[00:09.470 --> 00:14.210]  All right, we're going to get our next session started. It is my great pleasure to introduce
[00:14.210 --> 00:21.750]  Schema, who is going to be talking to us about flaws in a commercial voting system
[00:21.750 --> 00:28.030]  and how that can make its way into civil elections in the U.S. So this is some
[00:28.030 --> 00:33.190]  really interesting work. We were talking about online voting earlier. Now we have an example.
[00:34.650 --> 00:42.960]  Awesome. Thank you, Matt. How are we doing on volume? You guys hear me? Perfect. Fantastic.
[00:42.960 --> 00:48.920]  All right. I'm Schema. I'm super excited to be here. I've been attending DEF CON for a long time,
[00:48.920 --> 00:54.960]  but I'm excited to present, excited to take you on this journey of this kind of little pocket of
[00:54.960 --> 00:59.040]  the world that many people don't know about, including I didn't know about this. I'm excited
[00:59.040 --> 01:06.200]  to bring you on that journey. So at the root, elections are about power and influence. And we
[01:06.200 --> 01:11.480]  elect the best to lead us and put their trust in them. And with that trust comes a lot of controls.
[01:11.960 --> 01:15.640]  Since there's so much potential for abuse, we have controls around the power that comes with
[01:15.640 --> 01:22.360]  elections. But there's an area of elections where those controls are much weaker. And this is an
[01:22.360 --> 01:27.340]  area that doesn't get discussed at places like this. And I want to bring it out of the shadows.
[01:27.340 --> 01:34.660]  And that's private elections. So private elections are elections for private organizations. So think
[01:34.660 --> 01:41.680]  unions, Amnesty International, Harvard University, tons and tons of organizations elect their
[01:41.680 --> 01:46.620]  leaders. And the way those election works are very different than civil elections. And as we're
[01:46.620 --> 01:52.780]  going to see, there's some problems there. So first, I want to touch on why does this matter?
[01:52.780 --> 01:58.560]  Why should we care about private elections? Let's imagine you're a foreign adversary. And on one
[01:58.560 --> 02:05.820]  side, you have the option of, you know, co-opting state and local election, maybe getting a random
[02:05.820 --> 02:11.560]  congressman in a state that matters elected. And that's kind of interesting. On the other side,
[02:11.560 --> 02:17.520]  you have Harvard, these big NGOs. You can get to elect the president of Harvard University and a
[02:17.520 --> 02:21.460]  lot of these national and international organizations that are very influential.
[02:22.080 --> 02:27.140]  That second bucket has some very rich targets if you're a foreign adversary.
[02:29.840 --> 02:34.700]  Not only are the organizations themselves interesting as a place of influence, but private
[02:34.700 --> 02:40.160]  elections... I'm sorry, I hope you can hear me. Private elections are a stepping stone to major
[02:40.160 --> 02:46.620]  political offices. So here we have Justin Kitanji Brown-Jackson. She started on the Harvard board
[02:46.620 --> 02:50.640]  of overseer. That's how she started to kind of gain influence and eventually came to be on the
[02:50.640 --> 02:54.860]  Supreme Court. We have people that are involved with the American Medical Association, senators
[02:54.860 --> 03:00.800]  now. Ambassadors that got their start on these private elections. They're the stepping stone
[03:00.800 --> 03:11.700]  for a lot of big major positions in U.S. society. So private elections have much less controls and
[03:11.700 --> 03:16.440]  scrutiny than traditional civil elections. And as we're going to see in this talk,
[03:16.440 --> 03:23.060]  their technical systems are highly vulnerable. Yeah. In this talk, I'm going to disclose a brand
[03:23.060 --> 03:28.960]  new zero-day vulnerability in a major provider of election software, private election software.
[03:31.660 --> 03:36.860]  The CVE number is here. This is a live CVE. There are approximately 2,000 elections that
[03:36.860 --> 03:40.900]  are affected. They're both civil elections, the kinds you're familiar with, and private elections.
[03:40.900 --> 03:47.200]  But this vendor runs many of many private elections. So we're going to focus on that
[03:47.200 --> 03:51.810]  part since it's so exploitable and such an interesting part that we don't talk a lot about.
[03:55.190 --> 04:00.990]  All right. Well, before we go diving deeper into private elections and what they are,
[04:00.990 --> 04:07.810]  I want to first make the point of just how much work is involved in the traditional way of spying,
[04:07.810 --> 04:12.890]  the traditional way of gaining influence in the U.S. Here we have this operation,
[04:12.890 --> 04:20.030]  this FBI operation, FBI Operation Ghost Story, where they caught a group of 10 Russian spies
[04:20.030 --> 04:25.890]  that had spent decades building their cover in the U.S. And because this is public information,
[04:25.890 --> 04:30.210]  we can kind of dig deep into just how much work was put into doing this.
