WEBVTT 00:13.650 --> 00:21.430 At this point, I'd like to welcome Dan and Lucas to present, My Call Sign is My Passport. 00:25.610 --> 00:27.490 Thank you, thank you. 00:27.610 --> 00:30.790 So, thank you everyone for coming to our talk. 00:30.870 --> 00:36.730 My Call Sign is My Passport, Responsible for Testing and Disclosure of Ham Radio Websites. 00:38.230 --> 00:39.650 So, I'm Dan Nort. 00:39.890 --> 00:42.630 I'm a Senior Security Consultant at NetSpy. 00:42.630 --> 00:54.970 I've got three years of experience, a little over three years of experience doing web application penetration testing, X-PEN, Cloud-PEN, API-PEN, so a wide skill set there. 00:55.030 --> 01:04.510 I've been licensed for six years and I now have my amateur extra as of May, so. 01:06.750 --> 01:08.290 All right, I'm Lucas Scaler. 01:08.350 --> 01:17.330 Ten years in InfoSec, did some digital forensics, sensor response, pen testing, phone management, now I run a security operations team. 01:17.730 --> 01:21.270 Licensed for 14 years, amateur... what is up with it? 01:21.270 --> 01:22.210 It's a bad one. 01:22.210 --> 01:22.650 Yeah. 01:22.650 --> 01:24.250 Yeah, it's a little jiggly. 01:24.410 --> 01:26.170 We don't want to talk about wires here. 01:26.330 --> 01:27.130 No. 01:28.350 --> 01:29.830 Maybe we'll just skip the mic. 01:29.850 --> 01:30.710 Yeah, skip the mic. 01:30.710 --> 01:32.230 Yeah, all right, we'll talk loudly. 01:33.330 --> 01:38.030 Yeah, so licensed for 14 years, now amateur extra, GLARD V. 01:39.710 --> 01:41.830 So start off with the usual disclaimer. 01:42.590 --> 01:45.070 Dan and I are doing this on our own volition. 01:45.070 --> 01:47.150 It's not anything from our employers. 01:47.510 --> 01:54.670 And there is some propensity for getting in trouble if you were to do some of this, so don't necessarily do what we did. 01:54.670 --> 01:56.350 Be careful if you decide to. 01:56.470 --> 01:58.350 It's not our responsibility if you do. 01:59.870 --> 02:02.170 This is how we pota in Minnesota. 02:04.930 --> 02:10.270 We're out on a frozen lake, it's zero degrees out, and miserable fun is what we like to do. 02:10.270 --> 02:12.230 Miserable fun is the best fun. 02:13.090 --> 02:20.310 And if you have an FCDX10 and you like the little protection rails, it's on Thingiverse, he designed them. 02:23.670 --> 02:26.110 So this is actually my home QTH. 02:27.810 --> 02:30.050 I'm technically portable during the summer. 02:30.050 --> 02:31.890 I go and I set up in the backyard. 02:33.130 --> 02:34.390 This is how I operate. 02:34.390 --> 02:41.530 Well, last year I wanted to be able to operate inside during the winter, because as you saw from our pota slide, in Minnesota it gets cold. 02:41.530 --> 02:43.110 I don't know if you guys know that. 02:44.590 --> 02:52.590 So Lucas came over, helped me install a ground rod, we got everything grounded, bonded, everything's done right, but that's what hams do. 02:52.590 --> 02:54.050 Hams help hams. 02:55.010 --> 02:59.870 And the water bottle trick in order to put a ground rod works great. 03:01.610 --> 03:02.670 Five minutes? 03:02.670 --> 03:03.390 Five minutes. 03:03.390 --> 03:04.510 It was amazing. 03:06.170 --> 03:09.070 So, how this all started. 03:09.430 --> 03:11.730 I accidentally found a vulnerability. 03:13.130 --> 03:16.170 I don't know if you guys know this about me, I'm kind of lazy. 03:16.250 --> 03:18.970 So I happen to be on my favorite ham radio website. 03:18.970 --> 03:21.370 Listening to the radio in the backyard. 03:21.710 --> 03:23.790 And I hear an interesting call sign. 03:25.110 --> 03:27.730 I'm not going to use the search bar, I'm lazy. 03:27.870 --> 03:30.830 So my call sign was already in the URL. 03:31.170 --> 03:37.410 So I went ahead and just typed in the interesting call sign in the URL. 03:38.610 --> 03:39.950 Next slide. 