1
00:00:00,060 --> 00:00:00,893
- All right aloha

2
00:00:00,893 --> 00:00:03,870
and welcome to our talk
on uncovering stolen

3
00:00:03,870 --> 00:00:06,090
algorithms in commercial products.

4
00:00:06,090 --> 00:00:06,923
I'm Patrick Wardle,

5
00:00:06,923 --> 00:00:09,240
I am the founder of the
Objective-C Foundation.

6
00:00:09,240 --> 00:00:12,000
And today I'm stoked to be
co-presenting with good friend,

7
00:00:12,000 --> 00:00:13,530
former colleague Tom McGuire,

8
00:00:13,530 --> 00:00:16,773
who is an instructor at the
Johns Hopkins university.

9
00:00:17,940 --> 00:00:20,760
So today we're gonna talk about
what I believe is a systemic

10
00:00:20,760 --> 00:00:22,200
issue affecting the community.

11
00:00:22,200 --> 00:00:25,530
And that's the unauthorized
use of stolen algorithms

12
00:00:25,530 --> 00:00:27,660
in widespread commercial products.

13
00:00:27,660 --> 00:00:29,640
Figured if it could happen to
us, could happen to others,

14
00:00:29,640 --> 00:00:30,903
maybe even happen to you.

15
00:00:31,890 --> 00:00:33,660
So here we'll first introduce,

16
00:00:33,660 --> 00:00:35,723
we'll talk about the victim application,

17
00:00:35,723 --> 00:00:39,300
and then we'll talk about how
we were able to find and prove

18
00:00:39,300 --> 00:00:40,770
that other commercial products

19
00:00:40,770 --> 00:00:43,710
were using its closed source algorithms,

20
00:00:43,710 --> 00:00:44,543
and then how we were able

21
00:00:44,543 --> 00:00:46,773
to ultimately resolve this situation.

22
00:00:48,180 --> 00:00:50,670
So, first let's talk about
OverSight, the victim,

23
00:00:50,670 --> 00:00:53,880
who I mentioned its closed
source algorithms were stolen by

24
00:00:53,880 --> 00:00:57,348
at least three separate
unrelated commercial entities

25
00:00:57,348 --> 00:01:00,060
for profits and gains.

26
00:01:00,060 --> 00:01:02,137
So in this part of the talk,

27
00:01:02,137 --> 00:01:04,590
I want to discuss OverSight
specifically its internals

28
00:01:04,590 --> 00:01:05,610
and its algorithms,

29
00:01:05,610 --> 00:01:08,610
as this is important to
understand this is relevant,

30
00:01:08,610 --> 00:01:11,100
when we dive into showing
the fact that this code

31
00:01:11,100 --> 00:01:12,200
was ultimately stolen.

32
00:01:13,800 --> 00:01:15,570
Now, OverSight is a
pretty straightforward,

33
00:01:15,570 --> 00:01:18,930
pretty simple utility
written by yours truly.

34
00:01:18,930 --> 00:01:20,880
It was released in 2016

35
00:01:20,880 --> 00:01:23,430
initially as a closed sourced application.

36
00:01:23,430 --> 00:01:25,410
So that's important because
we'll see the infringement

37
00:01:25,410 --> 00:01:27,960
occurred when corporations
actually reverse engineered

38
00:01:27,960 --> 00:01:31,200
the binary and re-implemented
the algorithms.

39
00:01:31,200 --> 00:01:32,670
Its goal is pretty simple.

40
00:01:32,670 --> 00:01:35,010
Just seeks to alert you anytime,

41
00:01:35,010 --> 00:01:38,490
anything accesses your mic or your webcam,

42
00:01:38,490 --> 00:01:40,860
and also identify what process

43
00:01:40,860 --> 00:01:43,080
is responsible for this action.

44
00:01:43,080 --> 00:01:44,790
This was kind of the killer feature,

45
00:01:44,790 --> 00:01:48,090
no other tools at the time
had the ability to identify

46
00:01:48,090 --> 00:01:50,100
the active or responsible process

47
00:01:50,100 --> 00:01:52,293
that was accessing the mic or webcam.

48
00:01:53,610 --> 00:01:56,130
Now OverSight was designed
predominantly to detect

49
00:01:56,130 --> 00:01:58,380
stealthy malware that
got onto your system,

50
00:01:58,380 --> 00:02:03,380
perhaps via a zero-day or some
other infection mechanism.

51
00:02:03,390 --> 00:02:07,080
And, when that malware would
attempt to access the mic

52
00:02:07,080 --> 00:02:11,040
or the webcam that gave OverSight
the ability to detect it

53
00:02:11,040 --> 00:02:12,659
and throw up an alert.

54
00:02:12,659 --> 00:02:13,492
So on the slide,

55
00:02:13,492 --> 00:02:15,060
we can see an example
of it detecting malware

56
00:02:15,060 --> 00:02:17,430
and the rest of the malware on the slide,

57
00:02:17,430 --> 00:02:18,810
OverSight was able to detect it

58
00:02:18,810 --> 00:02:21,570
with no a priority knowledge
of the actual malware.

59
00:02:21,570 --> 00:02:24,344
'Cause again, it was just alerting anytime

60
00:02:24,344 --> 00:02:26,010
anybody access the mic or the webcam.

61
00:02:26,010 --> 00:02:27,090
Turns out OverSight's pretty good

62
00:02:27,090 --> 00:02:28,860
at detecting zero-day vulnerabilities too,

63
00:02:28,860 --> 00:02:33,270
Specifically, those that
relate to webcam or mic access,

64
00:02:33,270 --> 00:02:35,100
remote Zoom bugs, or even zero-days

65
00:02:35,100 --> 00:02:37,500
that Mac malware was exploiting.

