1
00:00:13,650 --> 00:00:21,430
At this point, I'd like to welcome Dan and Lucas to present, My Call Sign is My Passport.

2
00:00:25,610 --> 00:00:27,490
Thank you, thank you.

3
00:00:27,610 --> 00:00:30,790
So, thank you everyone for coming to our talk.

4
00:00:30,870 --> 00:00:36,730
My Call Sign is My Passport, Responsible for Testing and Disclosure of Ham Radio Websites.

5
00:00:38,230 --> 00:00:39,650
So, I'm Dan Nort.

6
00:00:39,890 --> 00:00:42,630
I'm a Senior Security Consultant at NetSpy.

7
00:00:42,630 --> 00:00:54,970
I've got three years of experience, a little over three years of experience doing web application penetration testing, X-PEN, Cloud-PEN, API-PEN, so a wide skill set there.

8
00:00:55,030 --> 00:01:04,510
I've been licensed for six years and I now have my amateur extra as of May, so.

9
00:01:06,750 --> 00:01:08,290
All right, I'm Lucas Scaler.

10
00:01:08,350 --> 00:01:17,330
Ten years in InfoSec, did some digital forensics, sensor response, pen testing, phone management, now I run a security operations team.

11
00:01:17,730 --> 00:01:21,270
Licensed for 14 years, amateur... what is up with it?

12
00:01:21,270 --> 00:01:22,210
It's a bad one.

13
00:01:22,210 --> 00:01:22,650
Yeah.

14
00:01:22,650 --> 00:01:24,250
Yeah, it's a little jiggly.

15
00:01:24,410 --> 00:01:26,170
We don't want to talk about wires here.

16
00:01:26,330 --> 00:01:27,130
No.

17
00:01:28,350 --> 00:01:29,830
Maybe we'll just skip the mic.

18
00:01:29,850 --> 00:01:30,710
Yeah, skip the mic.

19
00:01:30,710 --> 00:01:32,230
Yeah, all right, we'll talk loudly.

20
00:01:33,330 --> 00:01:38,030
Yeah, so licensed for 14 years, now amateur extra, GLARD V.

21
00:01:39,710 --> 00:01:41,830
So start off with the usual disclaimer.

22
00:01:42,590 --> 00:01:45,070
Dan and I are doing this on our own volition.

23
00:01:45,070 --> 00:01:47,150
It's not anything from our employers.

24
00:01:47,510 --> 00:01:54,670
And there is some propensity for getting in trouble if you were to do some of this, so don't necessarily do what we did.

25
00:01:54,670 --> 00:01:56,350
Be careful if you decide to.

26
00:01:56,470 --> 00:01:58,350
It's not our responsibility if you do.

27
00:01:59,870 --> 00:02:02,170
This is how we pota in Minnesota.

28
00:02:04,930 --> 00:02:10,270
We're out on a frozen lake, it's zero degrees out, and miserable fun is what we like to do.

29
00:02:10,270 --> 00:02:12,230
Miserable fun is the best fun.

30
00:02:13,090 --> 00:02:20,310
And if you have an FCDX10 and you like the little protection rails, it's on Thingiverse, he designed them.

31
00:02:23,670 --> 00:02:26,110
So this is actually my home QTH.

32
00:02:27,810 --> 00:02:30,050
I'm technically portable during the summer.

33
00:02:30,050 --> 00:02:31,890
I go and I set up in the backyard.

34
00:02:33,130 --> 00:02:34,390
This is how I operate.

35
00:02:34,390 --> 00:02:41,530
Well, last year I wanted to be able to operate inside during the winter, because as you saw from our pota slide, in Minnesota it gets cold.

36
00:02:41,530 --> 00:02:43,110
I don't know if you guys know that.

37
00:02:44,590 --> 00:02:52,590
So Lucas came over, helped me install a ground rod, we got everything grounded, bonded, everything's done right, but that's what hams do.

38
00:02:52,590 --> 00:02:54,050
Hams help hams.

39
00:02:55,010 --> 00:02:59,870
And the water bottle trick in order to put a ground rod works great.

40
00:03:01,610 --> 00:03:02,670
Five minutes?

41
00:03:02,670 --> 00:03:03,390
Five minutes.

42
00:03:03,390 --> 00:03:04,510
It was amazing.

