know that I know about, and you know that everybody else knows about, which is the Swiss armor knife of RFID hacking. 01:16:33.630 --> 01:16:53.890 And now what happened here is some really intensive changes to the firmware and client used, which includes what I would call FPGA changes, and a new iClass standalone mode, which involves some separate modes I will talk more about, because it comes related to the surreptitious attacks that we want to demo for you. 01:16:53.890 --> 01:16:57.230 So, without further ado, next slide. 01:16:57.750 --> 01:16:59.290 Oh, yeah, my apologies. 01:16:59.490 --> 01:17:03.870 Yeah, my assistant Babak has to do this. 01:17:04.430 --> 01:17:06.010 And for you, Rick, I'm going to do this. 01:17:06.010 --> 01:17:08.450 Because it's DEF CON, you're going to get this one. 01:17:08.450 --> 01:17:09.570 It's for you, Rick. 01:17:12.010 --> 01:17:13.330 I'm Iceman. 01:17:13.610 --> 01:17:14.730 And that's it. 01:17:15.870 --> 01:17:21.770 So, yes, NFC tools, iClass by Adam Lorry. 01:17:21.770 --> 01:17:31.590 It uses the LibNFC behind it, and you see Filip Tøven and DotJocks, you know, the little puppet there, and they make it great. 01:17:31.590 --> 01:17:47.930 It tricks, and it uses a trick, because the LibNFC is not very good on ISO 15693 protocol, so it uses a trick where it actually, because iClass can talk to different tech, is ISO 443B or 15693. 01:17:47.930 --> 01:17:53.270 So, on this version, it tricks the reader to use that to talk to an iClass. 01:17:53.270 --> 01:18:09.810 The thingy, thingy, thingy, the fine, fine thing here is, of course, that what we are interested in is that this tool, Adam was so gracious, he made us config cards, possibilities to generate simply by open source. 01:18:10.150 --> 01:18:18.250 Other people, like Babak and other people, of course, have had the possibility to generate config cards at will, like many of us. 01:18:18.250 --> 01:18:28.190 But it hasn't been publicly released in the way that it has done now, so this is a good stepping stone for what is to come, of what we want to see. 01:18:28.410 --> 01:18:30.950 You can skip to the next slide. 01:18:33.450 --> 01:18:35.830 I'm not going to talk so much about the config card. 01:18:36.370 --> 01:18:44.070 It's the concept of having a config card that's interesting, not what the config card is, and how it's done, or whatever. 01:18:44.070 --> 01:18:45.310 You can look at that software. 01:18:45.310 --> 01:18:46.970 So, the next one is... 01:18:47.570 --> 01:18:49.990 We're not supporting I-Class timeline. 01:18:50.190 --> 01:18:51.350 Yes, yes. 01:18:51.370 --> 01:19:06.950 So, given the support for I-Class in Proxmox, I don't know how it is, but Proxmox is an open source tool, and it's as good as the firmware is, and it has had a story of two different repos, mainly mine and the official repo. 01:19:06.990 --> 01:19:12.930 And the thing is how this happened to be able to speak I-Class. 01:19:12.930 --> 01:19:30.110 And it started 2010-2013, where Ruelle researchers, cryptological researchers called Ruelle and Milosh and all those others, did some amazing attacks and research about the I-Class system, the encrypto, the hashes used, and released tools and attacks about it. 01:19:30.110 --> 01:19:37.350 And they also released some Malgos into the Proxmox repo, but that was it. 01:19:37.650 --> 01:19:55.570 And skipping a little bit forward, 2014-2015, a user called Hollyman, he did some improvements, where he actually implemented the crypto, the I-Class crypto use, which was a major thing, because before that Proxmox couldn't really talk I-Class. 01:19:55.670 --> 01:20:04.730 It's a deviant of ISO 15693, so I-Class is a little bit different, and you need the crypto part as well. 01:20:04.730 --> 01:20:23.010 So he did that, which is an amazing feature, and he also implemented, from that research made before, from Ruelle and everybody, he also made that elite key recovery attack, which we all call low-class nowadays, which has been, since then, has been a state-of-the-art attack to recover elite keys, 01:20:23.350 --> 01:20:28.570 based on Carl and Babax and all other people who helped to get the readers and all that. 01:20:28.570 --> 01:20:29.310 It's amazing. 01:20:29.310 --> 01:20:30.070 It's a shout-out. 01:20:30.070 --> 01:20:36.990 I'm just doing a shout-out to people who have done this, and I want to show appreciation for them, because that's what it is. 01:20:37.790 --> 01:20:43.570 Skipping forward again, 2008 and 2019, until then, nothing much happened with I-Class. 01:20:43.670 --> 01:20:45.550 The support worked. 01:20:45.550 --> 01:20:47.130 It was bad modulation. 01:20:47.130 --> 01:20:48.650 You had to find the right spot. 01:20:48.650 --> 01:20:52.310 If you ever used a Proxmog, you always were like, do you have the right antenna? 01:20:52.310 --> 01:20:53.770 Do you have the right distance? 01:20:53.770 --> 01:20:58.710 It's fidgety, and you might have been able to do the sniffing, snooping, and reading. 01:20:58.710 --> 01:21:00.330 It's a painful experience. 01:21:00.330 --> 01:21:09.470 If you've been as long as I've been into the Proxmog world, where it's come from, you know, crashing and bugging and everything like that, it's been painful. 01:21:09.730 --> 01:21:16.330 2018-2019, another user, who actually is another amazing contributor, is Peavey. 01:21:16.330 --> 01:21:23.450 And he did some historic use improvements on this code and form interface class. 01:21:23.450 --> 01:21:26.750 We majorly improved this. 01:21:26.750 --> 01:21:29.190 I talk majorly. 01:21:29.190 --> 01:21:37.110 And that really made the official repo, he works in the official repo, it makes it super, super stable. 01:21:37.410 --> 01:21:40.090 So all of a sudden, we have a good communication. 01:21:40.210 --> 01:21:41.790 We have all the pieces in place. 01:21:41.790 --> 01:21:45.570 Remember now, we have a public config card-generated software. 01:21:45.690 --> 01:21:51.730 We have good stability in Proxmog, reading of the cryptos, and we now have a very good way of doing it. 01:21:51.730 --> 01:21:58.890 I can talk more about how it's actually done, how it changes, and why it's kind of awesome the way he did it, because he went kind of deep. 01:21:58.890 --> 01:22:00.490 I will talk a little more about it. 01:22:00.510 --> 01:22:03.650 And 2020 is what I call Merge Hell start. 01:22:03.930 --> 01:22:06.250 And I will... yeah. 01:22:06.610 --> 01:22:07.850 Merge Hell is something... 01:22:08.450 --> 01:22:09.930 It's a little my fault. 01:22:10.390 --> 01:22:10.750 So... 01:22:11.730 --> 01:22:13.150 Yeah, you want to talk about that? 01:22:13.150 --> 01:22:13.790 Yeah, yeah, yeah. 01:22:13.790 --> 01:22:18.490 So I met Iceman for the first time in person last year, at DEF CON last year. 01:22:18.790 --> 01:22:23.570 And I pulled him aside at some point, and I'm like, hey, first of all, thank you for all the hard work. 01:22:23.570 --> 01:22:25.110 Like, I can't write code. 01:22:25.190 --> 01:22:26.570 Like, I wish I could contribute more. 01:22:26.570 --> 01:22:31.050 I can contribute in testing, I can contribute hardware, I can do a lot of other stuff. 01:22:31.050 --> 01:22:32.430 I'm not a great coder. 01:22:32.430 --> 01:22:34.050 I can do a lot of other things. 01:22:35.270 --> 01:22:37.290 Why is iClass so unstable? 01:22:37.290 --> 01:22:37.910 He's like, what do you mean? 01:22:37.910 --> 01:22:38.810 It works fine for me. 01:22:38.810 --> 01:22:41.330 I'm like, no, it's really bad. 01:22:41.330 --> 01:22:43.570 I don't know if you really appreciate how bad it is. 01:22:44.250 --> 01:22:45.730 It's unusable bad. 01:22:46.730 --> 01:22:56.070 And at some point, PeeWee made all these changes in the official repo, and all of a sudden it was rock solid, but, like, RRG was, like, still behind. 