66
00:02:37,500 --> 00:02:38,460
So again, on the slide,

67
00:02:38,460 --> 00:02:41,280
we have some examples of
malware with zero-days

68
00:02:41,280 --> 00:02:42,360
or other vulnerabilities.

69
00:02:42,360 --> 00:02:44,160
And again, OverSight can detect that

70
00:02:44,160 --> 00:02:46,380
because it doesn't care
how the mic or the webcam

71
00:02:46,380 --> 00:02:48,063
is accessed just that it was.

72
00:02:49,980 --> 00:02:52,890
Finally, OverSight also
played a pivotal role

73
00:02:52,890 --> 00:02:55,440
uncovering good apps, behaving badly.

74
00:02:55,440 --> 00:02:58,830
Favorite example was that it
was able to uncover and prove

75
00:02:58,830 --> 00:03:01,770
for the first time that Shazam on Mac OS

76
00:03:01,770 --> 00:03:03,570
was actually still listening,

77
00:03:03,570 --> 00:03:06,273
even if the user turned it off. Yikes.

78
00:03:07,980 --> 00:03:10,350
All right, so back to
OverSight's killer feature,

79
00:03:10,350 --> 00:03:13,950
which is the ability to identify
what process is accessing

80
00:03:13,950 --> 00:03:15,330
the mic or the webcam.

81
00:03:15,330 --> 00:03:16,163
For security tool,

82
00:03:16,163 --> 00:03:18,930
this is obviously a must
have feature, right?

83
00:03:18,930 --> 00:03:21,300
If the process, the application accessing

84
00:03:21,300 --> 00:03:24,570
the mic or the webcam is
Zoom, Skype, FaceTime,

85
00:03:24,570 --> 00:03:25,403
that's fine, right?

86
00:03:25,403 --> 00:03:27,660
That should be allowed. maybe
don't even alert the user,

87
00:03:27,660 --> 00:03:29,280
but if it's some other malware

88
00:03:29,280 --> 00:03:32,190
or some other unrecognized program,

89
00:03:32,190 --> 00:03:34,440
obviously you want to alert the user.

90
00:03:34,440 --> 00:03:36,270
Now you might be thinking, well, yeah,

91
00:03:36,270 --> 00:03:37,908
this is a great feature.

92
00:03:37,908 --> 00:03:39,780
Why didn't other tools
have this capability?

93
00:03:39,780 --> 00:03:40,620
And the answer was,

94
00:03:40,620 --> 00:03:44,580
it's actually very difficult
to implement and to achieve.

95
00:03:44,580 --> 00:03:46,170
So on the slide, we have
a few lines of code,

96
00:03:46,170 --> 00:03:48,060
it's very easy to determine that

97
00:03:48,060 --> 00:03:51,090
the mic or the webcam was activated.

98
00:03:51,090 --> 00:03:53,220
Mac OS provides a notification for this

99
00:03:53,220 --> 00:03:54,450
that you can register for,

100
00:03:54,450 --> 00:03:57,453
but that notification
doesn't tell you who done it.

101
00:03:59,250 --> 00:04:01,816
So now let's look exactly
how OverSight went about

102
00:04:01,816 --> 00:04:04,950
identifying the active process.

103
00:04:04,950 --> 00:04:08,070
It's a bit involved and
leverages a bunch of undocumented

104
00:04:08,070 --> 00:04:09,750
features of the operating system.

105
00:04:09,750 --> 00:04:11,310
But again, it's important
to understand this

106
00:04:11,310 --> 00:04:13,770
so that when we look at
commercial products, we can again,

107
00:04:13,770 --> 00:04:16,650
prove without a doubt that
they stole the code directly

108
00:04:16,650 --> 00:04:18,273
and verbatim from OverSight.

109
00:04:19,290 --> 00:04:22,260
So OverSight has three steps
that it performs in order to

110
00:04:22,260 --> 00:04:25,080
identify the active or
responsible process.

111
00:04:25,080 --> 00:04:27,900
Step one is enumerating mock messages.

112
00:04:27,900 --> 00:04:32,340
So when an application wants
to access the mic or the webcam

113
00:04:32,340 --> 00:04:34,530
under the hood, kind of behind the scenes,

114
00:04:34,530 --> 00:04:38,081
the low level APIs and frameworks
will actually send a mock

115
00:04:38,081 --> 00:04:41,913
message to the camera or mic daemon.

116
00:04:42,900 --> 00:04:44,700
So with this observation,
I said, "okay, cool.

117
00:04:44,700 --> 00:04:47,067
I can just enumerate mock
messages and see who was sending

118
00:04:47,067 --> 00:04:51,390
mock messages to the camera or
mic daemon to ascertain what

119
00:04:51,390 --> 00:04:53,130
process is responsible."

120
00:04:53,130 --> 00:04:54,540
Turns out you can't do that directly.

121
00:04:54,540 --> 00:04:56,010
You need special entitlements,

122
00:04:56,010 --> 00:04:58,530
but there's a command line
utility that ships with Mac OS

123
00:04:58,530 --> 00:05:02,640
called LSMP and it has
the correct entitlements.

124
00:05:02,640 --> 00:05:05,760
So what OverSight does
is simply execute LSMP,

125
00:05:05,760 --> 00:05:06,840
it's very straightforward.

126
00:05:06,840 --> 00:05:08,490
You spawn a child process.

127
00:05:08,490 --> 00:05:12,270
Then it reads everything from
standard out and parses that.

128
00:05:12,270 --> 00:05:14,370
Now this parsing is a little complex

129
00:05:14,370 --> 00:05:15,720
or at least a little involved,

130
00:05:15,720 --> 00:05:18,450
because the output from
LSMP is not designed to be

131
00:05:18,450 --> 00:05:19,833
read in programmatically.