43
00:03:06,170 --> 00:03:09,070
So, how this all started.

44
00:03:09,430 --> 00:03:11,730
I accidentally found a vulnerability.

45
00:03:13,130 --> 00:03:16,170
I don't know if you guys know this about me, I'm kind of lazy.

46
00:03:16,250 --> 00:03:18,970
So I happen to be on my favorite ham radio website.

47
00:03:18,970 --> 00:03:21,370
Listening to the radio in the backyard.

48
00:03:21,710 --> 00:03:23,790
And I hear an interesting call sign.

49
00:03:25,110 --> 00:03:27,730
I'm not going to use the search bar, I'm lazy.

50
00:03:27,870 --> 00:03:30,830
So my call sign was already in the URL.

51
00:03:31,170 --> 00:03:37,410
So I went ahead and just typed in the interesting call sign in the URL.

52
00:03:38,610 --> 00:03:39,950
Next slide.

53
00:03:43,010 --> 00:03:49,730
Now, this is what we call an insecure direct object reference, or IDOR for short.

54
00:03:50,890 --> 00:03:53,970
It seemed like there was some sensitive information.

55
00:03:53,970 --> 00:03:58,550
By the way, all these slides are completely faked because we'll go into that later.

56
00:03:59,010 --> 00:04:05,790
But it seemed like there was some sensitive information here that I should not be able to see on someone else's profile.

57
00:04:07,690 --> 00:04:08,870
And that's why it was an IDOR.

58
00:04:08,870 --> 00:04:11,930
Now I wasn't sure if it was an IDOR or if this was intended functionality.

59
00:04:12,830 --> 00:04:14,970
Now we get to kind of the big problem.

60
00:04:15,430 --> 00:04:16,370
What do we do?

61
00:04:16,370 --> 00:04:19,750
So here's the problem with trying to disclose something.

62
00:04:20,810 --> 00:04:25,230
There are many incidences of where it did not go well for the person trying to disclose it.

63
00:04:25,230 --> 00:04:27,030
Someone trying to do the right thing.

64
00:04:27,150 --> 00:04:32,750
And him and I went back and forth on this for quite a bit before we decided what is the right thing to do in this case.

65
00:04:32,750 --> 00:04:39,290
There was the F12 incidents where, hey, you use dev tools, the governor now says, you're a hacker.

66
00:04:39,430 --> 00:04:42,430
And it's like, well, if he's a hacker, I want to hire him.

67
00:04:42,710 --> 00:04:45,310
But there's other cases.

68
00:04:45,310 --> 00:04:48,510
Four students arrested for disclosing a vulnerability.

69
00:04:48,510 --> 00:04:51,790
And they were strip searched for disclosing a vulnerability.

70
00:04:51,790 --> 00:04:52,990
That's how bad it goes.

71
00:04:52,990 --> 00:05:01,410
And when I was looking for these things, it turns out I actually found like an open source project that is tracking this sort of like occurrences.

72
00:05:01,410 --> 00:05:06,910
And the fact that there needs to be a project of that scale tells you just how bad of a problem this is.

73
00:05:07,030 --> 00:05:08,410
And so it's like, what do you do?

74
00:05:08,410 --> 00:05:11,010
Do you do the right thing and disclose?

75
00:05:11,730 --> 00:05:15,290
Or do you just say, yeah, it's not my problem?

76
00:05:15,510 --> 00:05:16,610
Well, we're hams.

77
00:05:17,430 --> 00:05:18,690
So it's Dan.

78
00:05:18,690 --> 00:05:20,290
So of course, he's going to full send.

79
00:05:20,290 --> 00:05:21,570
And it's me, I'm going to full send.

80
00:05:21,570 --> 00:05:23,630
A disclosure to the site owner.

81
00:05:23,630 --> 00:05:29,350
So at this point, I emailed the site owner asking him, hey, is this intended functionality?

82
00:05:30,030 --> 00:05:34,710
Here is seven steps to replicate this exact behavior.

83
00:05:38,730 --> 00:05:41,610
But hey, everything turned out okay.

84
00:05:41,790 --> 00:05:43,590
He confirmed it was a problem.

85
00:05:43,590 --> 00:05:45,210
Was very, very grateful.

