WEBVTT 00:00.000 --> 00:09.860 Now we have Filipe Proteus, who will be going ahead and giving a talk on crushing crumbs of information to eat a whole cake, as attractive as it sounds. 00:09.860 --> 00:12.340 A little introduction about Filipe. 00:12.940 --> 00:25.660 Filipe works as a security researcher at TensorSecurity and he has graduated in information security and has a master's in systems and computing engineering from a university in Brazil. 00:26.200 --> 00:34.220 He has over 10 years of experience in information security and has an emphasis on networking, data visualization, and threat hunting. 00:34.580 --> 00:39.940 And he's also presented in a lot of conferences such as Black Hat and DEF CON, so yes, we are seeing him again at DEF CON. 00:40.060 --> 00:41.660 So welcome, Filipe. 00:48.130 --> 00:49.770 Thank you, thank you very much. 00:56.750 --> 00:58.310 Recording in progress. 01:01.550 --> 01:03.510 Hopefully everything is set up. 01:04.350 --> 01:05.230 Everything is good? 01:05.230 --> 01:06.110 Hi, everyone. 01:06.370 --> 01:08.050 Nice to have you all here. 01:08.290 --> 01:12.510 So let's start with crushing crumbs of information to eat a whole cake. 01:12.510 --> 01:13.870 It's a funny name, right? 01:14.030 --> 01:17.230 So who am I? 01:17.230 --> 01:19.030 Well, thank you for the introduction. 01:19.730 --> 01:24.510 My full name is Filipe Expósito, but I'm also known as Proteus. 01:24.890 --> 01:27.330 Ten years of experience, father of a girl. 01:27.690 --> 01:34.070 I do bug bounty when the above items allow, and I'm also a blue team instructor when the above items allow. 01:34.490 --> 01:38.550 And my main job, I'm a security researcher at TNT Security. 01:38.970 --> 01:50.630 TNT Security is a company, it's a cloud security company that works with cloud, and we also have a product that does third-party risk management. 01:50.910 --> 01:58.890 And as my job as a security researcher in focus on third-party risk management, we all think about supply chain and this kind of stuff. 01:59.350 --> 02:16.530 And as a motivation for this talk, thinking about supply chain and this kind of stuff, I just realized that we as a society, we rely not only on each other as people, as persons, but in our governments, because they have data on us. 02:16.530 --> 02:21.230 They know how much we make per month, yearly, and this kind of stuff. 02:21.910 --> 02:26.590 But also services, like electricity, gas, internet, all this kind of stuff. 02:26.590 --> 02:29.930 So that creates a huge supply chain of trust. 02:29.930 --> 02:31.490 Well, you'll see it. 02:31.490 --> 02:33.170 But also relationships. 02:33.530 --> 02:43.230 So, for instance, here we have a... I don't know if you guys know about this, but this is an electrician that works back in Brazil. 02:43.250 --> 02:53.650 So an electricity company knows about your name, where you live, how much you spend in energy, and if you're paying day by day. 02:53.650 --> 02:57.290 So they have to know all this kind of information to provide you services. 02:57.370 --> 03:05.770 By the way, if you're interested in supply chain, TNT has a newsletter called Alice in Supply Chains. 03:05.790 --> 03:09.030 So if you like the theme, just go subscribe. 03:09.330 --> 03:13.710 So coming back to our theme, that is supply chains. 03:13.710 --> 03:19.890 So this happens with a not really close friend of mine, but someone that I know. 03:20.090 --> 03:24.530 I don't know if everybody knows, but back in Brazil, marijuana is illegal. 03:24.730 --> 03:25.830 So it's illegal. 03:25.870 --> 03:43.290 So what happens is this friend of mine, he got caught by the police because someone told to the police that his electricity bill was like over 2,000 reais, like really huge electricity bill. 03:44.690 --> 03:46.590 And why he has that electricity bill? 03:46.590 --> 03:49.530 Because he's growing marijuana inside of his place. 03:49.530 --> 04:09.310 So he has a three-room place, one room for growing the marijuana and stuff with hot air and that kind of stuff, the other room just to make the flowers grow, and he controls all the weather, the humidity, and everything plus electricity, right? 