03:43.010 --> 03:49.730 Now, this is what we call an insecure direct object reference, or IDOR for short. 03:50.890 --> 03:53.970 It seemed like there was some sensitive information. 03:53.970 --> 03:58.550 By the way, all these slides are completely faked because we'll go into that later. 03:59.010 --> 04:05.790 But it seemed like there was some sensitive information here that I should not be able to see on someone else's profile. 04:07.690 --> 04:08.870 And that's why it was an IDOR. 04:08.870 --> 04:11.930 Now I wasn't sure if it was an IDOR or if this was intended functionality. 04:12.830 --> 04:14.970 Now we get to kind of the big problem. 04:15.430 --> 04:16.370 What do we do? 04:16.370 --> 04:19.750 So here's the problem with trying to disclose something. 04:20.810 --> 04:25.230 There are many incidences of where it did not go well for the person trying to disclose it. 04:25.230 --> 04:27.030 Someone trying to do the right thing. 04:27.150 --> 04:32.750 And him and I went back and forth on this for quite a bit before we decided what is the right thing to do in this case. 04:32.750 --> 04:39.290 There was the F12 incidents where, hey, you use dev tools, the governor now says, you're a hacker. 04:39.430 --> 04:42.430 And it's like, well, if he's a hacker, I want to hire him. 04:42.710 --> 04:45.310 But there's other cases. 04:45.310 --> 04:48.510 Four students arrested for disclosing a vulnerability. 04:48.510 --> 04:51.790 And they were strip searched for disclosing a vulnerability. 04:51.790 --> 04:52.990 That's how bad it goes. 04:52.990 --> 05:01.410 And when I was looking for these things, it turns out I actually found like an open source project that is tracking this sort of like occurrences. 05:01.410 --> 05:06.910 And the fact that there needs to be a project of that scale tells you just how bad of a problem this is. 05:07.030 --> 05:08.410 And so it's like, what do you do? 05:08.410 --> 05:11.010 Do you do the right thing and disclose? 05:11.730 --> 05:15.290 Or do you just say, yeah, it's not my problem? 05:15.510 --> 05:16.610 Well, we're hams. 05:17.430 --> 05:18.690 So it's Dan. 05:18.690 --> 05:20.290 So of course, he's going to full send. 05:20.290 --> 05:21.570 And it's me, I'm going to full send. 05:21.570 --> 05:23.630 A disclosure to the site owner. 05:23.630 --> 05:29.350 So at this point, I emailed the site owner asking him, hey, is this intended functionality? 05:30.030 --> 05:34.710 Here is seven steps to replicate this exact behavior. 05:38.730 --> 05:41.610 But hey, everything turned out okay. 05:41.790 --> 05:43.590 He confirmed it was a problem. 05:43.590 --> 05:45.210 Was very, very grateful. 05:45.550 --> 05:48.070 Remediated it within just a few days. 05:48.070 --> 05:51.010 And then asked me to validate that it was actually fixed. 05:51.550 --> 05:53.450 Can't get better than that, right? 05:53.450 --> 05:55.310 Didn't go to jail, didn't get strip searched. 05:56.430 --> 06:01.970 Now, we were wondering, hey, why did this go so well for me? 06:02.790 --> 06:05.930 Obviously, the professional reporting, I write pen test reports all the time. 06:05.930 --> 06:08.070 So it's kind of like within my wheelhouse. 06:08.650 --> 06:13.550 I believe it might have been because I asked, hey, is this actually a problem? 06:14.490 --> 06:16.610 Because I didn't want to assume anything. 06:16.610 --> 06:22.950 But the thing that him and I identified, we think, was why it went okay. 06:22.950 --> 06:25.370 Because we were licensed, or I was licensed. 06:25.430 --> 06:28.150 And so, he comes in later on this. 06:28.150 --> 06:29.950 I was licensed, and so it was... 06:30.650 --> 06:34.530 The license kind of like gives you a little bit of trust with other hands. 06:34.530 --> 06:38.270 Because, I mean, hey, we all care about the call signs. 06:39.830 --> 06:41.730 Ending in Lima, come back, you know? 06:41.730 --> 06:43.110 We've all been there. 