86
00:05:45,550 --> 00:05:48,070
Remediated it within just a few days.

87
00:05:48,070 --> 00:05:51,010
And then asked me to validate that it was actually fixed.

88
00:05:51,550 --> 00:05:53,450
Can't get better than that, right?

89
00:05:53,450 --> 00:05:55,310
Didn't go to jail, didn't get strip searched.

90
00:05:56,430 --> 00:06:01,970
Now, we were wondering, hey, why did this go so well for me?

91
00:06:02,790 --> 00:06:05,930
Obviously, the professional reporting, I write pen test reports all the time.

92
00:06:05,930 --> 00:06:08,070
So it's kind of like within my wheelhouse.

93
00:06:08,650 --> 00:06:13,550
I believe it might have been because I asked, hey, is this actually a problem?

94
00:06:14,490 --> 00:06:16,610
Because I didn't want to assume anything.

95
00:06:16,610 --> 00:06:22,950
But the thing that him and I identified, we think, was why it went okay.

96
00:06:22,950 --> 00:06:25,370
Because we were licensed, or I was licensed.

97
00:06:25,430 --> 00:06:28,150
And so, he comes in later on this.

98
00:06:28,150 --> 00:06:29,950
I was licensed, and so it was...

99
00:06:30,650 --> 00:06:34,530
The license kind of like gives you a little bit of trust with other hands.

100
00:06:34,530 --> 00:06:38,270
Because, I mean, hey, we all care about the call signs.

101
00:06:39,830 --> 00:06:41,730
Ending in Lima, come back, you know?

102
00:06:41,730 --> 00:06:43,110
We've all been there.

103
00:06:43,110 --> 00:06:47,430
So this is great.

104
00:06:47,430 --> 00:06:55,550
We helped, at this point, we helped one of my favorite ham radio websites.

105
00:06:55,670 --> 00:06:57,970
And we improved their security posture.

106
00:06:57,970 --> 00:07:02,370
And we got rid of a vulnerability that actually would impact other users and their data.

107
00:07:02,370 --> 00:07:04,810
It wasn't extremely sensitive.

108
00:07:04,890 --> 00:07:09,530
But it was still things that I felt were like, people shouldn't be able to see that.

109
00:07:10,890 --> 00:07:13,630
But we wanted to be able to do more, too.

110
00:07:13,830 --> 00:07:15,730
So Dan and I talked about it a little bit.

111
00:07:15,730 --> 00:07:20,870
We decided to approach the owner again and say, hey, what if we do a full assessment of your site?

112
00:07:20,950 --> 00:07:24,470
Let's look around for other stuff beyond just what we've stumbled on.

113
00:07:25,190 --> 00:07:26,050
We're hams.

114
00:07:26,050 --> 00:07:27,230
Here's our call signs.

115
00:07:27,490 --> 00:07:29,350
Here's what we're thinking for a scope.

116
00:07:29,350 --> 00:07:31,410
We're going to do manual testing only.

117
00:07:31,410 --> 00:07:34,670
We're going to keep within these certain testing windows.

118
00:07:35,190 --> 00:07:37,570
We're going to not do destructive testing.

119
00:07:37,870 --> 00:07:40,190
We're going to provide a report back with the findings.

120
00:07:40,490 --> 00:07:43,510
We're going to not disclose specifics prior to remediation.

121
00:07:43,510 --> 00:07:47,570
And we're going to de-conflict by, here's the IP addresses we're coming from.

122
00:07:47,570 --> 00:07:48,430
Here's the testing windows.

123
00:07:48,430 --> 00:07:49,290
We're going to do it.

124
00:07:49,690 --> 00:07:55,010
So this way, if anything went wrong, he at least can go like, oh, it wasn't actually them that caused that problem.

125
00:07:55,010 --> 00:07:59,030
Because it's like, hey, here's our de-confliction.

126
00:08:00,210 --> 00:08:02,270
But yes, absolutely no scanning.

127
00:08:02,550 --> 00:08:03,550
It's prod.

128
00:08:03,970 --> 00:08:05,110
It's prod.

129
00:08:05,230 --> 00:08:07,430
So he was 100% on board.

130
00:08:07,430 --> 00:08:10,130
He was very excited to get some more attention on it.