04:09.310 --> 04:15.790 So someone tipped the police with his electricity bill, the police went to his home, and arrested him. 04:15.850 --> 04:19.830 So the same can occur in a lot of services that we rely on. 04:19.830 --> 04:25.610 So this can happen with internet provider, water, and gas, and so on. 04:25.790 --> 04:29.910 So I was thinking, how can we exploit those relationships? 04:30.110 --> 04:44.350 So we could hack every single company that we rely on any kind of providing services, so hack the planet, but that would be unfeasible, right? 04:44.350 --> 04:48.190 Nobody has the time to hack like 10 and 100 companies. 04:48.190 --> 04:56.430 Or wait for the company to be hacked, which will happen, and get the leak, but that's kind of boring, we have to sit and wait. 04:56.950 --> 05:07.070 So I start to wonder, what's the minimum crumb of information do I need to get, for instance, anyone's electricity bill? 05:08.570 --> 05:17.390 And just taking my example, I figured out that with just the CPF, it would be enough for me to get my electricity bill. 05:17.390 --> 05:23.190 So if I know the CPF of anyone, I would also be able to get the electricity bill for that people as well. 05:23.330 --> 05:25.030 So what is the CPF? 05:25.030 --> 05:29.750 CPF is really similar to the social security number in the United States of America. 05:30.410 --> 05:41.210 Every single Brazilian has at least one, and here I at least because there are some fraudsters, they're able to get two, three, or perhaps five. 05:42.810 --> 05:50.150 And by being unique for each Brazilian, that makes an awesome primary key for all databases. 05:50.150 --> 05:54.790 So this is the format of the CPF, it's 11 digits. 05:55.130 --> 06:00.350 The first eight digits are unique for you. 06:00.890 --> 06:07.270 The tenth digit here, the ninth digit here, it says the orange. 06:07.270 --> 06:12.390 So as I live in Rio de Janeiro, my number here is seven. 06:12.390 --> 06:14.170 If you live in Sao Paulo, it's six. 06:14.170 --> 06:16.110 The same occurs with the social security number, right? 06:16.110 --> 06:19.110 You guys have numbers splitted by regions. 06:19.110 --> 06:25.910 And the last two digits here are digits to verify if the first ones are right. 06:25.910 --> 06:34.990 So there's some sort of calculation that you sum, divide by two, do some math, and you figure out if the number is right or not. 06:36.030 --> 06:42.410 So if every single piece of information, you can get a good intel on it. 06:42.410 --> 06:57.350 Here we have an example of a bank in Brazil, that if you click on recover my password, and you put the CPF, if the CPF is not valid, or the user don't have an account on that bank, it returns an error. 06:57.650 --> 07:01.790 But if that user has an account in that bank, it returns success. 07:02.250 --> 07:11.610 So it's enough to me to know if somebody has an account in that bank, I can perhaps phishing him, or send a mission to him, or whatever. 07:12.370 --> 07:23.710 And here we have another example in another bank in Brazil, small bank, but if you know email and the CPF, you can figure it out if he has an account or not on that bank as well. 07:24.790 --> 07:31.970 So another really good source of information that we have back in Brazil, it's called PIX. 07:33.110 --> 07:40.790 And the PIX is a new system that we have like the last three years, I guess, but it's an instant payment system. 07:40.790 --> 07:48.190 Basically, you just have to know a key for someone that you want to pay, and you can have four kinds of keys. 07:48.190 --> 07:57.510 You can have the cell phone as a key, the CPF as a key, an email address as a key, and a random key that might be shared by a QR code. 07:57.730 --> 08:23.690 So these numbers are from July 2022, but we can see here that CPF has more than 100 million keys, cell phones has 98 million keys, emails around 70 million keys, and back in Brazil we are only 200 million, 214 million, and there are at least 470 million keys in CPF. 08:23.690 --> 08:25.250 So it's a really huge database. 08:25.810 --> 08:28.590 So what you can get with the CPF? 08:29.930 --> 08:53.650 If you do a PIX to pay someone, and in this example here I was getting the cab to go to the airport to come to Vegas, and I asked the guy the CPF, and he gave me the CPF, I paid him here just an example, just one cent, and it gives me the full name of him, 08:53.650 --> 09:03.210 here it is blacked out, but not only it gives me the full name, it also gives me the CPF, but I already know the CPF, right? 