start	end	text
13650	21430	At this point, I'd like to welcome Dan and Lucas to present, My Call Sign is My Passport.
25610	32110	Thank you, thank you. So, thank you everyone for coming to our talk. My Call Sign is My
32110	36730	Passport, Responsible for Testing and Disclosure of Ham Radio Websites.
38230	44870	So, I'm Dan Nort. I'm a Senior Security Consultant at NetSpy. I've got three years of experience,
45090	50170	a little over three years of experience doing web application penetration testing, X-PEN,
50170	61450	Cloud-PEN, API-PEN, so a wide skill set there. I've been licensed for six years and I now
61450	64510	have my amateur extra as of May, so.
66750	72330	All right, I'm Lucas Scaler. Ten years in InfoSec, did some digital forensics, sensor
72330	78130	response, pen testing, phone management, now I run a security operations team. Licensed
78130	81270	for 14 years, amateur... what is up with it?
81270	82210	It's a bad one.
82210	82650	Yeah.
82650	84250	Yeah, it's a little jiggly.
84410	86170	We don't want to talk about wires here.
86330	89830	No. Maybe we'll just skip the mic.
89850	90710	Yeah, skip the mic.
90710	96890	Yeah, all right, we'll talk loudly. Yeah, so licensed for 14 years, now amateur extra,
96890	105070	GLARD V. So start off with the usual disclaimer. Dan and I are doing this on our own volition.
105070	111850	It's not anything from our employers. And there is some propensity for getting in trouble
111850	116350	if you were to do some of this, so don't necessarily do what we did. Be careful if you decide to.
116470	118350	It's not our responsibility if you do.
119870	122170	This is how we pota in Minnesota.
124930	130270	We're out on a frozen lake, it's zero degrees out, and miserable fun is what we like to do.
130270	132230	Miserable fun is the best fun.
133090	140310	And if you have an FCDX10 and you like the little protection rails, it's on Thingiverse, he designed them.
143670	146110	So this is actually my home QTH.
147810	151890	I'm technically portable during the summer. I go and I set up in the backyard.
153130	154390	This is how I operate.
154390	160410	Well, last year I wanted to be able to operate inside during the winter, because as you saw from our pota slide,
160410	163110	in Minnesota it gets cold. I don't know if you guys know that.
164590	169670	So Lucas came over, helped me install a ground rod, we got everything grounded, bonded,
169670	174050	everything's done right, but that's what hams do. Hams help hams.
175010	179870	And the water bottle trick in order to put a ground rod works great.
181610	182670	Five minutes?
182670	183390	Five minutes.
183390	184510	It was amazing.
186170	189070	So, how this all started.
189430	191730	I accidentally found a vulnerability.
193130	196170	I don't know if you guys know this about me, I'm kind of lazy.
196250	198970	So I happen to be on my favorite ham radio website.
198970	201370	Listening to the radio in the backyard.
201710	203790	And I hear an interesting call sign.
205110	207730	I'm not going to use the search bar, I'm lazy.
207870	210830	So my call sign was already in the URL.
211170	217410	So I went ahead and just typed in the interesting call sign in the URL.
218610	219950	Next slide.
223010	229730	Now, this is what we call an insecure direct object reference, or IDOR for short.
230890	233970	It seemed like there was some sensitive information.
233970	238550	By the way, all these slides are completely faked because we'll go into that later.
239010	245790	But it seemed like there was some sensitive information here that I should not be able to see on someone else's profile.
247690	248870	And that's why it was an IDOR.
248870	251930	Now I wasn't sure if it was an IDOR or if this was intended functionality.
252830	254970	Now we get to kind of the big problem.
255430	256370	What do we do?
256370	259750	So here's the problem with trying to disclose something.
260810	265230	There are many incidences of where it did not go well for the person trying to disclose it.
265230	267030	Someone trying to do the right thing.
267150	272750	And him and I went back and forth on this for quite a bit before we decided what is the right thing to do in this case.
272750	279290	There was the F12 incidents where, hey, you use dev tools, the governor now says, you're a hacker.
279430	282430	And it's like, well, if he's a hacker, I want to hire him.
282710	285310	But there's other cases.
285310	288510	Four students arrested for disclosing a vulnerability.
288510	291790	And they were strip searched for disclosing a vulnerability.