06:43.110 --> 06:47.430 So this is great. 06:47.430 --> 06:55.550 We helped, at this point, we helped one of my favorite ham radio websites. 06:55.670 --> 06:57.970 And we improved their security posture. 06:57.970 --> 07:02.370 And we got rid of a vulnerability that actually would impact other users and their data. 07:02.370 --> 07:04.810 It wasn't extremely sensitive. 07:04.890 --> 07:09.530 But it was still things that I felt were like, people shouldn't be able to see that. 07:10.890 --> 07:13.630 But we wanted to be able to do more, too. 07:13.830 --> 07:15.730 So Dan and I talked about it a little bit. 07:15.730 --> 07:20.870 We decided to approach the owner again and say, hey, what if we do a full assessment of your site? 07:20.950 --> 07:24.470 Let's look around for other stuff beyond just what we've stumbled on. 07:25.190 --> 07:26.050 We're hams. 07:26.050 --> 07:27.230 Here's our call signs. 07:27.490 --> 07:29.350 Here's what we're thinking for a scope. 07:29.350 --> 07:31.410 We're going to do manual testing only. 07:31.410 --> 07:34.670 We're going to keep within these certain testing windows. 07:35.190 --> 07:37.570 We're going to not do destructive testing. 07:37.870 --> 07:40.190 We're going to provide a report back with the findings. 07:40.490 --> 07:43.510 We're going to not disclose specifics prior to remediation. 07:43.510 --> 07:47.570 And we're going to de-conflict by, here's the IP addresses we're coming from. 07:47.570 --> 07:48.430 Here's the testing windows. 07:48.430 --> 07:49.290 We're going to do it. 07:49.690 --> 07:55.010 So this way, if anything went wrong, he at least can go like, oh, it wasn't actually them that caused that problem. 07:55.010 --> 07:59.030 Because it's like, hey, here's our de-confliction. 08:00.210 --> 08:02.270 But yes, absolutely no scanning. 08:02.550 --> 08:03.550 It's prod. 08:03.970 --> 08:05.110 It's prod. 08:05.230 --> 08:07.430 So he was 100% on board. 08:07.430 --> 08:10.130 He was very excited to get some more attention on it. 08:10.130 --> 08:17.950 So in summary, what we ended up finding, six high vulnerabilities, three mediums, three lows, and one informational. 08:18.130 --> 08:21.250 And this was done over a little more than 12 hours of time. 08:21.450 --> 08:24.250 Spread out over a couple weekends, an hour here and there. 08:24.810 --> 08:28.250 And that's an actual photo of us doing the assessment right there. 08:29.170 --> 08:31.310 I think that was weekend two. 08:31.670 --> 08:38.790 But yeah, so the important thing is, that was 12.5 hours between two of us, spread over several weekends. 08:38.790 --> 08:42.910 It was not any sort of big commitment for us. 08:42.910 --> 08:45.710 We weren't burning up our weekends or anything like that. 08:45.710 --> 08:49.870 It was, hey, we got a little bit of time, let's send some help. 08:49.870 --> 08:50.790 Full send. 08:52.670 --> 08:55.750 So you can't come to DEF CON without showing the hacks. 08:56.930 --> 09:04.030 As I mentioned earlier, I can't actually show you the real hacks, but we got a mocked up version of the hacks. 09:04.030 --> 09:09.790 As we said, don't disclose anything that the owner isn't comfortable with you disclosing. 09:09.890 --> 09:11.570 We're here to help. 09:12.190 --> 09:18.150 So, I don't know if you know this about hams, we love logs. 09:19.590 --> 09:21.930 Yeah, okay, so that tracks. 09:22.730 --> 09:26.410 So, obviously most websites you can upload your logs. 09:26.410 --> 09:29.530 The other thing we love to do is brag about our logs. 09:29.530 --> 09:34.010 I personally like to do a handwritten log and then later upload it. 09:34.670 --> 09:39.470 So, now I'm looking at someone else's log, which is intended functionality. 09:40.890 --> 09:43.610 Now what happens if I try to upload something to my log? 09:44.130 --> 09:44.930 Next slide. 