09:03.210 --> 09:07.750 But it gives me the bank account where the money is going to. 09:08.690 --> 09:29.170 With this bank account I would be able to go to another bank, try to recover his password, with his CPF, and then it brought me another two pieces of information, another two little breads, brought me the cell phone number and also the email number. 09:29.170 --> 09:39.150 But realize that not the full cell phone number and not the full email address, it has stars to hide information from me, right? 09:39.150 --> 10:01.690 Well, from the email we can see that the name of this guy was clever, and we can see that his email starts with C, and the other stars part here are the rest of his names, he also starts with D, so we can try to imagine what his email address is. 10:02.290 --> 10:08.450 But even if I didn't know that, we can keep searching for information. 10:08.450 --> 10:16.650 So I just saved this information on my database, and looking for his phone number, I figured it out. 10:16.650 --> 10:28.530 Well, if we have four digits here, back in Brazil all the cell phones start with nine, then have another nine digits there, but the last four numbers we already know, right? 10:28.530 --> 10:32.410 So it only gives us a thousand possibilities to try. 10:32.970 --> 10:36.770 Would it be hard to try or brute force a thousand possibilities however you want? 10:36.770 --> 10:39.110 Yeah, it would be, at least boring. 10:39.130 --> 10:49.090 But we can go to another cell phone provider and try to figure it out if he has an account on that cell phone provider, and it turns out that he has. 10:49.410 --> 11:02.590 And by checking on his CPF again as an input source, and trying to recover his password for that cell phone provider, it got me, how do you want to get your password? 11:02.590 --> 11:04.690 It's by SMS or email? 11:04.810 --> 11:08.070 Well, let's check out the SMS possibility, right? 11:08.070 --> 11:25.210 So it masks the four numbers in the middle, but I already knew the last four numbers, so I already know these two, they gave me the first two, now I only have 99 possibilities to brute force, right? 11:26.010 --> 11:28.130 But there is a catch on this. 11:28.130 --> 11:35.850 There is also another website that tells you from which cell phone operator that number is. 11:35.910 --> 11:47.930 So if I go to that site and try to brute force like 91116497, it's just a cell phone from the cloud, he would say no, it's not, this cell phone doesn't exist. 11:47.950 --> 12:02.890 But if I try another number, and it's from the cloud, it's the cell phone operator, and by doing this, I can reduce these 99 possibilities to at least 25. 12:02.890 --> 12:08.930 And now it's feasible to call 25 numbers to figure out if it's his number, right? 12:08.930 --> 12:10.910 Things are getting easier. 12:13.090 --> 12:40.110 And by the email, if we check the email here, we can see that, well, we already know the CD and a lot of stars at ho, a lot of stars.com, but when we check on the cell phone providers, we already know the TLD, now it's hotmail.com, but not only this, it gives me the last letter here, 12:40.110 --> 12:54.570 the R, but not only the R is important here in the TLD, the matching number of stars is also important, because now I know that those stars, each star represents at least a letter, or a number. 12:54.570 --> 13:00.330 So I'm reducing the space to brute force for this kind of information. 13:00.330 --> 13:09.730 And we can look for leaks on emails that match that pattern, and it would be easier to find more information about him, right? 13:09.730 --> 13:25.730 So coming back to the electricity bill, I check in another endpoint on the same website, so if I can try to recover his client code, client code is basically how the company calls you, right? 13:25.730 --> 13:37.450 And to recover his client code, the first time that I put the CPF and click on proceed, it gives me five options of address, where he lives. 