131
00:08:10,130 --> 00:08:17,950
So in summary, what we ended up finding, six high vulnerabilities, three mediums, three lows, and one informational.

132
00:08:18,130 --> 00:08:21,250
And this was done over a little more than 12 hours of time.

133
00:08:21,450 --> 00:08:24,250
Spread out over a couple weekends, an hour here and there.

134
00:08:24,810 --> 00:08:28,250
And that's an actual photo of us doing the assessment right there.

135
00:08:29,170 --> 00:08:31,310
I think that was weekend two.

136
00:08:31,670 --> 00:08:38,790
But yeah, so the important thing is, that was 12.5 hours between two of us, spread over several weekends.

137
00:08:38,790 --> 00:08:42,910
It was not any sort of big commitment for us.

138
00:08:42,910 --> 00:08:45,710
We weren't burning up our weekends or anything like that.

139
00:08:45,710 --> 00:08:49,870
It was, hey, we got a little bit of time, let's send some help.

140
00:08:49,870 --> 00:08:50,790
Full send.

141
00:08:52,670 --> 00:08:55,750
So you can't come to DEF CON without showing the hacks.

142
00:08:56,930 --> 00:09:04,030
As I mentioned earlier, I can't actually show you the real hacks, but we got a mocked up version of the hacks.

143
00:09:04,030 --> 00:09:09,790
As we said, don't disclose anything that the owner isn't comfortable with you disclosing.

144
00:09:09,890 --> 00:09:11,570
We're here to help.

145
00:09:12,190 --> 00:09:18,150
So, I don't know if you know this about hams, we love logs.

146
00:09:19,590 --> 00:09:21,930
Yeah, okay, so that tracks.

147
00:09:22,730 --> 00:09:26,410
So, obviously most websites you can upload your logs.

148
00:09:26,410 --> 00:09:29,530
The other thing we love to do is brag about our logs.

149
00:09:29,530 --> 00:09:34,010
I personally like to do a handwritten log and then later upload it.

150
00:09:34,670 --> 00:09:39,470
So, now I'm looking at someone else's log, which is intended functionality.

151
00:09:40,890 --> 00:09:43,610
Now what happens if I try to upload something to my log?

152
00:09:44,130 --> 00:09:44,930
Next slide.

153
00:09:47,090 --> 00:09:49,530
So, got a flex of the FT5D here.

154
00:09:49,570 --> 00:09:56,030
So, there's my call sign, because it's going to say, hey, it's going to go to my log.

155
00:09:56,350 --> 00:09:58,910
What happens if I just go ahead and change that?

156
00:09:58,910 --> 00:10:01,530
Does anyone remember the vulnerability from earlier?

157
00:10:02,130 --> 00:10:04,690
When you find one, there's usually more.

158
00:10:04,930 --> 00:10:05,810
So, what do we have?

159
00:10:05,810 --> 00:10:07,270
This is an iDoor.

160
00:10:07,510 --> 00:10:08,550
Next slide.

161
00:10:09,450 --> 00:10:11,990
Boom, now I'm uploading to someone else's log.

162
00:10:11,990 --> 00:10:16,210
I just put him into this very interesting person's log.

163
00:10:16,290 --> 00:10:18,590
Not a real call sign, at least I hope not.

164
00:10:19,290 --> 00:10:21,210
Don't know, should have checked.

165
00:10:21,570 --> 00:10:22,790
Next slide.

166
00:10:22,870 --> 00:10:25,530
So, now let's go a little bit further.

167
00:10:25,530 --> 00:10:38,070
Instead of actually just uploading a legitimate log to someone else's log, what if we put a cross-site scripting payload into there?

168
00:10:40,570 --> 00:10:47,310
And now we have stored cross-site scripting with an iDoor on someone else's log.

169
00:10:48,470 --> 00:10:50,870
What can I say?

170
00:10:51,950 --> 00:10:53,810
Ham websites need some help.

171
00:10:53,810 --> 00:10:56,970
If you've got the skills, volunteer.

172
00:10:59,290 --> 00:11:00,210
Next slide.

173
00:11:01,070 --> 00:11:04,970
Now, you may have noticed there was an informational finding.

174
00:11:05,730 --> 00:11:09,810
You know, we had, what, three highs, three mediums, something like that.

175
00:11:09,810 --> 00:11:11,190
But there was one informational finding.