09:47.090 --> 09:49.530 So, got a flex of the FT5D here. 09:49.570 --> 09:56.030 So, there's my call sign, because it's going to say, hey, it's going to go to my log. 09:56.350 --> 09:58.910 What happens if I just go ahead and change that? 09:58.910 --> 10:01.530 Does anyone remember the vulnerability from earlier? 10:02.130 --> 10:04.690 When you find one, there's usually more. 10:04.930 --> 10:05.810 So, what do we have? 10:05.810 --> 10:07.270 This is an iDoor. 10:07.510 --> 10:08.550 Next slide. 10:09.450 --> 10:11.990 Boom, now I'm uploading to someone else's log. 10:11.990 --> 10:16.210 I just put him into this very interesting person's log. 10:16.290 --> 10:18.590 Not a real call sign, at least I hope not. 10:19.290 --> 10:21.210 Don't know, should have checked. 10:21.570 --> 10:22.790 Next slide. 10:22.870 --> 10:25.530 So, now let's go a little bit further. 10:25.530 --> 10:38.070 Instead of actually just uploading a legitimate log to someone else's log, what if we put a cross-site scripting payload into there? 10:40.570 --> 10:47.310 And now we have stored cross-site scripting with an iDoor on someone else's log. 10:48.470 --> 10:50.870 What can I say? 10:51.950 --> 10:53.810 Ham websites need some help. 10:53.810 --> 10:56.970 If you've got the skills, volunteer. 10:59.290 --> 11:00.210 Next slide. 11:01.070 --> 11:04.970 Now, you may have noticed there was an informational finding. 11:05.730 --> 11:09.810 You know, we had, what, three highs, three mediums, something like that. 11:09.810 --> 11:11.190 But there was one informational finding. 11:11.190 --> 11:13.310 I don't know if you guys know this about me. 11:13.490 --> 11:14.190 Probably not. 11:14.190 --> 11:15.730 I hate TLS findings. 11:16.570 --> 11:18.130 My side of the house hates them. 11:18.130 --> 11:19.310 His side of the house hates them. 11:19.310 --> 11:20.950 Everybody hates TLS findings. 11:20.950 --> 11:23.070 This is not your normal TLS finding. 11:23.570 --> 11:31.190 So, the TLS certificate in use had an annual cost of over $200 for this website. 11:31.190 --> 11:35.610 So , we all know everyone's always asking for donations and donations and donations. 11:35.610 --> 11:37.610 Here's another way that we can make an impact. 11:37.810 --> 11:39.850 That's why we included this. 11:40.070 --> 11:43.510 We recommended that he switches to Let's Encrypt. 11:43.510 --> 11:53.290 But then, we also provided the correct installation instructions for the architecture and infrastructure that was in use. 11:54.390 --> 11:57.670 And that's just a big impact of saving $200 for that website. 11:57.670 --> 12:00.850 That's $200 less in donations that they're going to need. 12:02.450 --> 12:04.190 But, how do you feel about TLS findings? 12:04.190 --> 12:05.210 I also don't like them. 12:05.210 --> 12:06.650 Yeah, everyone hates TLS findings. 12:06.650 --> 12:08.350 I hate fixing them because they come back in a month. 12:08.350 --> 12:10.550 The second you remediate it... 12:10.550 --> 12:11.010 They're bad. 12:11.010 --> 12:12.550 There's another bad cipher. 12:13.430 --> 12:21.010 So, this got us thinking about, alright, so this one website's like this. 12:21.010 --> 12:21.930 How prevalent is this? 12:21.930 --> 12:25.450 How common are these kind of things across amateur radio websites? 12:25.750 --> 12:27.510 So, we did some research. 12:28.550 --> 12:32.670 Turns out, it's a pretty common kind of thing going on. 12:33.310 --> 12:38.550 So, 40% of them we found had what we considered to be an excessive number of services open. 12:38.550 --> 12:40.530 In many cases, what seemed to be unnecessary. 12:40.530 --> 12:47.450 Things like FTP, DNS, RPC, RDP, R-SQL, I mean MySQL. 12:48.710 --> 12:53.450 If your SQL server is exposed to the internet, it's not MySQL no more. 12:53.510 --> 12:54.810 It's R-SQL. 12:55.570 --> 12:58.510 You know, banner grab suggesting versioning was often behind. 