13:38.190 --> 13:49.990 All right, okay, so what I did was just refresh the page, and by refreshing the page, every time that I refresh the page, it gives five different, five new positions, but just one repeats. 13:50.410 --> 13:53.590 So trivial to figure out where he lives, right? 13:53.690 --> 13:57.890 Well, we can put this on the Google Maps and find out where he lives. 13:58.090 --> 14:07.710 Actually, not the true place here, I just put some mark on the map, but it's in this region where he lives, right? 14:08.750 --> 14:17.250 So yeah, now we have the CPF, we have the cell phone, we have the email address, or partial email address, and we also know where he lives. 14:20.130 --> 14:23.670 We can use all the kind of social information that we have. 14:23.670 --> 14:36.590 So here, I don't know if it happens the same here, but when you do your taxes, and the money sometimes has money to give you back, and we have a website for this. 14:36.590 --> 14:50.970 So if you put your CPF and your birth date, and fill in this gap here, it will return, okay, you have money to receive from the government, and which bank and agents we are going to put this. 14:51.470 --> 15:15.850 So I did this, through a leak, I found the birth date of this guy, and went to this website, and figured out that the agents that he receives was a predestined agent, it's a Brazilian bank, where the bank lives, and by looking at the Google Street Maps, 15:15.850 --> 15:18.410 I figured out it's a prime bank. 15:18.410 --> 15:23.990 And by being a prime bank, that means that he makes at least 10,000 reais monthly. 15:24.190 --> 15:29.630 So now I also have some kind of idea how much money he makes, right. 15:30.130 --> 15:33.510 And fun thing is, it works not only websites. 15:33.790 --> 15:49.210 Back in Brazil, we have SMS bots, WhatsApp bots, so we can interact with those bots, and just provide some piece of information that you have, and we reply you with some information that you need. 15:49.270 --> 16:12.610 So I asked him, I asked this bot to get an energy, it's a gas company, to cook, not fuel, and I asked him, all right, can I give a second paper to pay, about his bill, and all right, give me your CPF, I already knew the CPF, and then he returns with a payment code, 16:12.610 --> 16:15.770 with the value of his account, of gas. 16:15.770 --> 16:32.670 So now I know that he, or not his wife, do not cook outside, because the value of the gas is not that much, it's enough for people to have hot water, and cook at home. 16:32.670 --> 16:41.310 So with those little pieces of information, you can start grabbing a much more bigger picture from your target, right? 16:41.710 --> 17:03.350 And sometimes, we have to look further, and this is another bank, back in Brazil, and if you provide the CPF, the website just does nothing, but if you look at the F12, and the network tools, and the return, we're going to be, not only the CPF, and if he is registered in the site, 17:03.350 --> 17:06.210 but also the full name of the people who is registered. 17:08.390 --> 17:26.570 And also there are some side effects, sometimes, yeah, some services, when you try to recover the email, you're going to send an email to your target, letting him know that he's being targeted by someone, and there's some kind of examples, but the main problem that I want to solve here, 17:26.570 --> 17:37.090 is if I only know just one piece of information about that target, how do I pivot and find other piece of information to get the whole cake, or to get the whole picture? 17:37.950 --> 17:56.350 So, when I start this, I start to catalog all those information, so the name of the website, the URL, if the URL has a capture or not, which kind of input I have to provide on this website, and which kind of returns to me. 17:56.350 --> 18:07.730 So, I decided to use YAML files because they're easy to write and to read, and one smart thing that I put here, it's input. 18:07.790 --> 18:18.250 Sometimes websites need end inputs, like you need to know the CPF, the birthdate, and the year, but sometimes you only need, like PIX, you only need to know one information of those. 18:18.410 --> 18:26.650 And so, those websites that only need one information, it's the OR thing, but you can mix both. 18:26.930 --> 18:31.250 So, this is the kind of end-to-end relationship between the input data. 18:31.830 --> 18:34.690 And this is what this website returns, right? 