176
00:11:11,190 --> 00:11:13,310
I don't know if you guys know this about me.

177
00:11:13,490 --> 00:11:14,190
Probably not.

178
00:11:14,190 --> 00:11:15,730
I hate TLS findings.

179
00:11:16,570 --> 00:11:18,130
My side of the house hates them.

180
00:11:18,130 --> 00:11:19,310
His side of the house hates them.

181
00:11:19,310 --> 00:11:20,950
Everybody hates TLS findings.

182
00:11:20,950 --> 00:11:23,070
This is not your normal TLS finding.

183
00:11:23,570 --> 00:11:31,190
So, the TLS certificate in use had an annual cost of over $200 for this website.

184
00:11:31,190 --> 00:11:35,610
So , we all know everyone's always asking for donations and donations and donations.

185
00:11:35,610 --> 00:11:37,610
Here's another way that we can make an impact.

186
00:11:37,810 --> 00:11:39,850
That's why we included this.

187
00:11:40,070 --> 00:11:43,510
We recommended that he switches to Let's Encrypt.

188
00:11:43,510 --> 00:11:53,290
But then, we also provided the correct installation instructions for the architecture and infrastructure that was in use.

189
00:11:54,390 --> 00:11:57,670
And that's just a big impact of saving $200 for that website.

190
00:11:57,670 --> 00:12:00,850
That's $200 less in donations that they're going to need.

191
00:12:02,450 --> 00:12:04,190
But, how do you feel about TLS findings?

192
00:12:04,190 --> 00:12:05,210
I also don't like them.

193
00:12:05,210 --> 00:12:06,650
Yeah, everyone hates TLS findings.

194
00:12:06,650 --> 00:12:08,350
I hate fixing them because they come back in a month.

195
00:12:08,350 --> 00:12:10,550
The second you remediate it...

196
00:12:10,550 --> 00:12:11,010
They're bad.

197
00:12:11,010 --> 00:12:12,550
There's another bad cipher.

198
00:12:13,430 --> 00:12:21,010
So, this got us thinking about, alright, so this one website's like this.

199
00:12:21,010 --> 00:12:21,930
How prevalent is this?

200
00:12:21,930 --> 00:12:25,450
How common are these kind of things across amateur radio websites?

201
00:12:25,750 --> 00:12:27,510
So, we did some research.

202
00:12:28,550 --> 00:12:32,670
Turns out, it's a pretty common kind of thing going on.

203
00:12:33,310 --> 00:12:38,550
So, 40% of them we found had what we considered to be an excessive number of services open.

204
00:12:38,550 --> 00:12:40,530
In many cases, what seemed to be unnecessary.

205
00:12:40,530 --> 00:12:47,450
Things like FTP, DNS, RPC, RDP, R-SQL, I mean MySQL.

206
00:12:48,710 --> 00:12:53,450
If your SQL server is exposed to the internet, it's not MySQL no more.

207
00:12:53,510 --> 00:12:54,810
It's R-SQL.

208
00:12:55,570 --> 00:12:58,510
You know, banner grab suggesting versioning was often behind.

209
00:12:58,510 --> 00:13:00,830
There's caveats around the accuracy of banners, right?

210
00:13:00,830 --> 00:13:06,690
But, it's still pointed to a pattern of, hey, there's probably some patching that we're deficient on here.

211
00:13:06,690 --> 00:13:12,770
And then, just seeing a SQL server on there is telling you that you have a database function running on a web server.

212
00:13:14,830 --> 00:13:17,030
So, what can we do about it?

213
00:13:18,290 --> 00:13:27,410
If we look at the Venn diagram over here, we can see there's a large overlap between InfoSec enthusiasts and licensed amateurs, right?

214
00:13:27,610 --> 00:13:31,390
That intersection point in the middle is why we have a ham radio village at DEF CON.

215
00:13:31,390 --> 00:13:35,010
So, that's basically you, right there.

216
00:13:35,010 --> 00:13:41,970
So , if we were able to do this, why can't other hams in InfoSec do the same thing, right?

217
00:13:42,570 --> 00:13:48,750
You know, verifiable identification can go a long ways, right, towards establishing trust.

218
00:13:48,850 --> 00:13:53,910
Call sign happens to be a very easily identifiable and verifiable piece of information that we all have.