01:22:56.070 --> 01:23:03.210 And I'm like, oh, man, like, surely at some point it's going to be merged, but I didn't really appreciate how much work it was. 01:23:03.230 --> 01:23:06.570 So what I did is I tricked Iceman a little bit. 01:23:06.590 --> 01:23:13.850 I invited Iceman to participate in some of our trainings that we were doing for our professional pen testers. 01:23:13.990 --> 01:23:15.890 We were in classes. 01:23:16.250 --> 01:23:17.730 And just to watch. 01:23:17.730 --> 01:23:22.810 And he saw, he saw how bad the performance was. 01:23:22.890 --> 01:23:24.990 Again, not his fault. 01:23:24.990 --> 01:23:26.530 This is a community project. 01:23:26.530 --> 01:23:28.210 Everyone is doing their best. 01:23:28.810 --> 01:23:32.510 But that was, that was the thing, like a month and a half ago, right? 01:23:32.510 --> 01:23:33.930 That was in June. 01:23:34.150 --> 01:23:35.970 Where you're like... 01:23:35.970 --> 01:23:36.970 It was bad. 01:23:37.630 --> 01:23:40.550 Anyone who was in that June class, it was a solid class. 01:23:40.550 --> 01:23:46.970 But once we got to I-class, we hit a freaking brick wall because we just had a lot of trouble communicating with cards. 01:23:47.330 --> 01:23:48.950 You've been having that for years. 01:23:48.950 --> 01:23:51.810 The thing is, I use it at home. 01:23:51.810 --> 01:23:52.970 I have some credentials. 01:23:52.970 --> 01:23:54.050 It works. 01:23:54.190 --> 01:23:54.870 That's it. 01:23:54.870 --> 01:23:56.410 You don't do very much more with it. 01:23:56.410 --> 01:23:57.550 You don't need to. 01:23:57.710 --> 01:23:59.430 You dump some cards and look at it. 01:23:59.430 --> 01:24:01.530 It works. 01:24:01.670 --> 01:24:07.550 But for a class, for teaching, for using it on field, oh man, that sucks. 01:24:08.390 --> 01:24:15.350 So yeah, two months ago, let's say two months ago, because it started a little bit earlier and I came up to this. 01:24:15.350 --> 01:24:16.830 I decided finally... 01:24:16.830 --> 01:24:23.330 I didn't want to do it because I was actually supposed to do a high tech 2 code and then we made a release of this stable thing. 01:24:23.330 --> 01:24:28.550 Once that was in place, I could do other things and that would become merge hell. 01:24:28.550 --> 01:24:35.850 Meaning that the total changes that we've done for two years to be merged into the RG Iceman repo. 01:24:35.890 --> 01:24:37.330 Which is... yeah. 01:24:37.330 --> 01:24:43.590 The thing is, what I want to say, the most important part is that the I-class support that we made is rock solid. 01:24:43.590 --> 01:24:44.610 It's so good. 01:24:45.750 --> 01:24:49.670 Even if you use LibNFC now, you're going to go like, oh that's ugly. 01:24:49.990 --> 01:24:52.170 Bad compared to this. 01:24:52.170 --> 01:24:53.130 Next slide. 01:24:53.590 --> 01:24:55.550 Oops, sorry. 01:24:56.290 --> 01:25:00.730 And in true Proxmark form, by the way, fixing one thing broke another. 01:25:00.730 --> 01:25:04.690 So I-class support, rock solid. 01:25:04.770 --> 01:25:08.190 ISO 14b support, completely broken. 01:25:08.290 --> 01:25:11.430 Thankfully, not as many people use ISO 14b. 01:25:11.430 --> 01:25:16.210 I think I-class is more useful myself, but it's just whack-a-mole, right? 01:25:16.610 --> 01:25:20.710 Yeah, it's what's... 01:25:21.170 --> 01:25:22.050 God. 01:25:22.530 --> 01:25:23.730 I don't know what to say. 01:25:23.730 --> 01:25:24.510 Anyway. 01:25:26.850 --> 01:25:27.990 I know. 01:25:27.990 --> 01:25:28.770 We're on a timeline. 01:25:28.770 --> 01:25:29.490 I know, I know. 01:25:29.490 --> 01:25:30.230 Sorry. 01:25:32.650 --> 01:25:34.330 I'm trying to do this seriously. 01:25:34.330 --> 01:25:35.490 I know, I know. 01:25:35.490 --> 01:25:36.810 It's so hard. 01:25:37.470 --> 01:25:39.810 Okay, you made me lose my mind here. 01:25:41.090 --> 01:25:42.430 Two repos, yes. 01:25:42.430 --> 01:25:43.910 Two very different repos. 01:25:47.370 --> 01:25:48.650 Yes, two repos. 01:25:48.650 --> 01:25:50.630 Official repo and Iceman repo. 01:25:50.890 --> 01:25:57.630 It's separate a couple of years ago because we wanted to build the support for RG4 a little bit better and put some effort in. 01:25:57.630 --> 01:25:59.810 So it's a different way of using and thinking and using. 01:25:59.810 --> 01:26:04.910 Once you use RG, Iceman repo, you will see the difference and you feel the difference in it. 01:26:04.910 --> 01:26:06.430 It is what it is. 01:26:06.630 --> 01:26:08.210 Basically, the FPGA changes. 01:26:08.210 --> 01:26:11.290 This is an amazing thing because it's a huge feature that's coming out. 01:26:11.290 --> 01:26:13.010 The FPGA changes. 01:26:13.110 --> 01:26:22.010 You have a system here, you have a client on a PC, you have an ARM device and on it you have also an FPGA that talks to the ADC and do things. 01:26:22.010 --> 01:26:23.610 It's all programmable. 01:26:23.610 --> 01:26:29.670 It all had to change and PV made things and move IQ handling and stuff into the FPGA code. 01:26:29.670 --> 01:26:39.030 Since he did that, the thing is, the FPGA before did the ADC signal, send it to the ARM, ARM demodulated, sent it off to the client, the client did all the hard lifting. 01:26:39.030 --> 01:26:45.450 It did all the select the card, it did all the calculation of cryptos, calculation of MAC values when writing and everything like that. 01:26:45.490 --> 01:26:52.570 However, afterwards, FPGA took the signals, made IQ pairs of it and sent those to the ARM. 01:26:52.710 --> 01:26:57.530 ARM decoded that one much better because IQ's demodulation is super much better and stable. 01:26:57.530 --> 01:26:59.470 That's where that comes from. 01:26:59.750 --> 01:27:04.090 And then sent it all off to the client again, who still did the hard lifting. 01:27:04.210 --> 01:27:05.490 Next queue. 01:27:08.170 --> 01:27:11.850 And here is when things become funny. 01:27:12.770 --> 01:27:14.510 You did that and I didn't do that. 01:27:15.390 --> 01:27:23.390 And so, you talk with people, you talk with yourself and you talk with Bambach and you go like, hmm... 01:27:23.390 --> 01:27:26.630 So, we have rock solid demodulation of IQ class. 01:27:26.630 --> 01:27:28.430 What can we do now? 01:27:29.370 --> 01:27:31.110 And you know, it's a bouncing thing. 01:27:31.110 --> 01:27:34.810 I don't want to say who brought that in first because people have been saying these ideas for years. 01:27:35.010 --> 01:27:38.510 But , you know, with all this stuff, I'm like sitting here and I'm like thinking... 01:27:39.170 --> 01:27:41.550 We were talking about it at DEF CON last year. 01:27:41.730 --> 01:27:42.270 Yeah. 01:27:42.630 --> 01:27:43.290 Yeah. 01:27:43.290 --> 01:27:43.370 Yeah. 01:27:43.370 --> 01:27:43.550 Yeah. 01:27:43.550 --> 01:27:45.810 How about moving this crypto? 01:27:46.230 --> 01:27:48.190 How about , you know, do that to ARM, you know? 01:27:48.190 --> 01:27:53.170 And people are... I know I've even kept meeting and asked , why can't you get a nice class standalone mode ? 01:27:53.170 --> 01:27:55.990 And I'm like, yeah, you know. 01:27:55.990 --> 01:28:00.510 It's not solid for demodulation and the crypto parts is also better. 01:28:00.510 --> 01:28:02.390 You know, I don't want to do that work. 01:28:02.690 --> 01:28:03.990 So, we do that stuff. 01:28:03.990 --> 01:28:07.390 So , we're like, how about we move it? 01:28:07.390 --> 01:28:12.250 Now, one part that Peavey did, he actually optimized the crypto so it went even faster. 01:28:12.250 --> 01:28:15.530 And that's needed when you simulate things on the device. 01:28:15.530 --> 01:28:16.690 You need speed. 01:28:16.870 --> 01:28:17.830 So, he did that. 01:28:17.830 --> 01:28:22.150 You know, shaving off milliseconds or microseconds, you know. 01:28:22.610 --> 01:28:38.670 So, I had to refactor the whole code because since before everything was in the client, move it all into the device and by doing that, you can call it achievement unlocked, we have full crypto and MAC generation on the device. 