18:34.690 --> 18:42.610 It returns the full name, the bank, the banking agents, and the taxes result, if it has money to come back. 18:43.410 --> 19:00.610 So, with this information, I graphed this, I put this in a graph, and created a software that I'm calling Browse, it's like Brazilian open source information, but this kind of trick can be used by anyone in any place, right? 19:00.610 --> 19:07.890 Just try to recover a button, design the YAML for yourself, and use this tool to figure it out. 19:07.890 --> 19:16.290 So, here we have a show of the help here in the tools. 19:16.290 --> 19:24.200 So, you put a path on which data source you have, the "-sf", show you fields that you have as input. 19:24.920 --> 19:43.160 And what I know, what I know is basically, if I only know the CPF of someone, I put the here CPF, but if I know CPF in birthdates, I put CPF in birthdate, and we'll transverse the graph, figuring out which kind of information I have enough for OR, and get this field, 19:43.160 --> 19:49.120 or if I have to have more information about this target to get those information, right? 19:49.120 --> 19:55.160 And I also put an option to export to Neo4j, because, well, it's better to see graphics, right? 19:56.760 --> 20:15.560 And just by loading Brazilian data sources that is available right now on the GitHub, actually it's not publicized yet, I have to come back to Brazil and put my USB-C token to make the project public, but I will do on Monday. 20:16.120 --> 20:25.600 But here, I will turn available to everybody 17 sources of information, but I have at least 40 in my private database. 20:25.740 --> 20:38.800 And by just looking for which fields you have to figure out for inputs, now here we have the CPF cell phone, UF is state, father name, birthdate, full name, SNH is the driver license, mother name. 20:40.600 --> 20:49.860 I parse all those information and put it in a graph, so this is the Neo4j graph for this, for all those sources that I have. 20:51.680 --> 21:01.440 But I have a little damn time, so I record it, just because I don't want to play with the gods of the demo, right? 21:02.920 --> 21:07.060 Well, this is my fourth time speaking in Vega, so I won't try my luck. 21:14.180 --> 21:41.000 So, basically, you can run the script, you have the DS as a path for data source, SSF to show all the fields that we have, the graph, this first graph here, it's like, will pop up in image, and I created a smaller version for this demo, just to show up the capabilities of this project, 21:41.000 --> 21:41.580 right? 21:44.790 --> 22:00.730 So, this is all the Brazil data source that I have, now it's only 13 public, and I have changed for temporary, and with just five sources, so that's what's going to happen with this demo, right? 22:05.530 --> 22:10.530 So, let's take a look at those data sources that we are using in this demo. 22:15.210 --> 22:24.290 So, it's cell phone operator, PIX, company energy, recover number client, and another one that I... 22:29.690 --> 22:36.210 So, let's figure it out, which fields do we have to have inputs to make this work? 22:36.210 --> 22:42.690 So, from these five sources, the input fields are CPF, cell phone, email, year, CNPJ, and birthday. 22:45.780 --> 22:47.560 So, we can graph it 22:55.550 --> 23:00.870 , that's called PNG, we'll just split a PNG, 23:04.070 --> 23:04.610 right? 23:04.610 --> 23:26.390 And it shows the relationship between the input nodes and the return nodes, it's like really small, but you can zoom in and get this information, so, zoom out, and just checking this relationship here from two fields are the PIX, so, if I have the CPF, 23:26.390 --> 23:45.930 I have to go to the PIX to figure it out which bank it has, to get the election biometry, if the guy has biometry collected to vote, I know which fields I have to have, and this kind of stuff, right? 23:45.930 --> 23:51.810 But the most important here is with which information can I can get the rest, right? 23:51.870 --> 24:10.490 So, this is the option that I call what I know, and if I only know about the CPF of this person, of this target, these are the information that I can get back, the full name, full address, partial CPF, election status, bank account, election biometry collected, 24:10.490 --> 24:16.810 and his energy company client number. 