291790	292990	That's how bad it goes.
292990	301410	And when I was looking for these things, it turns out I actually found like an open source project that is tracking this sort of like occurrences.
301410	306910	And the fact that there needs to be a project of that scale tells you just how bad of a problem this is.
307030	308410	And so it's like, what do you do?
308410	311010	Do you do the right thing and disclose?
311730	315290	Or do you just say, yeah, it's not my problem?
315510	316610	Well, we're hams.
317430	318690	So it's Dan.
318690	320290	So of course, he's going to full send.
320290	321570	And it's me, I'm going to full send.
321570	323630	A disclosure to the site owner.
323630	329350	So at this point, I emailed the site owner asking him, hey, is this intended functionality?
330030	334710	Here is seven steps to replicate this exact behavior.
338730	341610	But hey, everything turned out okay.
341790	343590	He confirmed it was a problem.
343590	345210	Was very, very grateful.
345550	348070	Remediated it within just a few days.
348070	351010	And then asked me to validate that it was actually fixed.
351550	353450	Can't get better than that, right?
353450	355310	Didn't go to jail, didn't get strip searched.
356430	361970	Now, we were wondering, hey, why did this go so well for me?
362790	365930	Obviously, the professional reporting, I write pen test reports all the time.
365930	368070	So it's kind of like within my wheelhouse.
368650	373550	I believe it might have been because I asked, hey, is this actually a problem?
374490	376610	Because I didn't want to assume anything.
376610	382950	But the thing that him and I identified, we think, was why it went okay.
382950	385370	Because we were licensed, or I was licensed.
385430	388150	And so, he comes in later on this.
388150	389950	I was licensed, and so it was...
390650	394530	The license kind of like gives you a little bit of trust with other hands.
394530	398270	Because, I mean, hey, we all care about the call signs.
399830	401730	Ending in Lima, come back, you know?
401730	403110	We've all been there.
403110	407430	So this is great.
407430	415550	We helped, at this point, we helped one of my favorite ham radio websites.
415670	417970	And we improved their security posture.
417970	422370	And we got rid of a vulnerability that actually would impact other users and their data.
422370	424810	It wasn't extremely sensitive.
424890	429530	But it was still things that I felt were like, people shouldn't be able to see that.
430890	433630	But we wanted to be able to do more, too.
433830	435730	So Dan and I talked about it a little bit.
435730	440870	We decided to approach the owner again and say, hey, what if we do a full assessment of your site?
440950	444470	Let's look around for other stuff beyond just what we've stumbled on.
445190	447230	We're hams. Here's our call signs.
447490	449350	Here's what we're thinking for a scope.
449350	451410	We're going to do manual testing only.
451410	454670	We're going to keep within these certain testing windows.
455190	457570	We're going to not do destructive testing.
457870	460190	We're going to provide a report back with the findings.
460490	463510	We're going to not disclose specifics prior to remediation.
463510	467570	And we're going to de-conflict by, here's the IP addresses we're coming from.
467570	469290	Here's the testing windows. We're going to do it.
469690	475010	So this way, if anything went wrong, he at least can go like, oh, it wasn't actually them that caused that problem.
475010	479030	Because it's like, hey, here's our de-confliction.
480210	483550	But yes, absolutely no scanning. It's prod.
483970	485110	It's prod.
485230	487430	So he was 100% on board.
487430	490130	He was very excited to get some more attention on it.
490130	497950	So in summary, what we ended up finding, six high vulnerabilities, three mediums, three lows, and one informational.
498130	501250	And this was done over a little more than 12 hours of time.
501450	504250	Spread out over a couple weekends, an hour here and there.
504810	508250	And that's an actual photo of us doing the assessment right there.
509170	511310	I think that was weekend two.
511670	518790	But yeah, so the important thing is, that was 12.5 hours between two of us, spread over several weekends.
518790	522910	It was not any sort of big commitment for us.
522910	525710	We weren't burning up our weekends or anything like that.
525710	529870	It was, hey, we got a little bit of time, let's send some help.
529870	530790	Full send.
532670	535750	So you can't come to DEF CON without showing the hacks.
536930	544030	As I mentioned earlier, I can't actually show you the real hacks, but we got a mocked up version of the hacks.