219
00:13:54,390 --> 00:13:59,630
You know, many of these sites are being run by hams as a DIY side quest, right?

220
00:13:59,630 --> 00:14:02,450
They're just trying to make a little piece of the hobby work.

221
00:14:02,950 --> 00:14:04,810
They need all the help they can get.

222
00:14:05,030 --> 00:14:16,390
So, what we're advocating is to reach out to the sites that we care about and that we use, identify yourself as a ham, provide your call sign, and request permission to utilize your skills in whatever way they need.

223
00:14:18,310 --> 00:14:24,510
So, to that end, put together some kind of simple general guidelines on how to start, right?

224
00:14:24,510 --> 00:14:26,290
Keep this simple, right?

225
00:14:26,290 --> 00:14:28,430
Get permission from the site owner.

226
00:14:29,630 --> 00:14:34,790
We don't want to be, you know, pushing on stuff that isn't necessarily what they're looking for.

227
00:14:34,790 --> 00:14:38,730
Don't go looking for a vulnerability before you get permission.

228
00:14:38,970 --> 00:14:43,810
I happened to accidentally stumble upon one, and that's what led to this.

229
00:14:43,810 --> 00:14:46,890
But don't start looking until you get, like, permission.

230
00:14:47,590 --> 00:14:50,510
So, FriendDA is kind of the name of the game here, right?

231
00:14:50,790 --> 00:14:54,650
Honor the scope and constraints that you agreed to originally, right?

232
00:14:55,050 --> 00:14:56,910
Because there's still no legal protections here.

233
00:14:56,910 --> 00:14:59,250
We still have the CFAA in force.

234
00:14:59,750 --> 00:15:01,710
You know, avoid the destructive testing.

235
00:15:01,970 --> 00:15:02,510
It's fraud.

236
00:15:02,510 --> 00:15:03,150
It's fraud.

237
00:15:03,150 --> 00:15:04,030
It's fraud.

238
00:15:04,070 --> 00:15:07,230
And, you know, don't disclose the stuff you've been asked to keep private, right?

239
00:15:07,650 --> 00:15:11,030
We've built trust around our call sign, so let's keep that trust going.

240
00:15:12,310 --> 00:15:17,590
So, really trying, too, to focus on identifying issues and recommending solutions, right?

241
00:15:17,590 --> 00:15:19,730
We're just trying to start at a ground floor here.

242
00:15:20,390 --> 00:15:26,270
You know, offer to help with fixing if you're inclined, but really we're looking at remediation as the bonus.

243
00:15:26,270 --> 00:15:30,950
We just want to identify the problem so that they can figure out where they need to go next with it, right?

244
00:15:30,950 --> 00:15:34,710
Many sites are going to have limited resources to be able to actually remediate things.

245
00:15:35,110 --> 00:15:38,770
We're really trying to position this in the spirit of amateur radio licensing.

246
00:15:39,490 --> 00:15:41,650
How we conduct ourselves, right?

247
00:15:41,830 --> 00:15:45,390
Really fostering a collaborative dialogue instead of an adversarial one.

248
00:15:46,630 --> 00:15:50,050
So, going along with that, it's important we've got to know our limits, right?

249
00:15:50,590 --> 00:15:53,610
We're trying to help, not create more stress for the site owners.

250
00:15:54,170 --> 00:15:56,810
So, the key there is to stick to what you know, right?

251
00:15:57,030 --> 00:16:00,750
Everything here, we've got to be treating like prod under SLA, right?

252
00:16:00,750 --> 00:16:01,730
Because it is prod.

253
00:16:03,150 --> 00:16:03,830
Yeah.

254
00:16:05,490 --> 00:16:08,170
Probably not the place to try out your new techniques, right?

255
00:16:08,170 --> 00:16:12,710
Work on those in your lab and then come back later and do the things that are familiar to you, right?

256
00:16:12,710 --> 00:16:16,290
You know, probably skip a little bit of Ion Cannon here as well.

257
00:16:16,430 --> 00:16:18,090
Likewise, knowing when to stop, right?

258
00:16:18,090 --> 00:16:28,870
There's a very big difference between pulling a random exploit from ExploitDB and reading a banner and looking at the version and looking at vulnerabilities that apply to that one.