132
00:05:20,741 --> 00:05:22,320
But we'll see, when we talk
about the commercial products,

133
00:05:22,320 --> 00:05:23,760
this is one of the indications

134
00:05:23,760 --> 00:05:26,110
because they parsed it
in exactly the same way.

135
00:05:26,970 --> 00:05:30,720
Now that list from LSMP might
not be just one process,

136
00:05:30,720 --> 00:05:32,250
there might be several processes.

137
00:05:32,250 --> 00:05:34,835
So OverSight had to take other
actions to figure out one

138
00:05:34,835 --> 00:05:37,260
exact process, the active process,

139
00:05:37,260 --> 00:05:39,270
accessing the mic or the webcam.

140
00:05:39,270 --> 00:05:42,870
So step two, I observed the
fact that in the IO registry,

141
00:05:42,870 --> 00:05:46,290
there are very several
undocumented key value pairs that

142
00:05:46,290 --> 00:05:50,580
contain a list of pids that
did include the active process,

143
00:05:50,580 --> 00:05:53,400
which was accessing the mic or the webcam.

144
00:05:53,400 --> 00:05:54,780
Here's the code to do that.

145
00:05:54,780 --> 00:05:56,708
It's pretty straightforward

146
00:05:56,708 --> 00:05:59,280
because we can access the
IO kit registry directly,

147
00:05:59,280 --> 00:06:01,680
basically just query
these key value pairs,

148
00:06:01,680 --> 00:06:04,650
specifically the IO user
client creator under

149
00:06:04,650 --> 00:06:06,660
the IO PM route domain.

150
00:06:06,660 --> 00:06:09,150
And again, these are undocumented keys.

151
00:06:09,150 --> 00:06:10,200
Again, that's relevant.

152
00:06:10,200 --> 00:06:12,570
When we talk about proving equivalency,

153
00:06:12,570 --> 00:06:14,579
we also have to do some parsing

154
00:06:14,579 --> 00:06:16,140
to then pull out the pids as well.

155
00:06:16,140 --> 00:06:17,999
Finally, 'cause again,

156
00:06:17,999 --> 00:06:19,500
this list might have several pids as well.

157
00:06:19,500 --> 00:06:22,770
We do one final thing if we
don't have one single process

158
00:06:22,770 --> 00:06:25,920
and that is we sample candidate processes,

159
00:06:25,920 --> 00:06:27,480
read their remote memory,

160
00:06:27,480 --> 00:06:28,830
look at their stack traces

161
00:06:28,830 --> 00:06:31,860
and look at the APIs
they're actively calling.

162
00:06:31,860 --> 00:06:34,560
Now again, Mac OS doesn't
allow you to do this directly.

163
00:06:34,560 --> 00:06:37,020
You need special entitlements,
but lucky for us,

164
00:06:37,020 --> 00:06:39,540
there's a command line utility
called sample that again,

165
00:06:39,540 --> 00:06:42,060
we can execute against
the target remote process

166
00:06:42,060 --> 00:06:44,880
that we think might be
accessing the mic or the webcam.

167
00:06:44,880 --> 00:06:49,020
And then this will give us
a stack and thread trace.

168
00:06:49,020 --> 00:06:50,940
And what we do is we specifically look

169
00:06:50,940 --> 00:06:53,760
for the CMIOGRaph:DoWork function,

170
00:06:53,760 --> 00:06:56,040
which is related to reading frames off

171
00:06:56,040 --> 00:06:57,813
either the mic or the webcam.

172
00:06:59,070 --> 00:07:02,370
So via these steps OverSight
was very accurately

173
00:07:02,370 --> 00:07:04,740
able to identify the
process that was responsible

174
00:07:04,740 --> 00:07:06,480
for the mic and the webcam.

175
00:07:06,480 --> 00:07:09,273
And again, since it was
free, it became very popular.

176
00:07:10,140 --> 00:07:13,650
Unfortunately, this popularity
came at quite a cost.

177
00:07:13,650 --> 00:07:16,650
So now let's talk about how
OverSight was torn apart

178
00:07:16,650 --> 00:07:21,420
and its secrets shamelessly
stolen for commercial gain.

179
00:07:21,420 --> 00:07:22,290
First though, you might be wondering

180
00:07:22,290 --> 00:07:23,370
how did this even happen?

181
00:07:23,370 --> 00:07:25,621
Was Patrick's computer hacked?

182
00:07:25,621 --> 00:07:26,460
Was the source code stolen?

183
00:07:26,460 --> 00:07:28,530
No, it turns out was far easier, right?

184
00:07:28,530 --> 00:07:30,060
The binary is distributed.

185
00:07:30,060 --> 00:07:32,040
Anyone with basic reverse
engineering skills

186
00:07:32,040 --> 00:07:34,804
could reverse engineer
the OverSight binary

187
00:07:34,804 --> 00:07:37,290
and reconstruct its algorithm.

188
00:07:37,290 --> 00:07:38,790
So from a technical point of view,

189
00:07:38,790 --> 00:07:42,030
trivial from an ethical
legal point of view,

190
00:07:42,030 --> 00:07:43,728
not really that cool.

191
00:07:43,728 --> 00:07:46,020
Again, considering this was
stealing from a free tool

192
00:07:46,020 --> 00:07:48,183
and then utilizing it for commercial gain.

193
00:07:49,230 --> 00:07:52,740
Also it's worth noting that
OverSight's algorithm is first

194
00:07:52,740 --> 00:07:54,900
and foremost, very unique.

195
00:07:54,900 --> 00:07:58,560
If you Google a lot of the
strings, the actions it takes,

196
00:07:58,560 --> 00:08:00,270
there are zero hits.