12:58.510 --> 13:00.830 There's caveats around the accuracy of banners, right? 13:00.830 --> 13:06.690 But, it's still pointed to a pattern of, hey, there's probably some patching that we're deficient on here. 13:06.690 --> 13:12.770 And then, just seeing a SQL server on there is telling you that you have a database function running on a web server. 13:14.830 --> 13:17.030 So, what can we do about it? 13:18.290 --> 13:27.410 If we look at the Venn diagram over here, we can see there's a large overlap between InfoSec enthusiasts and licensed amateurs, right? 13:27.610 --> 13:31.390 That intersection point in the middle is why we have a ham radio village at DEF CON. 13:31.390 --> 13:35.010 So, that's basically you, right there. 13:35.010 --> 13:41.970 So , if we were able to do this, why can't other hams in InfoSec do the same thing, right? 13:42.570 --> 13:48.750 You know, verifiable identification can go a long ways, right, towards establishing trust. 13:48.850 --> 13:53.910 Call sign happens to be a very easily identifiable and verifiable piece of information that we all have. 13:54.390 --> 13:59.630 You know, many of these sites are being run by hams as a DIY side quest, right? 13:59.630 --> 14:02.450 They're just trying to make a little piece of the hobby work. 14:02.950 --> 14:04.810 They need all the help they can get. 14:05.030 --> 14:16.390 So, what we're advocating is to reach out to the sites that we care about and that we use, identify yourself as a ham, provide your call sign, and request permission to utilize your skills in whatever way they need. 14:18.310 --> 14:24.510 So, to that end, put together some kind of simple general guidelines on how to start, right? 14:24.510 --> 14:26.290 Keep this simple, right? 14:26.290 --> 14:28.430 Get permission from the site owner. 14:29.630 --> 14:34.790 We don't want to be, you know, pushing on stuff that isn't necessarily what they're looking for. 14:34.790 --> 14:38.730 Don't go looking for a vulnerability before you get permission. 14:38.970 --> 14:43.810 I happened to accidentally stumble upon one, and that's what led to this. 14:43.810 --> 14:46.890 But don't start looking until you get, like, permission. 14:47.590 --> 14:50.510 So, FriendDA is kind of the name of the game here, right? 14:50.790 --> 14:54.650 Honor the scope and constraints that you agreed to originally, right? 14:55.050 --> 14:56.910 Because there's still no legal protections here. 14:56.910 --> 14:59.250 We still have the CFAA in force. 14:59.750 --> 15:01.710 You know, avoid the destructive testing. 15:01.970 --> 15:02.510 It's fraud. 15:02.510 --> 15:03.150 It's fraud. 15:03.150 --> 15:04.030 It's fraud. 15:04.070 --> 15:07.230 And, you know, don't disclose the stuff you've been asked to keep private, right? 15:07.650 --> 15:11.030 We've built trust around our call sign, so let's keep that trust going. 15:12.310 --> 15:17.590 So, really trying, too, to focus on identifying issues and recommending solutions, right? 15:17.590 --> 15:19.730 We're just trying to start at a ground floor here. 15:20.390 --> 15:26.270 You know, offer to help with fixing if you're inclined, but really we're looking at remediation as the bonus. 15:26.270 --> 15:30.950 We just want to identify the problem so that they can figure out where they need to go next with it, right? 15:30.950 --> 15:34.710 Many sites are going to have limited resources to be able to actually remediate things. 15:35.110 --> 15:38.770 We're really trying to position this in the spirit of amateur radio licensing. 15:39.490 --> 15:41.650 How we conduct ourselves, right? 15:41.830 --> 15:45.390 Really fostering a collaborative dialogue instead of an adversarial one. 15:46.630 --> 15:50.050 So, going along with that, it's important we've got to know our limits, right? 15:50.590 --> 15:53.610 We're trying to help, not create more stress for the site owners. 