01:28:39.170 --> 01:28:41.610 Which is an amazing feature. 01:28:41.870 --> 01:28:44.390 It enables us to do more things. 01:28:44.390 --> 01:28:48.390 It took a whole remake because the whole flow of work is just different. 01:28:48.950 --> 01:28:53.470 Next thing that comes up, how about a stand-alone mode? 01:28:53.470 --> 01:28:56.970 Now that we can do these things here, how about that? 01:28:57.070 --> 01:28:59.890 Well, you know, how are we going to do the dumps? 01:28:59.950 --> 01:29:04.770 We have a flash memory on Rdb4, so let's do it like that. 01:29:04.770 --> 01:29:09.790 So, let's create a stand-alone mode which can talk iClass. 01:29:10.990 --> 01:29:11.650 Doable. 01:29:11.650 --> 01:29:14.830 Have to rework all the code again because make it work. 01:29:14.830 --> 01:29:21.730 And we actually achieved the very first iClass legacy simulation stand-alone mode one and a half month ago. 01:29:22.690 --> 01:29:28.570 Next question when you do this, just the bouncing ideas and you go like, what more can we do? 01:29:28.570 --> 01:29:31.170 Because we implemented all of this stuff in the client before. 01:29:31.170 --> 01:29:32.990 Can we push the limit? 01:29:32.990 --> 01:29:33.970 What more can we do? 01:29:33.970 --> 01:29:35.130 That would be cool. 01:29:35.590 --> 01:29:46.170 So, how about we do two more modes of the stand-alone modes where we now do reading and dumping. 01:29:46.170 --> 01:29:51.510 Read a tag, proxmark act as a reader and store the credential. 01:29:51.770 --> 01:29:55.550 And the next one is elite reader. 01:29:55.550 --> 01:29:57.670 Do the sim2 attack. 01:29:57.770 --> 01:29:59.570 It's a simple one in that sense. 01:30:00.130 --> 01:30:02.330 And achieve that as well. 01:30:02.330 --> 01:30:03.650 Too much is amazing. 01:30:03.650 --> 01:30:04.870 We have three in one. 01:30:05.610 --> 01:30:08.110 We were not quite done yet. 01:30:08.110 --> 01:30:10.230 And here's the next talk with Babak. 01:30:10.230 --> 01:30:18.750 We said this and he goes like, hey, do you remember my config card glitch attack? 01:30:18.750 --> 01:30:20.230 I want to clarify. 01:30:20.230 --> 01:30:22.050 This is not my attack. 01:30:22.050 --> 01:30:24.210 This was true. 01:30:24.970 --> 01:30:28.370 You showed it to me and you demonstrated it in your trainings and all that stuff. 01:30:28.370 --> 01:30:32.890 So, I called you in the context of where we were. 01:30:33.010 --> 01:30:35.090 But you had it. 01:30:35.090 --> 01:30:36.490 It's your baby. 01:30:36.610 --> 01:30:38.250 So, I'm like, yeah. 01:30:38.770 --> 01:30:41.730 We have a config card glitch attack. 01:30:41.730 --> 01:30:44.030 Okay, so what is that then? 01:30:44.030 --> 01:30:45.630 How does that work? 01:30:46.250 --> 01:30:53.730 Yeah, basically you simulate one, you present one card and then you present another card and Babak will demonstrate all this stuff pretty soon. 01:30:53.750 --> 01:30:56.530 So, I have to refactor all things again and do that. 01:30:56.530 --> 01:30:58.890 And then do that to standalone mode. 01:30:58.890 --> 01:31:06.550 We achieve another thing unlocked and we now have a first ever implementation of a glitching config attack in a standalone mode for Poxbox. 01:31:06.750 --> 01:31:13.130 And we call this standalone mode HF Ice Class because we really love the way naming things. 01:31:13.130 --> 01:31:15.470 Instead of I-Class, we call it Ice Class. 01:31:15.470 --> 01:31:16.550 Because of me. 01:31:17.570 --> 01:31:21.290 However, this little mode only works on Proxmox AutoV4. 01:31:21.290 --> 01:31:29.610 It saves files to the on-board store memory, which will look like this. 01:31:29.610 --> 01:31:32.410 I will explain the four different modes. 01:31:32.630 --> 01:31:35.510 Basically, you upload, you have a dump of your credential before. 01:31:35.510 --> 01:31:36.770 You talked about secure storage. 01:31:36.770 --> 01:31:38.390 You dump it with Proxmox. 01:31:38.390 --> 01:31:39.250 You read it off. 01:31:39.490 --> 01:31:45.770 You send it up to the flash memory and then you just start the standalone mode and it simulates it. 01:31:45.770 --> 01:31:48.710 It keeps on simulating just before but it's a complete standalone. 01:31:48.850 --> 01:31:54.070 You press the button to exit and then it saves a copy of that emulated memory. 01:31:54.070 --> 01:32:04.070 So you have, as you see, you have the original bin that you were simulating the dump and then you have a modified so you can see what the reader did to update it or if it did any updates to it. 01:32:04.070 --> 01:32:07.330 Usually the EPRS of course but it could have changed the PACS data. 01:32:07.670 --> 01:32:09.510 So it's a good thing to have. 01:32:10.130 --> 01:32:11.070 Next. 01:32:12.790 --> 01:32:17.610 The reader attack is based on the elite recovery attack. 01:32:17.610 --> 01:32:26.650 It's a two-phase attack which you need the online part where you send and emulate some CSM and you recover that data, store it to a file. 01:32:27.370 --> 01:32:29.510 And it's a very simple one. 01:32:30.010 --> 01:32:33.210 Since you have the simulation in place, it's very simple to do. 01:32:33.210 --> 01:32:48.790 So as you say that you want to do this attack, you put the CSM on there and you present this to an elite configured reader and it collects the data very fast and it quits the standalone mode and you can go to the next reader and do the same thing. 01:32:48.790 --> 01:32:52.570 Start the standalone mode and collect this data from those and do that over and over again. 01:32:52.610 --> 01:33:00.230 Then you go home and you download it from the memory of the Proxmox and you run the low-class attack and we collect the data and recover the key. 01:33:00.230 --> 01:33:05.470 Super simple, all of a sudden very much more useful for pen tests and all that other stuff. 01:33:05.470 --> 01:33:06.570 Fun attacks! 01:33:08.450 --> 01:33:10.590 The third one is a read and dump. 01:33:10.670 --> 01:33:19.810 It's just a plain simple one for people you want to see go on snooping things credentialed secretly on the toilet, what I've seen someone do with these major antennas. 01:33:19.810 --> 01:33:34.710 Now you can do it with your large HF antenna or battery and you just present it and it just you start it and it starts reading and it starts dumping and you press the button to quit it and it saves all the dumps it finds it saves it to the flash memory. 01:33:34.710 --> 01:33:36.910 As you see here, it has two cards I presented to it. 01:33:36.910 --> 01:33:40.610 It goes kind of fast, it takes a quarter of a second to do it. 01:33:40.730 --> 01:33:44.110 And the glitch and config card... We'll just do a live demo. 01:33:44.810 --> 01:33:45.850 Yeah, yeah, yeah. 01:33:45.990 --> 01:33:47.250 We'll do a live demo, yeah. 01:33:47.530 --> 01:34:11.810 So for glitch and config, what I was explaining before I really cut him off, is that the short version behind the glitch is that there was in two of the most popular versions of firmware of legacy iClass readers, there was a bug in the firmware that if the card was programmed a certain way the card misbehaved, 01:34:11.810 --> 01:34:18.410 the reader would lock up, get confused, and then a watchdog timer would kick in and reboot the reader. 01:34:18.410 --> 01:34:19.950 Normally it's not a big deal. 01:34:19.950 --> 01:34:22.050 Reader reboots still works, no problem. 01:34:22.050 --> 01:34:35.690 However, once you remember that configuration cards can only be used right after the reader boots up, now you have an attack chain that you can use to reconfigure the reader without ever actually taking the reader off the wall. 01:34:35.690 --> 01:34:38.870 And we're going to do a demo of some of the things that you can do with that. 01:34:39.110 --> 01:34:41.470 So now we have 30 minutes for live demos. 