197
00:08:00,270 --> 00:08:02,070
Also it's kind of janky, right?

198
00:08:02,070 --> 00:08:03,930
First and foremost, I'm
a security researcher,

199
00:08:03,930 --> 00:08:06,240
not a software engineer,

200
00:08:06,240 --> 00:08:08,400
And to give credence to this claim,

201
00:08:08,400 --> 00:08:10,860
we'll see that when Apple
pushed out an update,

202
00:08:10,860 --> 00:08:13,563
it triggered a lot of
bugs in OverSight. Yikes.

203
00:08:14,760 --> 00:08:16,080
All right, so how did this all begin?

204
00:08:16,080 --> 00:08:18,240
How did I even think that someone was,

205
00:08:18,240 --> 00:08:19,953
you know, stealing my code?

206
00:08:19,953 --> 00:08:22,283
Well, actually I never thought
that this would happen.

207
00:08:22,283 --> 00:08:23,640
Maybe I'm naive and optimistic.

208
00:08:23,640 --> 00:08:26,130
So I was actually looking at
a binary that had been flagged

209
00:08:26,130 --> 00:08:28,320
by some antivirus products for a client,

210
00:08:28,320 --> 00:08:29,670
turns out it wasn't malware.

211
00:08:29,670 --> 00:08:32,800
It was one of these kind
of suspect security tools.

212
00:08:32,800 --> 00:08:36,570
I noticed it was
executing the LSMP binary.

213
00:08:36,570 --> 00:08:38,520
And I'm like, that's
strange, like, I do that.

214
00:08:38,520 --> 00:08:41,190
And I haven't really heard
of other people doing that.

215
00:08:41,190 --> 00:08:42,750
And the more and more I
looked into this product,

216
00:08:42,750 --> 00:08:45,433
they looked more and more
similar to OverSight,

217
00:08:45,433 --> 00:08:47,340
especially when I then read
their marketing material

218
00:08:47,340 --> 00:08:49,230
that said they provide
the ability to monitor

219
00:08:49,230 --> 00:08:50,380
the mic and the webcam.

220
00:08:51,480 --> 00:08:52,320
Around that same time,

221
00:08:52,320 --> 00:08:54,450
Apple pushed out some updates to Mac OS,

222
00:08:54,450 --> 00:08:57,270
which horribly broke
OverSight embarrassingly.

223
00:08:57,270 --> 00:08:59,159
So on the top of the slide,

224
00:08:59,159 --> 00:09:00,600
we have some bug reports that
people submitted basically

225
00:09:00,600 --> 00:09:03,180
saying, "hey Patrick,
you gotta fix your tool."

226
00:09:03,180 --> 00:09:07,620
So I did what any programmer
does, Googled for fixes.

227
00:09:07,620 --> 00:09:10,680
And I found other users
complaining about similar issues.

228
00:09:10,680 --> 00:09:12,540
And I was like, man, sorry y'all

229
00:09:12,540 --> 00:09:14,340
I didn't realize this was so widespread.

230
00:09:14,340 --> 00:09:15,480
But reading the forums,

231
00:09:15,480 --> 00:09:17,670
the users came to the
conclusion that this belonged

232
00:09:17,670 --> 00:09:19,830
to another product, another tool.

233
00:09:19,830 --> 00:09:20,850
And so I grabbed those tools,

234
00:09:20,850 --> 00:09:22,980
did some analysis and
turned out that again,

235
00:09:22,980 --> 00:09:24,780
it looked very similar to OverSight.

236
00:09:25,620 --> 00:09:28,830
At this point, I decided to do
some more proactive hunting.

237
00:09:28,830 --> 00:09:30,450
I wrote a simple, YARA rule,

238
00:09:30,450 --> 00:09:32,790
YARA rules are normally
used for detecting malware,

239
00:09:32,790 --> 00:09:34,140
but of course we can use

240
00:09:34,140 --> 00:09:36,480
them to detect other binaries as well.

241
00:09:36,480 --> 00:09:40,080
So whipped up a simple YARA
rule to basically detect

242
00:09:40,080 --> 00:09:42,960
OverSight's algorithm and then
ran it across the internet.

243
00:09:42,960 --> 00:09:44,490
And again, found some interesting hits

244
00:09:44,490 --> 00:09:47,223
that when I triaged looked
very similar to OverSight.

245
00:09:48,420 --> 00:09:49,253
So at this point,

246
00:09:49,253 --> 00:09:51,780
I had a handful of commercial
products that it first glance

247
00:09:51,780 --> 00:09:54,240
appeared very similar to OverSight.

248
00:09:54,240 --> 00:09:55,351
Of course, though,

249
00:09:55,351 --> 00:09:58,620
we had to dig deeper to prove
without a doubt that this code

250
00:09:58,620 --> 00:10:01,920
in these commercial products
came directly from OverSight.

251
00:10:01,920 --> 00:10:03,870
So I'm gonna hand this over
to Tom and he is gonna talk

252
00:10:03,870 --> 00:10:06,060
about how we were able
to prove equivalency

253
00:10:06,060 --> 00:10:08,673
between OverSight and
these commercial products.

254
00:10:09,510 --> 00:10:10,920
- All right. Thanks Patrick.

255
00:10:10,920 --> 00:10:12,900
So first I just wanna give
a shout-out to my wife

256
00:10:12,900 --> 00:10:15,400
and daughters, it's their
birthdays this week, so.

257
00:10:16,868 --> 00:10:17,862
(audience cheers)

258
00:10:17,862 --> 00:10:19,410
Thank you.

259
00:10:19,410 --> 00:10:20,730
So, for this section,

260
00:10:20,730 --> 00:10:23,490
so, I've looked at a lot of Patrick's

261
00:10:23,490 --> 00:10:25,320
code over the years as well.