544030	549790	As we said, don't disclose anything that the owner isn't comfortable with you disclosing.
549890	551570	We're here to help.
552190	558150	So, I don't know if you know this about hams, we love logs.
559590	561930	Yeah, okay, so that tracks.
562730	566410	So, obviously most websites you can upload your logs.
566410	569530	The other thing we love to do is brag about our logs.
569530	574010	I personally like to do a handwritten log and then later upload it.
574670	579470	So, now I'm looking at someone else's log, which is intended functionality.
580890	583610	Now what happens if I try to upload something to my log?
584130	584930	Next slide.
587090	589530	So, got a flex of the FT5D here.
589570	596030	So, there's my call sign, because it's going to say, hey, it's going to go to my log.
596350	598910	What happens if I just go ahead and change that?
598910	601530	Does anyone remember the vulnerability from earlier?
602130	604690	When you find one, there's usually more.
604930	607270	So, what do we have? This is an iDoor.
607510	608550	Next slide.
609450	611990	Boom, now I'm uploading to someone else's log.
611990	616210	I just put him into this very interesting person's log.
616290	618590	Not a real call sign, at least I hope not.
619290	621210	Don't know, should have checked.
621570	622790	Next slide.
622870	625530	So, now let's go a little bit further.
625530	632890	Instead of actually just uploading a legitimate log to someone else's log,
633180	638070	what if we put a cross-site scripting payload into there?
640570	647310	And now we have stored cross-site scripting with an iDoor on someone else's log.
648470	650870	What can I say?
651950	653810	Ham websites need some help.
653810	656970	If you've got the skills, volunteer.
659290	660210	Next slide.
661070	664970	Now, you may have noticed there was an informational finding.
665730	669810	You know, we had, what, three highs, three mediums, something like that.
669810	671190	But there was one informational finding.
671190	673310	I don't know if you guys know this about me.
673490	674190	Probably not.
674190	675730	I hate TLS findings.
676570	678130	My side of the house hates them.
678130	679310	His side of the house hates them.
679310	680950	Everybody hates TLS findings.
680950	683070	This is not your normal TLS finding.
683570	691190	So, the TLS certificate in use had an annual cost of over $200 for this website.
691190	695610	So, we all know everyone's always asking for donations and donations and donations.
695610	697610	Here's another way that we can make an impact.
697810	699850	That's why we included this.
700070	703510	We recommended that he switches to Let's Encrypt.
703510	713290	But then, we also provided the correct installation instructions for the architecture and infrastructure that was in use.
714390	717670	And that's just a big impact of saving $200 for that website.
717670	720850	That's $200 less in donations that they're going to need.
722450	724190	But, how do you feel about TLS findings?
724190	725210	I also don't like them.
725210	726650	Yeah, everyone hates TLS findings.
726650	728350	I hate fixing them because they come back in a month.
728350	730550	The second you remediate it...
730550	731010	They're bad.
731010	732550	There's another bad cipher.
733430	741010	So, this got us thinking about, alright, so this one website's like this.
741010	741930	How prevalent is this?
741930	745450	How common are these kind of things across amateur radio websites?
745750	747510	So, we did some research.
748550	752670	Turns out, it's a pretty common kind of thing going on.
753310	758550	So, 40% of them we found had what we considered to be an excessive number of services open.
758550	760530	In many cases, what seemed to be unnecessary.
760530	767450	Things like FTP, DNS, RPC, RDP, R-SQL, I mean MySQL.
768710	773450	If your SQL server is exposed to the internet, it's not MySQL no more.
773510	774810	It's R-SQL.
775570	778510	You know, banner grab suggesting versioning was often behind.
778510	780830	There's caveats around the accuracy of banners, right?
780830	786690	But, it's still pointed to a pattern of, hey, there's probably some patching that we're deficient on here.
786690	792770	And then, just seeing a SQL server on there is telling you that you have a database function running on a web server.
794830	797030	So, what can we do about it?
798290	807410	If we look at the Venn diagram over here, we can see there's a large overlap between InfoSec enthusiasts and licensed amateurs, right?
807610	811390	That intersection point in the middle is why we have a ham radio village at DEF CON.
811390	815010	So, that's basically you, right there.
815010	821970	So, if we were able to do this, why can't other hams in InfoSec do the same thing, right?