24:16.810 --> 24:24.510 But if I only know the birth date, the only thing that I can reach is the bank agents and the full name of his, right? 24:24.850 --> 24:25.330 And 24:31.020 --> 24:40.720 if I know the CPF and the birth date, I can reach much more information, right? 24:46.080 --> 24:48.320 So, this was the first one. 25:08.670 --> 25:25.050 Here's the second one, showing the Neo4j option, so you have to pass a config for the Neo4j, and it will put on the Neo4j, and then you can carry as much information that you want. 25:25.150 --> 25:35.850 On the Neo4j, I choose map this relationship between AND and OR, just to get easier to make carries about those nodes. 25:35.850 --> 25:44.590 So, with the CPF, only the CPF, I can get the election, the election status, the full address, and this kind of stuff. 25:44.770 --> 25:54.810 And I also can get the partial CPF, and makes easier to carry information using the Neo4j stuff, right? 25:57.050 --> 26:09.990 So, with the cell phone, I can figure it out, the operator of the cell phone, or with the cell phone, I also can figure it out the bank accounts, because the peaks, that source, and things go on like this, right? 26:18.150 --> 26:27.170 So, as a future work, one thing that I felt that I have to improve on this project is to uniform the input fields. 26:27.230 --> 26:33.550 As you see, I made the code in English, but there are some fields that make more sense in Portuguese. 26:34.470 --> 26:40.230 But I have to figure out a way to uniform those input and output fields to avoid confusions. 26:40.230 --> 26:49.150 Also, I add some regex on this, add more sources, so you all are invited to contribute with this project. 26:49.150 --> 26:56.390 You can just create the sources, United States, sources of your country, whatever, and submit your mail files there. 26:57.070 --> 27:02.470 One thing that I also figured out that's kind of important is to add some context on those filters. 27:02.530 --> 27:10.410 For instance, if I know the CPF, it's from the state of Sao Paulo, I just want to look at the sources from the state of Sao Paulo. 27:10.410 --> 27:15.630 So, the electricity company back in Rio is not interested enough for this, right? 27:15.630 --> 27:17.670 And also add some browse information. 27:17.670 --> 27:30.090 So, if you remember the first email that I showed you guys has some XPath, because I already started playing with some browsing automation, but it's not done, so it's a future work in progress. 27:31.790 --> 27:37.750 And for conclusion, user interface and user experience must be taken account for security. 27:37.750 --> 27:49.970 So, basically this problem is because security teams do not interact with user experience, user interface, and there isn't some sort of norm or regulation on this. 27:49.970 --> 27:59.510 So, maybe we have to figure out a way to recall the passwords and get information from users without showing that much of information. 27:59.570 --> 28:09.610 So, until there is some kind of regulation or norm or best practice guide, anything like this, we still have room to exploit this kind of fragility, right? 28:09.790 --> 28:14.550 And the same can be applicable to several countries and different contexts. 28:14.550 --> 28:19.110 So, go for it, download the code, create your own sources, start to catalog. 28:19.290 --> 28:35.370 Like these 40 sources that I have, I took like... it's not my day-to-day job, but I do it for the last two years, cataloging, oh, just hit another website, figured it out, okay, this is the information that I need, this is from the output, save it on the EML, 28:35.370 --> 28:37.270 and then let it there. 28:37.970 --> 28:41.050 So, that's it, guys. 28:41.150 --> 28:42.130 That's all, folks. 28:42.130 --> 28:43.130 Well, thanks. 28:43.390 --> 28:44.810 If you have any questions, 28:53.310 --> 28:56.470 so, the code and data sources will be available at GitHub. 28:57.050 --> 29:05.610 And a special thanks for Corvolino, a guy who helped me to test, Borghini, Sierra, and Motoro, who also helped me with the tool, right? 29:05.610 --> 29:07.050 Thank you very much, guys.