262
00:10:25,320 --> 00:10:26,700
So for this section,

263
00:10:26,700 --> 00:10:29,010
when you look at the size on
the left hand side is OverSight

264
00:10:29,010 --> 00:10:30,870
on the right hand side
is the the products'.

265
00:10:30,870 --> 00:10:33,330
As he mentioned, there were
three products that were sort of

266
00:10:33,330 --> 00:10:36,480
ones that we needed to
investigate a little bit further.

267
00:10:36,480 --> 00:10:38,340
We only have time to go over two of them.

268
00:10:38,340 --> 00:10:39,960
So I'll try to go through
'em a little quickly

269
00:10:39,960 --> 00:10:41,760
since we're running short.

270
00:10:41,760 --> 00:10:44,760
But if you look, the OverSights algorithm,

271
00:10:44,760 --> 00:10:47,910
as Patrick mentioned, sort of
has three unique steps to it.

272
00:10:47,910 --> 00:10:50,520
And as we go through sort
of the first two, I think,

273
00:10:50,520 --> 00:10:52,410
you could make an argument
that maybe someone was

274
00:10:52,410 --> 00:10:53,400
running these a little bit,

275
00:10:53,400 --> 00:10:56,880
but when we get to the third
step to me having done,

276
00:10:56,880 --> 00:10:58,410
you know, a lot of
reverse engineering over

277
00:10:58,410 --> 00:11:00,390
the number of years,

278
00:11:00,390 --> 00:11:03,120
I think we can reasonably think

279
00:11:03,120 --> 00:11:05,370
that this was taken from the OverSight.

280
00:11:05,370 --> 00:11:06,360
So on the first slide here,

281
00:11:06,360 --> 00:11:10,020
this is the first product
we have the LSMP parsing.

282
00:11:10,020 --> 00:11:11,640
And as Patrick mentioned,

283
00:11:11,640 --> 00:11:14,400
there's a little bit of
jankiness going on in his code.

284
00:11:14,400 --> 00:11:16,080
So he basically just tries to parse this

285
00:11:16,080 --> 00:11:18,210
looking for in between the parentheses.

286
00:11:18,210 --> 00:11:20,490
So I think there could be
a use of optimization here

287
00:11:20,490 --> 00:11:24,150
for some RegEx, but you
don't see that here, right?

288
00:11:24,150 --> 00:11:27,270
You see literally the same
processing that's going on within

289
00:11:27,270 --> 00:11:31,050
OverSight as there is in
with this secondary product.

290
00:11:31,050 --> 00:11:34,950
We also see this going in
the method name as well.

291
00:11:34,950 --> 00:11:37,950
So if you look at the method
names, they're very similar.

292
00:11:37,950 --> 00:11:40,050
So I think that's an interesting point,

293
00:11:40,050 --> 00:11:43,260
but it's not necessarily
conclusive of taking the algorithm

294
00:11:43,260 --> 00:11:45,780
from one component to another.

295
00:11:45,780 --> 00:11:48,990
Another aspect of this
was the unique aspect

296
00:11:48,990 --> 00:11:51,630
of the OverSight was
looking at the IO registry.

297
00:11:51,630 --> 00:11:55,140
So when you look for these
specific key value pairs

298
00:11:55,140 --> 00:11:58,350
that are used in OverSight,
they're not necessarily,

299
00:11:58,350 --> 00:11:59,880
you don't really get a whole lot of hits.

300
00:11:59,880 --> 00:12:02,910
So maybe after the talk,
we'll see quite a few more.

301
00:12:02,910 --> 00:12:04,860
But when we look at this again,

302
00:12:04,860 --> 00:12:07,680
we see the same exact steps
that are going on with

303
00:12:07,680 --> 00:12:10,680
OverSight, as they're in this
particular product, right?

304
00:12:10,680 --> 00:12:13,140
Right down, looking through this again,

305
00:12:13,140 --> 00:12:14,730
looking at the method names, right?

306
00:12:14,730 --> 00:12:16,680
This is a little telling of

307
00:12:16,680 --> 00:12:19,773
that this could have
come from another source.

308
00:12:21,870 --> 00:12:24,300
And for the final one
for the first product,

309
00:12:24,300 --> 00:12:29,280
if we look this aspect of
it is the sampling, right?

310
00:12:29,280 --> 00:12:32,250
To me, the sampling component of OverSight

311
00:12:32,250 --> 00:12:34,230
sort of makes it very unique,

312
00:12:34,230 --> 00:12:35,490
especially when we tie it back

313
00:12:35,490 --> 00:12:37,443
to those other two components.

314
00:12:38,573 --> 00:12:39,720
And, for a commercial product,

315
00:12:39,720 --> 00:12:43,290
the sampling for a security
tool is free, open source,

316
00:12:43,290 --> 00:12:45,060
doing the sampling is fine, right?

317
00:12:45,060 --> 00:12:48,090
You're trying to eliminate
those false positives

318
00:12:48,090 --> 00:12:51,210
and figure out which specific
process has that unique

319
00:12:51,210 --> 00:12:53,700
through the camera and microphone.

320
00:12:53,700 --> 00:12:55,620
But the sampling is a
little invasive, right,

321
00:12:55,620 --> 00:12:59,040
it pauses the process, has
to go through the back trace,

322
00:12:59,040 --> 00:13:00,690
and provides that for you.

323
00:13:00,690 --> 00:13:04,170
And again, OverSight's looking
for the CMIOGraph:DoWork,

324
00:13:04,170 --> 00:13:06,960
which is really the worker
thread for accessing

325
00:13:06,960 --> 00:13:08,910
the cameras and microphones.