822570	828750	You know, verifiable identification can go a long ways, right, towards establishing trust.
828850	833910	Call sign happens to be a very easily identifiable and verifiable piece of information that we all have.
834390	839630	You know, many of these sites are being run by hams as a DIY side quest, right?
839630	842450	They're just trying to make a little piece of the hobby work.
842950	844810	They need all the help they can get.
845030	851670	So, what we're advocating is to reach out to the sites that we care about and that we use, identify yourself as a ham,
851670	856390	provide your call sign, and request permission to utilize your skills in whatever way they need.
858310	864510	So, to that end, put together some kind of simple general guidelines on how to start, right?
864510	866290	Keep this simple, right?
866290	868430	Get permission from the site owner.
869630	874790	We don't want to be, you know, pushing on stuff that isn't necessarily what they're looking for.
874790	878730	Don't go looking for a vulnerability before you get permission.
878970	883810	I happened to accidentally stumble upon one, and that's what led to this.
883810	886890	But don't start looking until you get, like, permission.
887590	890510	So, FriendDA is kind of the name of the game here, right?
890790	894650	Honor the scope and constraints that you agreed to originally, right?
895050	899250	Because there's still no legal protections here. We still have the CFAA in force.
899750	901710	You know, avoid the destructive testing.
901970	904030	It's fraud. It's fraud. It's fraud.
904070	907230	And, you know, don't disclose the stuff you've been asked to keep private, right?
907650	911030	We've built trust around our call sign, so let's keep that trust going.
912310	917590	So, really trying, too, to focus on identifying issues and recommending solutions, right?
917590	919730	We're just trying to start at a ground floor here.
920390	926270	You know, offer to help with fixing if you're inclined, but really we're looking at remediation as the bonus.
926270	930950	We just want to identify the problem so that they can figure out where they need to go next with it, right?
930950	934710	Many sites are going to have limited resources to be able to actually remediate things.
935110	938770	We're really trying to position this in the spirit of amateur radio licensing.
939490	941650	How we conduct ourselves, right?
941830	945390	Really fostering a collaborative dialogue instead of an adversarial one.
946630	950050	So, going along with that, it's important we've got to know our limits, right?
950590	953610	We're trying to help, not create more stress for the site owners.
954170	956810	So, the key there is to stick to what you know, right?
957030	960750	Everything here, we've got to be treating like prod under SLA, right?
960750	961730	Because it is prod.
963150	963830	Yeah.
965490	968170	Probably not the place to try out your new techniques, right?
968170	972710	Work on those in your lab and then come back later and do the things that are familiar to you, right?
972710	976290	You know, probably skip a little bit of Ion Cannon here as well.
976430	978090	Likewise, knowing when to stop, right?
978090	981970	There's a very big difference between pulling a random exploit from ExploitDB
982510	988870	and reading a banner and looking at the version and looking at vulnerabilities that apply to that one.
989070	994630	Because, again, it's really not hard to get in trouble with the CFAA if you're kind of going outside the bounds.
995490	997970	Because there's no legal protections and it's prod.
998830	1005710	So, kind of going back to those common themes before and some examples of ideas we can give as recommendations, right?
1005910	1010430	Limiting attack surface, turning on a firewall, shutting down services you don't need, right?
1010730	1012910	Segmenting those logical functions out.
1013130	1016810	Just getting those databases down into a database tier away from the DMZ.
1016930	1018710	Patching systems, right?
1018710	1020670	Like, even the app stuff, right?
1020670	1022610	Use the OLAF Secure Coding Guide.
1022610	1026370	Applying OLAF, this is all pretty basic stuff to a lot of the industry.
1026370	1031550	But for HAMS, it appears to maybe be an area we can go back and kind of get back to the basics of.
1031550	1037510	Because it's a hobbyist thing and while they... they're running as a DIY side quest, basically.
1037510	1040010	And they need help.
1040470	1043770	So who can help?
1043790	1046390	Cool thing is there's something for everybody, right?
1046390	1050370	As we thought about this, pen testers can go looking for vulns like they usually do.
1050370	1053050	Usually breaking stuff. Try not to do that here.
1053390	1059310	App dev, right? Look for OLAF's top 10 or even just get more involved in some of the open source projects in the HAM community.
1059970	1062310	General tech, they're going to need help with remediation.