01:34:41.470 --> 01:34:46.090 We're going to go very, very, very fast. 01:34:46.090 --> 01:34:47.930 As fast as I reasonably can. 01:34:48.350 --> 01:34:50.510 We worked hard to make this happen for them. 01:34:50.670 --> 01:34:55.050 You have to understand it's been two long months. 01:34:55.050 --> 01:35:04.390 So, I'm going to go fast because RF Hacker Sanctuary is going to kick us off in half an hour sharp. 01:35:04.870 --> 01:35:09.650 So, we can talk about this more later in the Discord channel or elsewhere. 01:35:09.650 --> 01:35:15.370 So, first thing we're going to do, we're going to talk about that tech downgrade attack that I was talking about. 01:35:15.370 --> 01:35:21.190 So, for example we're going to take this reader we had before. 01:35:27.810 --> 01:35:34.090 It's been an intensive month for us to do this and we're really psyched to show you off all of this stuff actually. 01:35:34.090 --> 01:35:35.790 I did not get much sleep. 01:35:36.450 --> 01:35:37.290 Alright. 01:35:37.650 --> 01:35:45.610 So, we have this reader and if you recall, that reader reads multiple credential technologies. 01:35:45.610 --> 01:35:48.110 So, it reads Prox. 01:35:48.490 --> 01:35:50.810 It reads Indala. 01:35:51.730 --> 01:35:56.570 This one also, you know, it reads I-Class. 01:35:56.570 --> 01:35:59.450 And it also reads SEOS. 01:35:59.450 --> 01:36:02.230 I have a SEOS card here. 01:36:02.230 --> 01:36:05.730 He's actually a Desfire card. 01:36:05.730 --> 01:36:06.530 Right. 01:36:06.530 --> 01:36:11.490 And here is a SEOS card here. 01:36:11.730 --> 01:36:16.050 For you who don't understand this , this is a very amazing reader. 01:36:17.470 --> 01:36:28.030 So, what we're going to do is show you how to take a secure credential that we don't know how to talk to and copy it to a weaker credential technology. 01:36:28.310 --> 01:36:31.850 So, we're going to start with, right now this is blank, so it does nothing. 01:36:31.850 --> 01:36:33.750 We'll set that right next to the reader. 01:36:34.130 --> 01:36:41.530 And by way of example, what we're going to do is we're going to grab we're going to start with, we're going to pick on Desfire . 01:36:41.530 --> 01:36:43.190 Actually, yeah. 01:36:43.550 --> 01:36:45.150 So, we have two cards here. 01:36:45.270 --> 01:36:48.570 We have Desfire Evolution 1 and an example of a SEOS card. 01:36:48.570 --> 01:36:50.150 There's nothing special about these cards. 01:36:50.150 --> 01:36:52.970 They were ordered through a regular supplier. 01:36:52.970 --> 01:36:55.210 This is a regular, you know, customer card. 01:36:56.090 --> 01:36:58.510 And they work with the system. 01:36:59.890 --> 01:37:01.450 So, that's one card. 01:37:01.530 --> 01:37:02.910 That's the other card. 01:37:02.950 --> 01:37:10.910 And so, if you are an attacker, you might think, okay, the first thing I'm going to do is I'm going to go to my Proxmark and I'm going to switch here. 01:37:10.910 --> 01:37:11.830 There we go. 01:37:11.830 --> 01:37:13.190 So, I'm going to go to my Proxmark. 01:37:13.190 --> 01:37:17.210 I'm going to type in hfsearch and oh, crap. 01:37:17.210 --> 01:37:21.530 It's, you know, some sort of oh, that's right. 01:37:21.530 --> 01:37:24.730 This is this card emulates multiple technologies. 01:37:24.850 --> 01:37:25.350 So, okay. 01:37:25.350 --> 01:37:32.290 This is a 14a card that rather, it's a Java card that uses 14a commands to communicate. 01:37:32.290 --> 01:37:35.030 Short version, we don't know how to talk to it. 01:37:35.490 --> 01:37:37.550 Here's a Desfire credential. 01:37:41.720 --> 01:37:43.360 There's a Desfire card. 01:37:43.520 --> 01:37:45.360 Again, we don't know the keys. 01:37:45.360 --> 01:37:48.900 We don't know how to read the data off of these cards. 01:37:48.900 --> 01:37:50.940 But the reader does, right? 01:37:50.940 --> 01:38:03.300 So, what I can do is I can take this reader, and remember, this special reader is showing me, because of this little add-on here, it's showing me the WeGand data that's on that reader. 01:38:03.300 --> 01:38:08.780 So, what I can do is I can say, take this CEOS card. 01:38:09.480 --> 01:38:16.340 I can read it, and I can see, oh, that WeGand data is 2547 E76. 01:38:18.400 --> 01:38:22.800 So, we're going to come back here to DopePad. 01:38:29.660 --> 01:38:31.780 So, I'm going to type it again. 01:38:31.780 --> 01:38:32.920 Pardon me. 01:38:33.520 --> 01:38:39.320 So, this is 2547 Echo 76. 01:38:42.780 --> 01:38:48.460 And I'm going to convert that to binary. 01:38:48.540 --> 01:38:49.040 Whoops . 01:38:50.820 --> 01:38:52.260 There we go. 01:38:56.450 --> 01:39:01.530 And let me just make sure that we have 26 bits. 01:39:01.530 --> 01:39:02.110 We do. 01:39:02.110 --> 01:39:02.810 Good. 01:39:02.890 --> 01:39:15.290 The next thing that I'm going to kind of gloss over here, those of you who are familiar with the Proxmark and know Prox, Prox credentials have a preamble that is necessary to use when programming it with the Proxmark. 01:39:15.290 --> 01:39:16.670 So, that's what I'm doing here. 01:39:16.670 --> 01:39:23.430 What I've done is I've just added this preamble that the Proxmark client requires in order to encode Prox credentials. 01:39:23.730 --> 01:39:30.230 And I'm going to take this string and I'm going to encode it back into hex. 01:39:30.230 --> 01:39:38.530 So, the hex value that we're going to write in our Proxmark client is this, this 2006547 Echo 76. 01:39:38.850 --> 01:40:02.810 So, now, we're going to pop back over to our Proxmark client, and we're going to take this low frequency T5577 and there we go, fit on camera there and we'll run LF HID clone and then this new value and then I'll double check my work to make sure it's there. 01:40:03.190 --> 01:40:04.990 Yep, that's there. 01:40:04.990 --> 01:40:10.610 So, if I did this correctly, now, these two cards should be the same. 01:40:10.610 --> 01:40:13.410 So, let's switch back to our BigView camera 01:40:17.550 --> 01:40:21.070 and I'm going to... I know you can't see the top of the reader, but that's okay. 01:40:21.070 --> 01:40:24.130 So, here's our original credential. 01:40:24.490 --> 01:40:27.710 There's our WGAN data, 2547 Echo 76. 01:40:27.710 --> 01:40:30.730 Let's go ahead and try our Prox card. 01:40:32.150 --> 01:40:36.070 Same data, 2547 Echo 76. 01:40:36.270 --> 01:40:39.190 This is the data that the door controller is seeing. 01:40:39.190 --> 01:40:52.390 So, what that means is that right now, as far as the door controller is concerned, this very, very secure and much more expensive credential is equivalent in security access in all things to this one. 01:40:52.390 --> 01:40:57.550 And it's only because this reader was left in transition mode. 01:40:57.550 --> 01:41:04.690 It was left in the mode that allows it to read other, more secure credential types that we do know how to talk to. 01:41:04.690 --> 01:41:17.330 So, even when we're dealing with secure credentials, as it relates to access control, sometimes we can find other ways of re-encoding that credential data onto something else and making it work with the reader. 01:41:18.810 --> 01:41:24.330 So, same demo, super fast, with DESFire. 01:41:24.330 --> 01:41:26.170 So, here is... 01:41:26.170 --> 01:41:28.450 here's our DESFire credential. 01:41:28.970 --> 01:41:31.370 This has different WGAN data. 01:41:31.370 --> 01:41:35.490 This one is 1 Bravo 5 Delta Bravo 6 Delta. 01:41:35.650 --> 01:41:40.030 And we're going to switch back to our notepad here. 01:41:41.450 --> 01:41:44.370 And we're going to run through this super quick. 01:41:44.430 --> 01:41:46.570 So, we'll just delete all this. 01:41:46.570 --> 01:41:48.090 So, now we're going to do this credential. 01:41:48.090 --> 01:41:55.870 We're going to do 1 Bravo 5 Delta Bravo 6 Delta. 