326
00:13:08,910 --> 00:13:11,340
So when we see this in a back trace,

327
00:13:11,340 --> 00:13:14,190
that is evidence that this
particular process is accessing

328
00:13:14,190 --> 00:13:15,720
one of those two currently.

329
00:13:15,720 --> 00:13:19,800
So it gives the way
for OverSight to extend

330
00:13:19,800 --> 00:13:22,260
the first two algorithms to this third one

331
00:13:22,260 --> 00:13:24,480
and eliminate all those false positives.

332
00:13:24,480 --> 00:13:26,670
And if you look, this is
exactly the same, right?

333
00:13:26,670 --> 00:13:28,440
The CMIOGraph:DoWork.

334
00:13:28,440 --> 00:13:29,850
So it's very suspicious.

335
00:13:29,850 --> 00:13:33,810
So I think we can really
conclude that this algorithm,

336
00:13:33,810 --> 00:13:34,643
as it's written,

337
00:13:34,643 --> 00:13:36,330
especially in the three aspects of it

338
00:13:36,330 --> 00:13:38,403
are directly from OverSight.

339
00:13:39,660 --> 00:13:42,960
And again, we can see, we
have the same drill here.

340
00:13:42,960 --> 00:13:47,010
We look at the secondary product here,

341
00:13:47,010 --> 00:13:49,050
look at the LSMP processing.

342
00:13:49,050 --> 00:13:50,580
In this case, there's
a little bit of RegEx,

343
00:13:50,580 --> 00:13:51,570
so we give 'em a little kudos

344
00:13:51,570 --> 00:13:53,490
that they're trying to
improve the performance.

345
00:13:53,490 --> 00:13:56,689
Maybe they saw some bugs in
it and wanted to improve that.

346
00:13:56,689 --> 00:13:58,290
Great.

347
00:13:58,290 --> 00:14:00,000
But, when we continue further, right,

348
00:14:00,000 --> 00:14:01,710
it's not just that one aspect to it.

349
00:14:01,710 --> 00:14:04,800
It's tying these together
to get a better picture

350
00:14:04,800 --> 00:14:06,273
of what's actually going on.

351
00:14:07,140 --> 00:14:08,430
The IO registry, again,

352
00:14:08,430 --> 00:14:10,770
we see exactly the same processing here

353
00:14:10,770 --> 00:14:12,030
with the IO root domain,

354
00:14:12,030 --> 00:14:14,910
going down to the correct key value pairs

355
00:14:14,910 --> 00:14:17,550
that we see in OverSight.

356
00:14:17,550 --> 00:14:20,850
And finally in this product as well

357
00:14:20,850 --> 00:14:22,290
we see the sampling, right?

358
00:14:22,290 --> 00:14:24,480
And sure, there's a little
bit differences here.

359
00:14:24,480 --> 00:14:28,500
They do some sampling differences
with respect to timing.

360
00:14:28,500 --> 00:14:31,080
Maybe that was just for
improvements on performance

361
00:14:31,080 --> 00:14:32,670
because they are a
commercial product, right,

362
00:14:32,670 --> 00:14:34,560
they don't want to hog all the resources.

363
00:14:34,560 --> 00:14:37,200
So, they have to optimize
that a little bit,

364
00:14:37,200 --> 00:14:39,810
but we see the DoWork method here.

365
00:14:39,810 --> 00:14:41,790
So this is sort of a dead giveaway.

366
00:14:41,790 --> 00:14:43,020
And as I tell my students,

367
00:14:43,020 --> 00:14:44,280
one of the things you wanna do

368
00:14:44,280 --> 00:14:46,200
is look at the binaries, right?

369
00:14:46,200 --> 00:14:47,400
That gives us the ground truth,

370
00:14:47,400 --> 00:14:49,800
and so when we're comparing
these two binaries, right,

371
00:14:49,800 --> 00:14:53,190
this gives us a pretty good
confidence that this algorithm

372
00:14:53,190 --> 00:14:56,730
was taken from the OverSight components.

373
00:14:56,730 --> 00:14:59,407
So I'm gonna turn it back
over to Patrick for some

374
00:14:59,407 --> 00:15:01,353
hopefully better news.

375
00:15:02,910 --> 00:15:04,050
- All right, thanks Tom.

376
00:15:04,050 --> 00:15:07,920
So at this point we clearly
have pretty indisputable proof

377
00:15:07,920 --> 00:15:10,980
that these products directly
copied from OverSight.

378
00:15:10,980 --> 00:15:13,050
So now the question
becomes, what do we do?

379
00:15:13,050 --> 00:15:16,323
How do we turn this into a
happy or a happyish ending?

380
00:15:17,640 --> 00:15:20,880
Now, obviously I was gonna
reach out to the perpetrators,

381
00:15:20,880 --> 00:15:23,100
but I quickly learned there was somewhat

382
00:15:23,100 --> 00:15:25,050
of a winning approach.

383
00:15:25,050 --> 00:15:26,100
First and foremost,

384
00:15:26,100 --> 00:15:29,520
I found it was really important
to define or articulate

385
00:15:29,520 --> 00:15:31,140
exactly what you wanted.

386
00:15:31,140 --> 00:15:32,850
Did you just want money?

387
00:15:32,850 --> 00:15:36,690
Did you want to disparage them
and flame them on Twitter?

388
00:15:36,690 --> 00:15:39,600
Did you want them to remove the code,

389
00:15:39,600 --> 00:15:40,860
open source their tools?

390
00:15:40,860 --> 00:15:42,931
Knowing what you want was important

391
00:15:42,931 --> 00:15:43,973
because they were always gonna ask.

392
00:15:45,225 --> 00:15:48,120
Then, and this is important
too, create irrefutable proof.