15:54.170 --> 15:56.810 So, the key there is to stick to what you know, right? 15:57.030 --> 16:00.750 Everything here, we've got to be treating like prod under SLA, right? 16:00.750 --> 16:01.730 Because it is prod. 16:03.150 --> 16:03.830 Yeah. 16:05.490 --> 16:08.170 Probably not the place to try out your new techniques, right? 16:08.170 --> 16:12.710 Work on those in your lab and then come back later and do the things that are familiar to you, right? 16:12.710 --> 16:16.290 You know, probably skip a little bit of Ion Cannon here as well. 16:16.430 --> 16:18.090 Likewise, knowing when to stop, right? 16:18.090 --> 16:28.870 There's a very big difference between pulling a random exploit from ExploitDB and reading a banner and looking at the version and looking at vulnerabilities that apply to that one. 16:29.070 --> 16:34.630 Because, again, it's really not hard to get in trouble with the CFAA if you're kind of going outside the bounds. 16:35.490 --> 16:37.970 Because there's no legal protections and it's prod. 16:38.830 --> 16:45.710 So, kind of going back to those common themes before and some examples of ideas we can give as recommendations, right? 16:45.910 --> 16:50.430 Limiting attack surface, turning on a firewall, shutting down services you don't need, right? 16:50.730 --> 16:52.910 Segmenting those logical functions out. 16:53.130 --> 16:56.810 Just getting those databases down into a database tier away from the DMZ. 16:56.930 --> 16:58.710 Patching systems, right? 16:58.710 --> 17:00.670 Like, even the app stuff, right? 17:00.670 --> 17:02.610 Use the OLAF Secure Coding Guide. 17:02.610 --> 17:06.370 Applying OLAF, this is all pretty basic stuff to a lot of the industry. 17:06.370 --> 17:11.550 But for HAMS, it appears to maybe be an area we can go back and kind of get back to the basics of. 17:11.550 --> 17:17.510 Because it's a hobbyist thing and while they... they're running as a DIY side quest, basically. 17:17.510 --> 17:20.010 And they need help. 17:20.470 --> 17:23.770 So who can help? 17:23.790 --> 17:26.390 Cool thing is there's something for everybody, right? 17:26.390 --> 17:30.370 As we thought about this, pen testers can go looking for vulns like they usually do. 17:30.370 --> 17:31.770 Usually breaking stuff. 17:31.770 --> 17:33.050 Try not to do that here. 17:33.390 --> 17:34.210 App dev, right? 17:34.210 --> 17:39.310 Look for OLAF's top 10 or even just get more involved in some of the open source projects in the HAM community. 17:39.970 --> 17:42.310 General tech, they're going to need help with remediation. 17:42.310 --> 17:44.290 They need to understand how infrastructure works. 17:44.490 --> 17:46.990 How best to apply some of this stuff, right? 17:47.110 --> 17:48.610 Even somebody in audit, right? 17:48.650 --> 17:52.470 Is going to be able to map against one of the common frameworks that are out there. 17:52.470 --> 18:01.270 And the great thing is, if you're new to IT, some of this makes for very good ways to get bullet points for the resume. 18:02.050 --> 18:03.170 Hey! 18:03.250 --> 18:11.010 I mean, like, if I see a bunch of accepted pull requests on your GitHub, I'm saying that's pretty impressive. 18:11.490 --> 18:13.330 It helps, yeah. 18:13.570 --> 18:17.770 So, we're really just trying to start a conversation here, right? 18:17.770 --> 18:19.890 We've obviously identified a need. 18:19.890 --> 18:24.170 But beyond that, this is still a relatively fresh idea, right? 18:24.530 --> 18:27.530 You know, some things we're kind of noodling on yet. 18:27.530 --> 18:30.190 How do you handle the sites that don't want help, right? 18:30.190 --> 18:33.770 And the ones that are unmotivated or not really looking for help, right? 18:34.030 --> 18:39.330 As we think about where the industry was 20 years ago with responsible disclosure on its own. 18:39.330 --> 18:42.810 I say just pass on them and just help someone that wants help. 18:43.050 --> 18:46.730 And we can circle back to the difficult ones later. 