01:41:56.990 --> 01:41:59.170 And we're going to copy that. 01:41:59.430 --> 01:42:03.650 We're going to convert that to WGAN. 01:42:05.250 --> 01:42:09.190 And it looks like it dropped a leading zero, so we're going to add that back in. 01:42:09.190 --> 01:42:11.230 I only saw 25 bits. 01:42:12.030 --> 01:42:19.570 And we're also going to add our prox preamble here. 01:42:20.710 --> 01:42:25.410 And then we're going to convert that back to weekend. 01:42:25.730 --> 01:42:30.050 Sorry, back to the format that the proxmark3 is going to expect. 01:42:30.590 --> 01:42:33.750 And, again, we're going to do the same thing. 01:42:33.750 --> 01:42:47.680 We're going to take our proxmark, run lf.hid.clone and then this value. 01:42:47.680 --> 01:42:49.540 Make sure it wrote. 01:42:49.820 --> 01:42:50.960 Looks good. 01:42:50.960 --> 01:42:52.240 Let's try it. 01:42:53.780 --> 01:42:56.280 So, switching back here. 01:42:57.900 --> 01:43:00.480 Here's our DESFire credential. 01:43:00.520 --> 01:43:04.780 We have 1 Bravo 5 Delta Bravo 6 Delta access granted. 01:43:04.780 --> 01:43:06.460 Here's our prox credential. 01:43:07.120 --> 01:43:08.540 Same credential. 01:43:08.540 --> 01:43:10.900 1 Bravo 5 Delta Bravo 6 Delta. 01:43:10.900 --> 01:43:15.180 So, again, two different examples, different card technologies completely, right? 01:43:15.180 --> 01:43:16.660 We did not crack DESFire. 01:43:16.660 --> 01:43:18.240 We did not crack CEOS. 01:43:18.240 --> 01:43:26.520 What we did is we took advantage of a configuration in the system that was not changed after the transition or the migration was complete. 01:43:26.520 --> 01:43:30.260 So, that's the entire concept behind a technology downgrade attack. 01:43:30.260 --> 01:43:42.720 It's something that not everyone really thinks about very often and it's crucial to be aware of as customers, as integrators, as installers in defending the system because it really undermines the security of the system otherwise. 01:43:43.760 --> 01:43:44.780 All right. 01:43:44.960 --> 01:43:47.280 So, now we're going to move on to... 01:43:52.440 --> 01:43:53.480 Let's do... 01:43:53.480 --> 01:43:56.740 Let me just show config cards, actually, because it's related. 01:43:56.760 --> 01:43:57.620 So, let's say... 01:43:57.620 --> 01:44:00.120 Let's say, like, okay, well, you know what? 01:44:00.120 --> 01:44:02.380 We disabled those old credentials. 01:44:02.380 --> 01:44:03.380 So, we're fine. 01:44:03.380 --> 01:44:04.640 So, we're secure, right? 01:44:04.640 --> 01:44:08.620 So, actually, I'm going to take this reader off. 01:44:08.820 --> 01:44:10.520 I have a different reader. 01:44:13.760 --> 01:44:16.440 And I pre-baked a cake already. 01:44:16.440 --> 01:44:17.920 Yes, correct. 01:44:27.720 --> 01:44:29.000 All right. 01:44:29.220 --> 01:44:31.740 So , here we have a different reader . 01:44:31.740 --> 01:44:35.120 And right off the bat, what we're going to notice is it says multi-class. 01:44:35.120 --> 01:44:39.780 It says that it's a migration or a transition reader, but it doesn't read prox. 01:44:40.480 --> 01:44:45.640 It doesn't read, if I present it, a regular iClass card . 01:44:45.640 --> 01:44:46.580 Let's see here. 01:44:46.580 --> 01:44:47.320 I forgot. 01:44:47.320 --> 01:44:49.240 So , here's my regular iClass card. 01:44:49.240 --> 01:44:51.080 It doesn't read that either. 01:44:51.080 --> 01:44:55.660 It will, however, read CEOS. 01:44:56.040 --> 01:44:56.560 Okay ? 01:44:56.560 --> 01:44:58.080 So, right now , we're like, great. 01:44:58.080 --> 01:44:59.780 This is a secure reader , right? 01:44:59.780 --> 01:45:00.800 We're set. 01:45:00.800 --> 01:45:05.220 However, remember, configuration cards can change the behavior of the reader. 01:45:05.220 --> 01:45:19.860 So, now we have a reader that only supports CEOS, but what we can do is we can use a different configuration card to re-enable those legacy credentials. 01:45:19.860 --> 01:45:21.700 So, I'm going to power cycle the reader. 01:45:23.340 --> 01:45:27.600 I'm going to present the configuration card to re-enable legacy credentials. 01:45:28.260 --> 01:45:32.140 It's going to take a couple of seconds as it reads that data off the card. 01:45:32.340 --> 01:45:34.660 And these are standard parts, to be clear. 01:45:34.660 --> 01:45:36.200 This is not an exploit. 01:45:36.260 --> 01:45:40.960 This is using design-intended functionality that is available to any customer, right? 01:45:40.960 --> 01:45:45.280 So, these are cards that can be ordered by customers, by integrators. 01:45:45.540 --> 01:45:51.900 And now, if that card worked correctly, what we're going to see is there's my PROX, right? 01:45:52.040 --> 01:45:53.680 There's my iClass. 01:45:53.680 --> 01:45:54.960 It all comes back. 01:45:55.500 --> 01:45:59.040 So, that is something to be mindful of. 01:45:59.040 --> 01:46:08.580 Being able to take the reader off the wall and power cycle it, if you're not monitoring for that, that can be a huge gap in the system's security. 01:46:08.580 --> 01:46:15.480 Because older, more secure credential technologies might be re-enabled in the reader. 01:46:15.480 --> 01:46:27.980 And then, someone can just take one of those readers that can read your secure credentials and then convert that weekend data to work off of a card that you can easily read and write with a PROXmark or any other tool. 01:46:28.900 --> 01:46:33.040 So, that attack, again, is... 01:46:33.040 --> 01:46:35.140 I don't consider it an exploit. 01:46:35.140 --> 01:46:41.220 I consider it taking advantage of misconfiguration, taking advantage of how the system was designed. 01:46:41.220 --> 01:46:44.840 In fact, this issue is not unique to HID. 01:46:45.660 --> 01:46:49.140 Multiple brands, many brands, have this problem. 01:46:49.140 --> 01:46:53.260 So, what I have here is... 01:46:53.260 --> 01:46:56.220 And I'm not going to do a full demo on this other one. 01:46:56.840 --> 01:46:58.500 I'm just going to move our camera. 01:47:01.580 --> 01:47:02.420 So, we have... 01:47:02.420 --> 01:47:03.740 Oh, there we go. 01:47:03.740 --> 01:47:04.840 It's a little jittery. 01:47:04.840 --> 01:47:05.760 My apologies. 01:47:05.900 --> 01:47:07.880 So, we have a different branded reader. 01:47:07.880 --> 01:47:09.420 This is just an example. 01:47:09.420 --> 01:47:11.160 Again, I want to be clear. 01:47:11.160 --> 01:47:12.880 We're not picking on any one brand . 01:47:12.880 --> 01:47:16.280 This is just something to be aware of as far as systems can be designed. 01:47:16.440 --> 01:47:30.300 So , right now, this card reader will read and beep on both high frequency contactless smart cards and low frequency cards. 01:47:30.300 --> 01:47:34.740 So, it's reading both this Mindfair card and this Prox card. 01:47:35.590 --> 01:47:37.160 So, there we go. 01:47:38.860 --> 01:47:40.600 I can't fit everything. 01:47:40.600 --> 01:47:41.460 Hold on. 01:47:42.620 --> 01:47:44.260 Yeah, you can do it. 01:47:44.860 --> 01:47:46.340 There we go. 01:47:46.840 --> 01:47:57.980 So, again, I can power cycle the reader and I can use a different configuration card to disable proximity. 01:47:57.980 --> 01:48:08.480 Now, when that reader reboots, it reads Mindfair as expected, and that's fine, but it's not going to read this Prox card. 01:48:09.420 --> 01:48:12.900 So, let's say a customer has that in a secure configuration. 01:48:12.900 --> 01:48:24.960 Again, if you're not monitoring your tamper sensors, someone can come back and re-enable proximity, and now they're able to use Prox credentials again. 01:48:24.960 --> 01:48:35.880 So, monitoring those tamper sensors on the back of the reader is very, very important, because it's the only way to defend against knowing when these types of manipulations take place. 01:48:36.560 --> 01:48:38.080 Yep, very true. 01:48:38.080 --> 01:48:39.940 Alright, our next demo. 01:48:39.940 --> 01:48:41.520 So many demos, all the demos. 