393
00:15:48,120 --> 00:15:51,060
The code comparisons Tom walked through,

394
00:15:51,060 --> 00:15:53,520
to me are, you know, are
a hundred percent obvious,

395
00:15:53,520 --> 00:15:55,440
but understand that you're
probably gonna be talking

396
00:15:55,440 --> 00:15:58,440
to lawyers or the
intellectual property team

397
00:15:58,440 --> 00:16:00,780
that might not have, or
probably doesn't have,

398
00:16:00,780 --> 00:16:02,760
such an in-depth technical understanding.

399
00:16:02,760 --> 00:16:05,550
So provide those code comparisons as well.

400
00:16:05,550 --> 00:16:08,480
'Cause they probably will
go to the engineering team,

401
00:16:08,480 --> 00:16:10,007
but then also understand, you know,

402
00:16:10,007 --> 00:16:11,478
have to have some more high level.

403
00:16:11,478 --> 00:16:13,290
So like say, "hey, Google, this
string that's in my product

404
00:16:13,290 --> 00:16:15,330
and your product. There's zero hits.

405
00:16:15,330 --> 00:16:18,330
Please give me an explanation
why they're in both."

406
00:16:18,330 --> 00:16:21,660
Also speaking of lawyers, highly
recommend getting your own.

407
00:16:21,660 --> 00:16:23,640
If nothing else I found when you talk

408
00:16:23,640 --> 00:16:24,690
to the other companies,

409
00:16:24,690 --> 00:16:26,430
the commercial entities who stole this

410
00:16:26,430 --> 00:16:27,930
and you mention you have a lawyer,

411
00:16:27,930 --> 00:16:30,210
they take you far more seriously.

412
00:16:30,210 --> 00:16:31,770
I was lucky enough to work with EFF.

413
00:16:31,770 --> 00:16:33,180
EFF, if you don't know,

414
00:16:33,180 --> 00:16:34,770
amazing nonprofit organization

415
00:16:34,770 --> 00:16:36,660
that provides free legal resources

416
00:16:36,660 --> 00:16:38,730
to security researchers
and other nonprofits.

417
00:16:38,730 --> 00:16:41,850
So, a big thanks and shout-out to EFF.

418
00:16:41,850 --> 00:16:44,730
Finally, why is the probably
reach out professionally

419
00:16:44,730 --> 00:16:46,683
versus flaming them on Twitter.

420
00:16:47,910 --> 00:16:50,340
Also then, it's good to
know what corporations want.

421
00:16:50,340 --> 00:16:53,790
And this is generally
an amicable solution.

422
00:16:53,790 --> 00:16:56,820
Also, and this was something
of a learning experience to me.

423
00:16:56,820 --> 00:16:58,290
Really found that the majority,

424
00:16:58,290 --> 00:17:01,440
If not all of the cases
were result of a single,

425
00:17:01,440 --> 00:17:04,080
arguably rather naive developer,

426
00:17:04,080 --> 00:17:06,900
reverse engine and stealing
the code from OverSight

427
00:17:06,900 --> 00:17:09,630
versus the malice of
an entire corporation.

428
00:17:09,630 --> 00:17:11,940
When I first kind of
figured this out I was like,

429
00:17:11,940 --> 00:17:14,220
you know, F these companies they're evil,

430
00:17:14,220 --> 00:17:16,620
they're stealing from my nonprofit.

431
00:17:16,620 --> 00:17:18,660
But then really once I gained
a deeper understanding,

432
00:17:18,660 --> 00:17:20,670
what generally happened was the developer

433
00:17:20,670 --> 00:17:23,130
had been tasked to implement a feature.

434
00:17:23,130 --> 00:17:24,360
They went out, couldn't figure it out,

435
00:17:24,360 --> 00:17:25,590
reverse engineer my tools,

436
00:17:25,590 --> 00:17:26,767
and then, you know, no one asked them,

437
00:17:26,767 --> 00:17:28,830
"where did you get that from?"

438
00:17:28,830 --> 00:17:31,440
Also then. what do
corporations generally want?

439
00:17:31,440 --> 00:17:32,670
There's two main things.

440
00:17:32,670 --> 00:17:34,110
They wanna cover themselves legally.

441
00:17:34,110 --> 00:17:37,380
And so often this is achieved
via a licensing agreement,

442
00:17:37,380 --> 00:17:39,060
sometimes retroactively as well.

443
00:17:39,060 --> 00:17:42,630
And also they're very interested
in not being disparaged

444
00:17:42,630 --> 00:17:43,463
and for both of these,

445
00:17:43,463 --> 00:17:46,150
they're often willing to
provide financial compensation.

446
00:17:47,040 --> 00:17:48,720
So let's look at some win-win resolutions

447
00:17:48,720 --> 00:17:49,740
that came out of this,

448
00:17:49,740 --> 00:17:51,750
noting that all three of the corporations,

449
00:17:51,750 --> 00:17:53,790
the companies we approached,

450
00:17:53,790 --> 00:17:55,620
eventually fully admitted fault

451
00:17:55,620 --> 00:17:57,270
and said, "yes, we stole from you."

452
00:17:57,270 --> 00:17:58,743
Which was kinda nice.

453
00:17:59,790 --> 00:18:03,990
The first company really was very quick

454
00:18:03,990 --> 00:18:05,640
to recognize their fault.

455
00:18:05,640 --> 00:18:07,807
We see in the email,
they acknowledged saying,

456
00:18:07,807 --> 00:18:09,840
"hey, yeah, wow, it's really not cool."

457
00:18:09,840 --> 00:18:13,110
They also took some steps that
we're gonna remove the code

458
00:18:13,110 --> 00:18:16,140
from our products that
infringed upon your utility.

459
00:18:16,140 --> 00:18:19,560
And then we're gonna provide
you financial compensation.