259
00:16:29,070 --> 00:16:34,630
Because, again, it's really not hard to get in trouble with the CFAA if you're kind of going outside the bounds.

260
00:16:35,490 --> 00:16:37,970
Because there's no legal protections and it's prod.

261
00:16:38,830 --> 00:16:45,710
So, kind of going back to those common themes before and some examples of ideas we can give as recommendations, right?

262
00:16:45,910 --> 00:16:50,430
Limiting attack surface, turning on a firewall, shutting down services you don't need, right?

263
00:16:50,730 --> 00:16:52,910
Segmenting those logical functions out.

264
00:16:53,130 --> 00:16:56,810
Just getting those databases down into a database tier away from the DMZ.

265
00:16:56,930 --> 00:16:58,710
Patching systems, right?

266
00:16:58,710 --> 00:17:00,670
Like, even the app stuff, right?

267
00:17:00,670 --> 00:17:02,610
Use the OLAF Secure Coding Guide.

268
00:17:02,610 --> 00:17:06,370
Applying OLAF, this is all pretty basic stuff to a lot of the industry.

269
00:17:06,370 --> 00:17:11,550
But for HAMS, it appears to maybe be an area we can go back and kind of get back to the basics of.

270
00:17:11,550 --> 00:17:17,510
Because it's a hobbyist thing and while they... they're running as a DIY side quest, basically.

271
00:17:17,510 --> 00:17:20,010
And they need help.

272
00:17:20,470 --> 00:17:23,770
So who can help?

273
00:17:23,790 --> 00:17:26,390
Cool thing is there's something for everybody, right?

274
00:17:26,390 --> 00:17:30,370
As we thought about this, pen testers can go looking for vulns like they usually do.

275
00:17:30,370 --> 00:17:31,770
Usually breaking stuff.

276
00:17:31,770 --> 00:17:33,050
Try not to do that here.

277
00:17:33,390 --> 00:17:34,210
App dev, right?

278
00:17:34,210 --> 00:17:39,310
Look for OLAF's top 10 or even just get more involved in some of the open source projects in the HAM community.

279
00:17:39,970 --> 00:17:42,310
General tech, they're going to need help with remediation.

280
00:17:42,310 --> 00:17:44,290
They need to understand how infrastructure works.

281
00:17:44,490 --> 00:17:46,990
How best to apply some of this stuff, right?

282
00:17:47,110 --> 00:17:48,610
Even somebody in audit, right?

283
00:17:48,650 --> 00:17:52,470
Is going to be able to map against one of the common frameworks that are out there.

284
00:17:52,470 --> 00:18:01,270
And the great thing is, if you're new to IT, some of this makes for very good ways to get bullet points for the resume.

285
00:18:02,050 --> 00:18:03,170
Hey!

286
00:18:03,250 --> 00:18:11,010
I mean, like, if I see a bunch of accepted pull requests on your GitHub, I'm saying that's pretty impressive.

287
00:18:11,490 --> 00:18:13,330
It helps, yeah.

288
00:18:13,570 --> 00:18:17,770
So, we're really just trying to start a conversation here, right?

289
00:18:17,770 --> 00:18:19,890
We've obviously identified a need.

290
00:18:19,890 --> 00:18:24,170
But beyond that, this is still a relatively fresh idea, right?

291
00:18:24,530 --> 00:18:27,530
You know, some things we're kind of noodling on yet.

292
00:18:27,530 --> 00:18:30,190
How do you handle the sites that don't want help, right?

293
00:18:30,190 --> 00:18:33,770
And the ones that are unmotivated or not really looking for help, right?

294
00:18:34,030 --> 00:18:39,330
As we think about where the industry was 20 years ago with responsible disclosure on its own.

295
00:18:39,330 --> 00:18:42,810
I say just pass on them and just help someone that wants help.

296
00:18:43,050 --> 00:18:46,730
And we can circle back to the difficult ones later.

297
00:18:47,430 --> 00:18:52,610
Yeah, I mean, should your kind of standard responsible disclosure timelines even apply here?

298
00:18:52,750 --> 00:18:56,210
Is the data on these sites even important enough to warrant it?

299
00:18:56,310 --> 00:19:02,570
I have my opinions at an ethical level, but I think that's a broader question than just what I think.