01:48:41.520 --> 01:48:43.440 Okay, we have 15 minutes. 01:48:43.440 --> 01:48:44.360 Holy crap. 01:48:44.360 --> 01:48:45.860 This is going to be interesting. 01:48:45.860 --> 01:48:51.140 Alright, let me grab the camera again. 01:48:51.140 --> 01:48:53.500 It's going to be the best 15 minutes ever. 01:48:53.500 --> 01:48:54.600 Yep. 01:48:58.930 --> 01:49:01.170 In the RFID hacking. 01:49:01.290 --> 01:49:07.330 Alright, so we have our different readers already set up. 01:49:07.870 --> 01:49:21.190 So we have our stand-alone reader mode, our stand-alone full simulator mode, our stand-alone low-class attack mode, and our stand-alone config card mode. 01:49:22.470 --> 01:49:25.390 Iceman, we're not going to be able to finish all of our demos. 01:49:25.390 --> 01:49:28.230 No, yes, take the config card first. 01:49:28.230 --> 01:49:30.230 You wanted the config card one first, okay. 01:49:30.230 --> 01:49:31.190 Yeah, yeah, yeah. 01:49:31.190 --> 01:49:33.490 Okay, so you have... 01:49:34.530 --> 01:49:35.670 That's a cool one. 01:49:35.670 --> 01:49:37.210 I mean... 01:49:38.810 --> 01:49:41.730 The rest is what we could do with a client before. 01:49:41.730 --> 01:49:45.130 Alright, so I'm just going to explain what's happening. 01:49:45.130 --> 01:49:47.070 Put some of these aside. 01:49:47.490 --> 01:49:49.430 And we're going to power these readers on. 01:49:51.720 --> 01:49:52.560 Alright. 01:49:52.560 --> 01:49:54.360 So this is a fun attack. 01:49:55.240 --> 01:50:01.320 The reason this is a fun attack is because this is a very interesting model of service attack. 01:50:01.320 --> 01:50:05.640 So right now, we have two I-class readers. 01:50:05.640 --> 01:50:08.340 These are older legacy readers. 01:50:08.340 --> 01:50:10.500 These are not modern readers. 01:50:10.500 --> 01:50:12.080 These are revision C. 01:50:12.080 --> 01:50:14.600 So anything produced before 2012. 01:50:14.600 --> 01:50:18.000 And it reads standard I-class cards. 01:50:18.000 --> 01:50:20.020 So users can use that normally. 01:50:20.500 --> 01:50:25.960 What we're going to do is we're going to do an attack where we're going to glitch one reader. 01:50:26.040 --> 01:50:29.900 We're going to automatically reboot it using the glitch. 01:50:29.900 --> 01:50:35.580 And then use the configuration card to put the reader in something called key rolling mode. 01:50:35.580 --> 01:50:41.280 Key rolling mode is supposed to help you transition from a standard key to a high security key. 01:50:41.680 --> 01:50:48.480 And when you do that, the reader talks to both old cards, and then if it finds an old key, it updates it to the new one. 01:50:49.260 --> 01:50:57.260 The issue is, if all the readers aren't in that mode, then the key on the card gets changed to one of the second reader that doesn't necessarily understand. 01:50:57.420 --> 01:51:01.160 So what I'm going to do is I'm going to present my proxmark. 01:51:01.420 --> 01:51:03.000 It's going to glitch the reader. 01:51:03.440 --> 01:51:04.220 Oh, I have to. 01:51:04.220 --> 01:51:04.620 Hold on. 01:51:04.620 --> 01:51:06.040 I have to put it in the standard mode. 01:51:06.380 --> 01:51:07.420 There we go. 01:51:08.240 --> 01:51:09.700 So I'm going to present this here. 01:51:09.720 --> 01:51:11.320 It's going to glitch the reader. 01:51:11.320 --> 01:51:12.620 The reader is going to reboot. 01:51:12.620 --> 01:51:13.900 There's the first reboot. 01:51:13.900 --> 01:51:18.080 Now the proxmark is going to emulate a key roll configuration card. 01:51:18.140 --> 01:51:19.600 That's complete. 01:51:19.880 --> 01:51:22.860 And here's... let's pretend this is the exterior door. 01:51:22.860 --> 01:51:24.740 This is the door on the inside. 01:51:24.740 --> 01:51:27.640 So here's the same card. 01:51:28.060 --> 01:51:30.060 It works on the first reader. 01:51:30.060 --> 01:51:34.680 And now at this point, the key in this card has been changed. 01:51:35.140 --> 01:51:37.780 And it will not work on the second reader. 01:51:37.780 --> 01:51:40.000 It will only work on that first reader. 01:51:43.240 --> 01:51:45.160 It's such a meme . 01:51:46.860 --> 01:51:47.820 Alright . 01:51:48.000 --> 01:51:51.500 What's the next stupid thing that we can move to here? 01:51:52.420 --> 01:51:54.080 So yeah , full simulation. 01:51:54.080 --> 01:51:58.120 We're not going to go into it right now because we are so gosh darn short on time. 01:51:58.120 --> 01:51:59.040 Low class . 01:51:59.040 --> 01:51:59.980 Low class. 01:52:00.480 --> 01:52:01.300 Yeah, yeah, yeah. 01:52:01.300 --> 01:52:04.800 So actually we have an elite reader . 01:52:10.810 --> 01:52:16.350 Actually, I'm realizing that the camera doesn't like to be far away from the computer. 01:52:16.350 --> 01:52:20.750 So I'm just going to move this all really, really close. 01:52:21.070 --> 01:52:22.170 There we go. 01:52:22.170 --> 01:52:23.390 Much better. 01:52:23.630 --> 01:52:28.330 So this is an example of an elite reader. 01:52:31.210 --> 01:52:40.310 And as it stands right now, it does not read standard I-class cards. 01:52:40.310 --> 01:52:42.690 So here's an example of a standard I-class card. 01:52:42.690 --> 01:52:47.010 It won't read because it's not using the high security key. 01:52:47.010 --> 01:52:51.490 Here's an elite key designed for that system that reads. 01:52:53.290 --> 01:52:58.590 What we're going to do is switch here so we can see the debug data. 01:53:00.790 --> 01:53:05.390 And we're going to hold down our button to enter standalone mode. 01:53:05.770 --> 01:53:09.650 And so right now, all I have to do is just wave this over the reader. 01:53:10.370 --> 01:53:11.610 And that's it. 01:53:11.610 --> 01:53:15.790 So now it's saved that Mac attack file. 01:53:16.390 --> 01:53:18.510 And I can grab that. 01:53:34.650 --> 01:53:36.650 What did I do wrong? 01:53:37.590 --> 01:53:39.810 There sure is. 01:53:43.170 --> 01:53:44.090 Alright. 01:53:44.090 --> 01:53:47.070 And now we just operate the low class attack normally. 01:53:47.070 --> 01:53:52.110 So we'll do HFI class, low class, and then the file name. 01:53:54.920 --> 01:53:57.120 Oh, you're running that version. 01:53:57.140 --> 01:53:58.860 I'm running FPGA, yes. 01:54:02.110 --> 01:54:04.090 So it's not going to take very long. 01:54:04.090 --> 01:54:06.370 It's only going to take us about 30 seconds or so. 01:54:06.370 --> 01:54:08.130 And that's going to crack the key. 01:54:08.130 --> 01:54:11.970 So now we have the high security key that was in that reader. 01:54:12.030 --> 01:54:22.030 And now if I wanted to, I could take this elite card that worked on that and I can do HFI class dump. 01:54:23.330 --> 01:54:26.370 Specify the elite key without spaces. 01:54:29.400 --> 01:54:31.380 Make sure to tell it it's elite. 01:54:32.160 --> 01:54:34.280 And there is our data for the card. 01:54:37.420 --> 01:54:40.460 So, that's your standalone low class attack. 01:54:41.160 --> 01:54:41.880 Yeah. 01:54:41.880 --> 01:54:46.260 With a battery, just walk around with it and collect from different readers. 01:54:46.380 --> 01:54:48.060 What can we fit in 10 minutes? 01:54:48.940 --> 01:54:53.440 We did an out of service, we did a check downgrade, we did key recovery. 01:54:53.780 --> 01:54:57.780 Should we show the special door controller zero day that was sent to us? 01:54:57.920 --> 01:54:58.620 Yes! 01:55:00.180 --> 01:55:01.520 It's really cool. 01:55:01.520 --> 01:55:06.220 So first of all, I want to make sure the link gets out there. 01:55:06.680 --> 01:55:18.740 This repository contains an unpatched vulnerability in a semi -common, not super common, semi-common single door controller. 01:55:19.580 --> 01:55:21.480 And I'm going to show you how that works. 