460
00:18:19,560 --> 00:18:21,270
You know, if you can give us a license.

461
00:18:21,270 --> 00:18:22,533
So kind of a win-win.

462
00:18:23,682 --> 00:18:26,850
The other company, again,
similar win-win response.

463
00:18:26,850 --> 00:18:30,450
Clearly acknowledged the
issue, which is really nice.

464
00:18:30,450 --> 00:18:32,790
Remove the code and then
made a nice donation

465
00:18:32,790 --> 00:18:34,290
to the Objective-C Foundation.

466
00:18:35,190 --> 00:18:37,830
So let's wrap this up with some takeaways.

467
00:18:37,830 --> 00:18:39,360
First and foremost, if you're a developer,

468
00:18:39,360 --> 00:18:41,460
don't be naive like me,

469
00:18:41,460 --> 00:18:44,070
don't assume your code
will be not stolen, right?

470
00:18:44,070 --> 00:18:46,650
I mean I thought, "hey
my tools' closed source.

471
00:18:46,650 --> 00:18:49,230
Someone would have to really
premeditively reverse engineer

472
00:18:49,230 --> 00:18:51,357
and then, you know, steal it verbatim."

473
00:18:52,320 --> 00:18:54,480
But it happened right?

474
00:18:54,480 --> 00:18:56,700
Also, be proactive.

475
00:18:56,700 --> 00:18:57,907
The corporations aren't
gonna come to you saying,

476
00:18:57,907 --> 00:18:59,835
"Hey, we stole your code."

477
00:18:59,835 --> 00:19:01,590
So maybe use some of the
methods we talked about today

478
00:19:01,590 --> 00:19:04,830
to create YARA rules for your signatures.

479
00:19:04,830 --> 00:19:07,140
If your product has a very unique feature,

480
00:19:07,140 --> 00:19:08,460
maybe keep an eye on the competition.

481
00:19:08,460 --> 00:19:10,590
And, if they implement
that same feature, oh,

482
00:19:10,590 --> 00:19:12,240
reverse engineer and see how they do it.

483
00:19:12,240 --> 00:19:15,300
Bug reports, we showed was
kind of an interesting neat way

484
00:19:15,300 --> 00:19:17,460
as well, which allowed
us to kind of uncover

485
00:19:17,460 --> 00:19:19,233
some other perpetrators as well.

486
00:19:20,580 --> 00:19:21,810
For corporations.

487
00:19:21,810 --> 00:19:23,790
It's really important to educate

488
00:19:23,790 --> 00:19:25,200
your employers on the topic.

489
00:19:25,200 --> 00:19:27,840
Even just to reiterate that
stealing code is not okay.

490
00:19:27,840 --> 00:19:29,160
I mean, I thought this would be obvious,

491
00:19:29,160 --> 00:19:31,110
but apparently that's not the case.

492
00:19:31,110 --> 00:19:32,850
And again, if you're a corporation,

493
00:19:32,850 --> 00:19:37,850
this will avoid serious legal
issues and optics issues.

494
00:19:37,950 --> 00:19:39,870
Also, I think it's wise for corporations

495
00:19:39,870 --> 00:19:44,061
to implement various internal
procedures to detect this,

496
00:19:44,061 --> 00:19:46,380
or maybe perhaps when
a developer implements

497
00:19:46,380 --> 00:19:48,097
a really cool new feature say,

498
00:19:48,097 --> 00:19:49,410
"where did you get this from?"

499
00:19:49,410 --> 00:19:51,750
I've worked at a variety
of large companies

500
00:19:51,750 --> 00:19:53,280
and no one ever asked this question.

501
00:19:53,280 --> 00:19:54,420
I'm not gonna steal code,

502
00:19:54,420 --> 00:19:57,420
but still having that extra
question might have avoided

503
00:19:57,420 --> 00:19:58,920
some of these in the first place.

504
00:19:58,920 --> 00:20:01,350
And then finally it's really
important for the corporations

505
00:20:01,350 --> 00:20:04,170
to be amicable when someone reaches out.

506
00:20:04,170 --> 00:20:05,220
There was a few scenarios

507
00:20:05,220 --> 00:20:07,470
where they were a little defensive,

508
00:20:07,470 --> 00:20:10,643
really disagreed with the results.

509
00:20:10,643 --> 00:20:12,735
Once I showed up with the lawyers,

510
00:20:12,735 --> 00:20:14,244
they quickly changed their tune.

511
00:20:14,244 --> 00:20:16,350
And, you know again, ultimately
when they admitted to fault,

512
00:20:16,350 --> 00:20:17,183
I was like, well,

513
00:20:17,183 --> 00:20:19,540
we could have solved this
way more amicably up front.

514
00:20:20,640 --> 00:20:23,310
So that's a wrap before we jump into Q&A,

515
00:20:23,310 --> 00:20:25,530
I just wanna recognize
the amazing companies,

516
00:20:25,530 --> 00:20:27,780
the support the Objective-C foundation.

517
00:20:27,780 --> 00:20:31,260
Also wanted to thank
DEFCON for having us talk.

518
00:20:31,260 --> 00:20:34,770
And of course, all of you
for attending our talk.

519
00:20:34,770 --> 00:20:36,990
So I think we have a few minutes for Q&A,

520
00:20:36,990 --> 00:20:39,990
if not, I will be around here afterwards.

521
00:20:39,990 --> 00:20:44,100
Also I'm gonna be at
No Starch Press' table

522
00:20:44,100 --> 00:20:45,990
signing my new book at 3:30,

523
00:20:45,990 --> 00:20:48,840
so if you wanna come grab my
signature to steal my identity,

524
00:20:48,840 --> 00:20:49,890
I will see you there.

525
00:20:51,989 --> 00:20:54,739
(audience claps)