300
00:19:02,570 --> 00:19:09,630
And then as someone from my side of the house, if you find something that's critical, you're going to have to push it.

301
00:19:09,630 --> 00:19:14,470
But I don't believe we're going to find too many critical things that are that bad.

302
00:19:14,470 --> 00:19:20,790
And we really should just don't go adversarial, keep it as a collaborative thing.

303
00:19:20,790 --> 00:19:22,550
But that's my opinion.

304
00:19:22,550 --> 00:19:25,630
But this is going to have to be a discussion we all have someday.

305
00:19:26,330 --> 00:19:35,610
So kind of looking down the road, some other areas we're interested in trying to dig a little deeper into, too, is seeing if we can carve out some legal perspective for this, right?

306
00:19:35,610 --> 00:19:39,430
And finding some ways to make this a little bit easier, right?

307
00:19:39,430 --> 00:19:46,350
Some kind of sow-like paper trail would be really beneficial for being able to say, this is what we're up to, here's what we're doing, right?

308
00:19:47,310 --> 00:19:50,690
So if there's any attorneys out here, love to hear from you.

309
00:19:50,690 --> 00:19:51,910
Got any ideas?

310
00:19:52,270 --> 00:19:54,250
An attorney that has a license.

311
00:19:56,750 --> 00:19:58,730
You know the idea of a bug bounty, right?

312
00:19:58,890 --> 00:20:02,450
We kind of got to stay away from money when it comes to amateur radio.

313
00:20:03,090 --> 00:20:05,630
But people love to chase paper.

314
00:20:05,750 --> 00:20:08,990
Is there some kind of thing that can get tied into that, right?

315
00:20:08,990 --> 00:20:12,090
With how we look at bug bounties normally operating.

316
00:20:12,390 --> 00:20:13,730
Found all bones.

317
00:20:18,010 --> 00:20:20,890
Develop a community source testing methodology as well, right?

318
00:20:20,890 --> 00:20:25,230
Kind of come up with, here are the ten things that the hobby should be looking for, right?

319
00:20:25,450 --> 00:20:30,710
You know, standardized community reporting templates, any other supporting reference material we want to come up with.

320
00:20:31,430 --> 00:20:33,670
So it's kind of a wide open thing, right?

321
00:20:34,490 --> 00:20:39,030
It's a thing we kind of stumbled into and curious what the rest of the hobby thinks.

322
00:20:39,030 --> 00:20:40,910
Well that's the thing, hams help hams.

323
00:20:40,970 --> 00:20:45,810
So there's a couple of our references.

324
00:20:48,490 --> 00:20:50,150
Contact info for us.

325
00:20:50,750 --> 00:20:53,730
And we'll put these slides up on github here in a little bit.

326
00:20:54,110 --> 00:20:58,710
At least you can find us on QRZ and our proton addresses there.

327
00:20:58,890 --> 00:21:01,010
Yeah, I guess I'll update my QRZ.

328
00:21:02,390 --> 00:21:02,990
But...

329
00:21:04,950 --> 00:21:21,690
So I'd like to, first and foremost, I'd like to thank a very special ham radio website owner who I cannot name because we decided together that we couldn't actually name them yet.

330
00:21:21,730 --> 00:21:24,810
But thank you very much, you know who you are.

331
00:21:25,070 --> 00:21:26,650
So thank you.

332
00:21:27,210 --> 00:21:28,850
I really wish I could.

333
00:21:28,850 --> 00:21:30,030
But you know, I just can't.

334
00:21:30,030 --> 00:21:33,090
But anyhow, it was wonderful.

335
00:21:33,090 --> 00:21:35,110
Thank you to the ham radio village for having us.

336
00:21:35,110 --> 00:21:36,730
Thank you for everyone who came up.

337
00:21:36,730 --> 00:21:39,210
Big thank you for Ferris for coming and filming.

338
00:21:39,210 --> 00:21:39,970
Thank you.

339
00:21:42,730 --> 00:21:45,510
We'll be around for questions if there's any after.

340
00:21:46,790 --> 00:21:48,850
Come on, give a shout out to your daughters.

341
00:21:48,850 --> 00:21:50,350
Come on.

342
00:21:55,410 --> 00:22:00,930
Oh, and if Kenwood wants to send us a 75 to test out for security.