01:55:21.480 --> 01:55:25.880 So this exploit has been reported to the vendor that was about nine months ago. 01:55:25.880 --> 01:55:31.660 And then the person who discovered the exploit reached out and said, hey, I'm kind of done with this. 01:55:31.660 --> 01:55:35.260 I want it to be public, but I don't really feel like doing a talk. 01:55:35.260 --> 01:55:37.280 Which is totally fine and reasonable. 01:55:37.280 --> 01:55:45.690 So, we got their demo board, their demo kit here to show you, to show everyone how this works. 01:55:45.930 --> 01:55:53.570 What's important to mention here is I'm really big on not picking on individual vendors because this is an industry problem. 01:55:53.570 --> 01:55:59.310 The type and category of exploit that you're going to see on this demo is common, actually. 01:55:59.310 --> 01:56:01.190 It's not unique to this situation. 01:56:01.190 --> 01:56:11.710 I've seen variations of this, both published and unpublished, for at least five or six different vendors of door controllers, of software. 01:56:11.710 --> 01:56:18.670 And you're just going to see what can happen when these systems aren't properly protected and patched. 01:56:18.750 --> 01:56:26.390 So, let's go ahead and again switch all this stuff out of the way. 01:56:31.310 --> 01:56:34.690 We'll see if the camera can keep up. 01:56:34.750 --> 01:56:36.790 I don't know if it will. 01:56:42.870 --> 01:56:45.170 It's really, really jittery. 01:56:45.170 --> 01:56:46.950 My apologies to folks. 01:56:46.950 --> 01:56:55.370 Well, we've got less than ten minutes, so they get jitter and hoard nothing. 01:57:14.950 --> 01:57:19.570 Before we end up, some questions about the Q&A. 01:57:19.770 --> 01:57:27.810 Did you get something from Wireless Village, the Ricks of Wasabi, about where Q&A is possible to do? 01:57:27.810 --> 01:57:28.730 Was that in Discord? 01:57:28.730 --> 01:57:31.110 No, but we can do it in our Discord. 01:57:31.110 --> 01:57:31.990 I don't know. 01:57:32.010 --> 01:57:33.550 Yeah, we can do Discord, yeah. 01:57:37.210 --> 01:57:39.090 Alright, I will do that soon. 01:57:39.090 --> 01:57:44.290 I can let you guys know if you see that I'm not paying attention. 01:57:44.870 --> 01:57:55.170 Alright, so what we're looking at here is two Proxcard readers connected to a single door controller, and here's our user Alice. 01:57:55.410 --> 01:58:03.850 And Alice can badge in, and this green LED represents the door strike. 01:58:05.550 --> 01:58:08.530 I'm realizing that people can't see me, but that's okay. 01:58:08.530 --> 01:58:11.070 So this green LED here represents the door strike. 01:58:11.070 --> 01:58:12.310 So here we go. 01:58:12.350 --> 01:58:13.450 That's fine. 01:58:13.450 --> 01:58:16.330 And in fact, our log... 01:58:16.330 --> 01:58:19.150 This is so tricky. 01:58:19.150 --> 01:58:20.110 My apologies. 01:58:20.350 --> 01:58:21.290 So our log... 01:58:22.350 --> 01:58:25.310 I'm just going to explain what's happening, because we're tight on time. 01:58:25.310 --> 01:58:28.210 I realize the camera won't be able to show the screen, unfortunately. 01:58:28.210 --> 01:58:30.470 So my sincere apologies to folks there. 01:58:30.570 --> 01:58:35.010 But some mics say Alice can get in, Alice can get out. 01:58:35.630 --> 01:58:40.850 Bob wasn't doing so great on their employee performance, so they've been fired. 01:58:41.050 --> 01:58:43.010 Their badge no longer works. 01:58:45.390 --> 01:58:56.130 Mallory, our malicious attacker, is really interested in what App Incorporation is working on, but unfortunately they can't get in either. 01:58:56.890 --> 01:59:01.670 So what we're going to do is we're going to plug in this exploit stick. 01:59:03.710 --> 01:59:08.070 And this is actually just a unified cloud key that's been repurposed. 01:59:08.070 --> 01:59:10.770 It's just a little Debian box with a POE port on it. 01:59:10.770 --> 01:59:14.630 It's been repurposed to execute a very fun exploit. 01:59:14.630 --> 01:59:20.810 So this is going to do an ArcCache poisoning attack automatically when it boots up. 01:59:20.810 --> 01:59:24.390 It's going to look for this type of door controller. 01:59:24.650 --> 01:59:26.990 It's going to poison the ArcCache. 01:59:26.990 --> 01:59:30.770 It's going to force the door controller to connect to it. 01:59:31.370 --> 01:59:40.750 And then this will then connect to the system monitoring software, which is actually here in the background. 01:59:40.750 --> 01:59:51.430 Unfortunately, I don't have a great setup to show the data that's happening on this laptop here, so my sincere apologies there as well. 01:59:52.490 --> 01:59:56.230 But we're just going to wait another 10 or 15 more seconds. 01:59:56.250 --> 02:00:00.750 And what I'm waiting for is a light here to start flashing. 02:00:00.870 --> 02:00:09.310 So during this time, what will happen in the log is in the event log, I'm going to try. 02:00:09.310 --> 02:00:12.070 I know I said it's not going to work well, but we're going to try. 02:00:12.670 --> 02:00:19.630 Alright, so in the event log, we're going to see that the door controller briefly went offline and then came back online. 02:00:19.830 --> 02:00:22.630 And that was the attack tool running. 02:00:23.710 --> 02:00:28.310 Temporarily taking the door controller offline and then bringing it back online. 02:00:28.990 --> 02:00:31.330 So here we can see the light flashing. 02:00:31.610 --> 02:00:35.770 There's only one flash, which tells us it only found one door controller to take over. 02:00:35.770 --> 02:00:38.630 And everything continues working normally. 02:00:38.630 --> 02:00:41.650 So the door controller still has credentials cached. 02:00:41.650 --> 02:00:44.950 Alice can still get in normally. 02:00:45.930 --> 02:00:47.810 Bob is still fired. 02:00:47.810 --> 02:00:50.070 Bob, they can't get in. 02:00:50.070 --> 02:00:54.970 But something interesting happens now when Mallory scans their credential. 02:00:54.970 --> 02:01:04.450 When Mallory scans their credential, that invalid access attempt is going to go out over the network to this exploit device. 02:01:04.710 --> 02:01:14.350 It's going to see that it's Mallory's card, and it's going to manually tell that door controller to unlock the door for several seconds. 02:01:14.390 --> 02:01:21.930 In the meantime, it is not going to forward Mallory's attempt to get in to the system software, to the server. 02:01:21.930 --> 02:01:26.570 So there will be no log entry of any kind for any of Mallory's attempts. 02:01:26.570 --> 02:01:28.530 So here is Mallory's card. 02:01:29.710 --> 02:01:33.170 And they have access down here to the door strike. 02:01:34.210 --> 02:01:36.750 And, of course, they can get out as well. 02:01:39.650 --> 02:01:44.250 And, again, remember, Alice's credential still works. 02:01:44.970 --> 02:01:57.890 And what we'll notice is that the only log information that we see here is related to the real system credentials, that the exploit tool is not filtering out. 02:01:58.130 --> 02:02:00.910 It's just the Alice and Bob credentials. 02:02:00.910 --> 02:02:06.370 So it is actively filtering everything related to Mallory. 02:02:07.170 --> 02:02:11.770 And you might be curious, well, what happens when you unplug this? 02:02:11.770 --> 02:02:20.070 After a few minutes, the door controller reconnects back to the original server, and everything continues working as expected. 02:02:20.070 --> 02:02:27.390 So this is this specific exploit is in that GitHub link that we mentioned here. 02:02:27.710 --> 02:02:28.910 If you're interested in it... 02:02:29.790 --> 02:02:38.370 We got lenient, so we have... it's not a hard stop, so we can make a nice exit. 02:02:38.470 --> 02:02:40.170 Good enough. 02:02:41.410 --> 02:02:47.390 So, if you want to read more about it, the code is published here in this GitHub repository. 02:02:48.470 --> 02:02:51.410 It's something that I really want to stress. 02:02:51.910 --> 02:02:55.030 This category of exploit is not unique to this vendor. 