1062310	1064290	They need to understand how infrastructure works.
1064490	1066990	How best to apply some of this stuff, right?
1067110	1068610	Even somebody in audit, right?
1068650	1072470	Is going to be able to map against one of the common frameworks that are out there.
1072470	1081270	And the great thing is, if you're new to IT, some of this makes for very good ways to get bullet points for the resume.
1082050	1091010	Hey! I mean, like, if I see a bunch of accepted pull requests on your GitHub, I'm saying that's pretty impressive.
1091490	1093330	It helps, yeah.
1093570	1097770	So, we're really just trying to start a conversation here, right?
1097770	1099890	We've obviously identified a need.
1099890	1104170	But beyond that, this is still a relatively fresh idea, right?
1104530	1107530	You know, some things we're kind of noodling on yet.
1107530	1110190	How do you handle the sites that don't want help, right?
1110190	1113770	And the ones that are unmotivated or not really looking for help, right?
1114030	1119330	As we think about where the industry was 20 years ago with responsible disclosure on its own.
1119330	1122810	I say just pass on them and just help someone that wants help.
1123050	1126730	And we can circle back to the difficult ones later.
1127430	1132610	Yeah, I mean, should your kind of standard responsible disclosure timelines even apply here?
1132750	1136210	Is the data on these sites even important enough to warrant it?
1136310	1142570	I have my opinions at an ethical level, but I think that's a broader question than just what I think.
1142570	1149630	And then as someone from my side of the house, if you find something that's critical, you're going to have to push it.
1149630	1154470	But I don't believe we're going to find too many critical things that are that bad.
1154470	1160790	And we really should just don't go adversarial, keep it as a collaborative thing.
1160790	1165630	But that's my opinion. But this is going to have to be a discussion we all have someday.
1166330	1172150	So kind of looking down the road, some other areas we're interested in trying to dig a little deeper into, too,
1172150	1175610	is seeing if we can carve out some legal perspective for this, right?
1175610	1179430	And finding some ways to make this a little bit easier, right?
1179430	1183470	Some kind of sow-like paper trail would be really beneficial for being able to say,
1183470	1186350	this is what we're up to, here's what we're doing, right?
1187310	1191910	So if there's any attorneys out here, love to hear from you. Got any ideas?
1192270	1194250	An attorney that has a license.
1196750	1202450	You know the idea of a bug bounty, right? We kind of got to stay away from money when it comes to amateur radio.
1203090	1208990	But people love to chase paper. Is there some kind of thing that can get tied into that, right?
1208990	1212090	With how we look at bug bounties normally operating.
1212390	1213730	Found all bones.
1218010	1220890	Develop a community source testing methodology as well, right?
1220890	1225230	Kind of come up with, here are the ten things that the hobby should be looking for, right?
1225450	1230710	You know, standardized community reporting templates, any other supporting reference material we want to come up with.
1231430	1233670	So it's kind of a wide open thing, right?
1234490	1239030	It's a thing we kind of stumbled into and curious what the rest of the hobby thinks.
1239030	1240910	Well that's the thing, hams help hams.
1240970	1245810	So there's a couple of our references.
1248490	1250150	Contact info for us.
1250750	1253730	And we'll put these slides up on github here in a little bit.
1254110	1258710	At least you can find us on QRZ and our proton addresses there.
1258890	1261010	Yeah, I guess I'll update my QRZ.
1262390	1262990	But...
1264950	1269230	So I'd like to, first and foremost, I'd like to thank
1269350	1273430	a very special ham radio website owner who I cannot name
1273430	1276270	because we decided
1277010	1281690	together that we couldn't actually name them yet.
1281730	1284810	But thank you very much, you know who you are.
1285070	1288850	So thank you. I really wish I could.
1288850	1293090	But you know, I just can't. But anyhow, it was wonderful.
1293090	1296730	Thank you to the ham radio village for having us. Thank you for everyone who came up.
1296730	1299970	Big thank you for Ferris for coming and filming. Thank you.
1302730	1305510	We'll be around for questions if there's any after.
1306790	1308850	Come on, give a shout out to your daughters.
1308850	1310350	Come on.
1315410	1316830	Oh, and if Kenwood
1316830	1320930	wants to send us a 75 to test out for security.