18:47.430 --> 18:52.610 Yeah, I mean, should your kind of standard responsible disclosure timelines even apply here? 18:52.750 --> 18:56.210 Is the data on these sites even important enough to warrant it? 18:56.310 --> 19:02.570 I have my opinions at an ethical level, but I think that's a broader question than just what I think. 19:02.570 --> 19:09.630 And then as someone from my side of the house, if you find something that's critical, you're going to have to push it. 19:09.630 --> 19:14.470 But I don't believe we're going to find too many critical things that are that bad. 19:14.470 --> 19:20.790 And we really should just don't go adversarial, keep it as a collaborative thing. 19:20.790 --> 19:22.550 But that's my opinion. 19:22.550 --> 19:25.630 But this is going to have to be a discussion we all have someday. 19:26.330 --> 19:35.610 So kind of looking down the road, some other areas we're interested in trying to dig a little deeper into, too, is seeing if we can carve out some legal perspective for this, right? 19:35.610 --> 19:39.430 And finding some ways to make this a little bit easier, right? 19:39.430 --> 19:46.350 Some kind of sow-like paper trail would be really beneficial for being able to say, this is what we're up to, here's what we're doing, right? 19:47.310 --> 19:50.690 So if there's any attorneys out here, love to hear from you. 19:50.690 --> 19:51.910 Got any ideas? 19:52.270 --> 19:54.250 An attorney that has a license. 19:56.750 --> 19:58.730 You know the idea of a bug bounty, right? 19:58.890 --> 20:02.450 We kind of got to stay away from money when it comes to amateur radio. 20:03.090 --> 20:05.630 But people love to chase paper. 20:05.750 --> 20:08.990 Is there some kind of thing that can get tied into that, right? 20:08.990 --> 20:12.090 With how we look at bug bounties normally operating. 20:12.390 --> 20:13.730 Found all bones. 20:18.010 --> 20:20.890 Develop a community source testing methodology as well, right? 20:20.890 --> 20:25.230 Kind of come up with, here are the ten things that the hobby should be looking for, right? 20:25.450 --> 20:30.710 You know, standardized community reporting templates, any other supporting reference material we want to come up with. 20:31.430 --> 20:33.670 So it's kind of a wide open thing, right? 20:34.490 --> 20:39.030 It's a thing we kind of stumbled into and curious what the rest of the hobby thinks. 20:39.030 --> 20:40.910 Well that's the thing, hams help hams. 20:40.970 --> 20:45.810 So there's a couple of our references. 20:48.490 --> 20:50.150 Contact info for us. 20:50.750 --> 20:53.730 And we'll put these slides up on github here in a little bit. 20:54.110 --> 20:58.710 At least you can find us on QRZ and our proton addresses there. 20:58.890 --> 21:01.010 Yeah, I guess I'll update my QRZ. 21:02.390 --> 21:02.990 But... 21:04.950 --> 21:21.690 So I'd like to, first and foremost, I'd like to thank a very special ham radio website owner who I cannot name because we decided together that we couldn't actually name them yet. 21:21.730 --> 21:24.810 But thank you very much, you know who you are. 21:25.070 --> 21:26.650 So thank you. 21:27.210 --> 21:28.850 I really wish I could. 21:28.850 --> 21:30.030 But you know, I just can't. 21:30.030 --> 21:33.090 But anyhow, it was wonderful. 21:33.090 --> 21:35.110 Thank you to the ham radio village for having us. 21:35.110 --> 21:36.730 Thank you for everyone who came up. 21:36.730 --> 21:39.210 Big thank you for Ferris for coming and filming. 21:39.210 --> 21:39.970 Thank you. 21:42.730 --> 21:45.510 We'll be around for questions if there's any after. 21:46.790 --> 21:48.850 Come on, give a shout out to your daughters. 21:48.850 --> 21:50.350 Come on. 21:55.410 --> 22:00.930 Oh, and if Kenwood wants to send us a 75 to test out for security.