02:02:55.030 --> 02:03:08.250 It's something that we've seen time and time again over the years, but it's such a great, beautiful example of what happens when we treat network-enabled devices as if they're not network-enabled devices. 02:03:08.970 --> 02:03:14.970 So, definitely, if you are in this section here, I'm going to talk about mitigations. 02:03:14.970 --> 02:03:16.790 So , we'll just... yeah, there we go. 02:03:16.790 --> 02:03:19.570 So, overall defenses and mitigations. 02:03:19.710 --> 02:03:31.270 I see I didn't add here my biggest mitigation for door controllers, which is assume that your door controller is super insecure, and that if anyone is able to talk to it, they're able to compromise it. 02:03:31.270 --> 02:03:44.530 That may not actually be the case, but if you assume that when you're designing the system, whether you're a customer or you're an integrator, that will minimize the risk related to these types of exploits, these types of attacks. 02:03:44.630 --> 02:03:59.070 If you want to prevent credential interception by things like the ESP key or the BLE key, what you want to use is OSDP version 2 with secure channel to encrypt the communications between the reader and the door controller. 02:03:59.290 --> 02:04:04.730 If you want to resist cloning, you want to use secure credential with secure objects. 02:04:04.730 --> 02:04:21.570 We don't have time to get into it, but short description, secure objects are basically ways of cryptographically encrypting and signing that PACS payload and tying it to the serial number of that card, which makes it harder to duplicate or compromise later. 02:04:22.190 --> 02:04:31.350 If you want to resist tech downgrade attacks, if you want to just know if people are messing with your readers, those tamper switches are super important to monitor. 02:04:31.630 --> 02:04:36.930 There are a couple of different solutions that you can employ to actually stop attacks cold when they happen. 02:04:36.930 --> 02:04:53.590 If you have good tamper switches, and not all of them are, some access control software packages will allow you to configure an action that takes place where if a reader is tampered, then that door gets shut off until someone goes out and inspects the reader. 02:04:53.590 --> 02:05:04.740 There is also an additional product that was released sometime last year called the spider blocker. 02:05:04.740 --> 02:05:09.720 Super weird name, but interesting tool all the same. 02:05:10.120 --> 02:05:13.140 I don't recommend this for most people, if I'm being frank. 02:05:13.140 --> 02:05:15.520 So the spider blocker is an add-on board. 02:05:15.520 --> 02:05:26.520 You need one per reader, and it lives next to your door controller, and it is a man in the middle between the reader and the door controller that monitors the tamper line. 02:05:26.520 --> 02:05:31.120 And if tamper is detected, it physically disconnects the reader from the system. 02:05:31.120 --> 02:05:36.940 And then someone has to walk back into the wiring closet and press this red reset button. 02:05:36.940 --> 02:05:44.520 It's an interesting thought, and for some applications, it might be useful, but it is probably not really great for wide scale deployment. 02:05:44.520 --> 02:06:01.800 If you're really worried about people messing with your readers, the biggest things that you can do are having a good tamper monitoring solution, having a good plan of action for what happens if a tamper gets triggered , and depending on the vendor, if you are able to use custom keys, 02:06:01.800 --> 02:06:09.680 custom encryption keys for your credentials and readers, in many cases , that can offer an additional layer of protection. 02:06:09.840 --> 02:06:19.940 Specifically , with multiple vendors, if you are using custom keys, HID calls them elite, other vendors might call them different terminology. 02:06:19.940 --> 02:06:37.740 If you are using custom keys, then those configuration cards that we talked about also have to have those custom keys loaded, which is much harder to do, because there is a special restricted ordering process for ordering readers and credentials with custom keying data. 02:06:38.200 --> 02:06:51.020 So the only reason that this worked is because our reader was using a standard global key, and we were using a standard global configuration card that was available to all integrators and all customers. 02:06:52.460 --> 02:06:55.580 So, yeah, there are a couple of things to do there as well. 02:06:56.120 --> 02:06:58.520 Now, I don't know if we have any time left. 02:06:58.540 --> 02:07:02.220 Iceman, how much flexibility did they give us for Q &A? 02:07:02.760 --> 02:07:05.560 They made a very small one. 02:07:05.560 --> 02:07:06.020 Very small . 02:07:06.580 --> 02:07:12.400 I said that we are going to have a Q&A over at Wireless Village RFID channel. 02:07:12.400 --> 02:07:14.880 And how do people get there if they want to do that? 02:07:15.000 --> 02:07:18.340 I sent you a link, so I thought you could post it there. 02:07:18.340 --> 02:07:21.780 I posted on Twitter and I posted on Discord. 02:07:22.840 --> 02:07:23.520 Sure, sure. 02:07:23.520 --> 02:07:24.140 Give me a second. 02:07:24.140 --> 02:07:25.200 Let me grab that. 02:07:25.300 --> 02:07:31.800 Feel free to follow both me and Babak on Twitter, and shout out to YouTubes and all that stuff. 02:07:33.220 --> 02:07:40.680 So, give me one moment here, and I will add this link so everyone has it. 02:07:41.200 --> 02:07:41.640 Yeah. 02:07:44.180 --> 02:07:45.840 We have a text channel there. 02:07:45.840 --> 02:07:49.420 If you want to have a video channel, we can make it as well also later on. 02:07:49.820 --> 02:07:54.840 But the Wireless Village people, we are going to make a little talk now as well, so we don't want to. 02:07:54.840 --> 02:07:56.240 Of course, absolutely. 02:07:56.960 --> 02:07:58.300 Wade's talk is soon also. 02:07:58.600 --> 02:08:03.840 This link here, this Discord channel, we will be doing a little bit of Q&A for a few minutes. 02:08:03.840 --> 02:08:08.240 And if you have any questions, reach out, email us. 02:08:08.660 --> 02:08:11.200 We are happy to point you in the right direction. 02:08:11.200 --> 02:08:17.760 If you are a pen tester and you are interested in training, this is the point where I just plug for 10 seconds. 02:08:17.760 --> 02:08:19.460 Go to redteamalliance.com. 02:08:19.460 --> 02:08:29.780 Iceman and I have a new 5-day hands-on training where we are going to work hands-on with everything from door controllers to weaponized readers to some more advanced techniques for manipulating credentials. 02:08:29.780 --> 02:08:32.560 That's going to be coming out in end of September. 02:08:32.560 --> 02:08:34.560 So we have dates announced for it. 02:08:34.620 --> 02:08:36.540 And it is a hands-on course. 02:08:36.540 --> 02:08:40.660 So every student will receive hardware like the reader that you saw here. 02:08:40.960 --> 02:08:45.220 And test credentials and tools to weaponize things. 02:08:45.400 --> 02:08:48.540 So if you are curious about that, you can ask us about that as well. 02:08:48.540 --> 02:08:49.800 So that's it. 02:08:49.800 --> 02:08:55.540 Thank you everyone so much for being so patient with our first DEF CON livestream attempt. 02:08:55.700 --> 02:09:01.660 And for the back and forth that we had with the slides, all things considered, it went better than I expected somehow. 02:09:02.360 --> 02:09:03.880 So, thank you again. 02:09:03.880 --> 02:09:05.320 Hope you guys enjoyed it. 02:09:05.760 --> 02:09:07.260 Yes, yes one shipping. 02:09:07.260 --> 02:09:08.100 Thank you so much. 02:09:08.100 --> 02:09:09.600 It's been a delight. 02:09:09.600 --> 02:09:12.920 Pleasure as always to talk with you, Babak, and meet all you guys. 02:09:12.920 --> 02:09:17.440 And I'm looking forward to have you over at the Q&A and have some chats with you there. 02:09:17.960 --> 02:09:18.720 Stay cool.