[04:33.440 --> 04:39.200]  One of the spies is this gentleman here, Andre. He went by the name of Donald Howard
[04:39.200 --> 04:44.140]  Heathfield. That's a fake name. That's the name of a Canadian deceased person. So step one,
[04:44.140 --> 04:49.180]  you want to be a spy. You got to find some name and identity to take over. Step two,
[04:49.180 --> 04:53.800]  he got a degree at Harvard to get that legitimacy. So step two, you actually have to be admitted to
[04:53.800 --> 04:59.860]  Harvard, actually do the studying. And we're only in step two. Then he married. So he married in the
[04:59.860 --> 05:04.080]  U.S. He had children, legitimate children in the U.S. His children didn't know he was a spy,
[05:04.080 --> 05:09.260]  didn't know he was a Russian. Children believed the whole story. He bought a house out here and
[05:09.260 --> 05:13.380]  then he worked his way up like everybody. He started at the bottom of a company and then
[05:13.380 --> 05:17.500]  kind of moved his way up and eventually got more and more influence. He spent 20 years,
[05:17.500 --> 05:22.080]  20 plus years doing this. This is what it takes to do things the traditional way.
[05:22.300 --> 05:26.800]  There's a lot of energy because there's so much, so much opportunity here to have
[05:26.800 --> 05:32.440]  tentacles everywhere in the U.S. Foreign adversaries spend a lot of time doing this.
[05:37.870 --> 05:42.510]  So if you wanted to become a spy in the U.S., there's that kind of path A, the traditional path,
[05:42.510 --> 05:48.430]  the laundry list of things, the decades you need to put in to get in that position. But if you want
[05:48.430 --> 05:53.090]  to take the shortcut, just become an elected official. Become an elected official of a
[05:53.090 --> 06:04.210]  private organization. Go straight to the top. I'm sorry. It is funny. So if you were to take that
[06:04.210 --> 06:09.230]  path B, here's the menu of organizations that you could put your people in and top leadership
[06:09.230 --> 06:14.990]  positions. You have unions, big major unions, auto workers unions, all sorts of industries.
[06:15.330 --> 06:20.570]  NGOs, we talked about those. Universities, all the major universities elect their leadership.
[06:20.790 --> 06:25.790]  Corporation, professional bodies, the associations that govern who gets to be a doctor, who gets to
[06:25.790 --> 06:30.810]  be a lawyer. You could put your people in those positions. Pension funds, billions of dollars
[06:30.810 --> 06:35.410]  that gets spent. You could have your people deciding where that money goes.
[06:35.430 --> 06:41.290]  This is attractive. I want this. I'm interested. And I'm sure a foreign adversary is, too.
[06:45.560 --> 06:50.480]  So now that we've established that these elections are influential and juicy targets for a foreign
[06:50.480 --> 06:56.880]  adversary, I want to make a second point, which is that these elections are a lot easier to attack
[06:56.880 --> 07:04.100]  than traditional civil elections. The big reason is polling. Traditional elections have a lot of
[07:04.100 --> 07:09.600]  polling, third-party polling, leading up to the elections. By the day the election comes,
[07:09.600 --> 07:15.340]  we already kind of know who's going to win. And there's a lot of visibility and focus on that.
[07:15.340 --> 07:19.180]  And if things don't line up with the polls, people are going to notice. There's a lot of scrutiny.
[07:19.440 --> 07:23.960]  There's no polling in private elections. These are a lot more open. And these elections are
[07:23.960 --> 07:29.620]  all electronic, no paper record. I think the crowd knows how dangerous all electronic
[07:29.620 --> 07:36.640]  elections are. And here we have it. We have just this explosive mix of very powerful positions,
[07:36.640 --> 07:41.660]  no way to reconcile whether those numbers make any sense with third-party polling,
[07:41.660 --> 07:45.760]  and all electronic elections. To me, that's pretty scary.
[07:49.140 --> 07:53.860]  If you're like me, you've never heard about private elections before this. I definitely haven't.
[07:53.860 --> 07:58.960]  It's kind of the boring areas like this that foreign adversaries actually tend to attack,
[07:58.960 --> 08:11.460]  rather than the very visible things. So far we've been discussing a theoretical
[08:11.460 --> 08:17.740]  vulnerability in election software. I want to get to the practical now. In this part of the talk,
[08:17.740 --> 08:24.120]  I'm going to disclose a zero-day vulnerability in one of the big major providers of private
[08:24.120 --> 08:29.920]  election software. I mentioned earlier, there are about 2,000 elections affected. It's a live
[08:29.920 --> 08:34.660]  CVE. And to tell you the story about this, I want to tell you about my journey, about how I
[08:34.660 --> 08:44.920]  discovered this. I voted in one of these private elections, and I realized that there's basically
[08:44.920 --> 08:49.740]  this one vendor that handles all these private elections you've never heard about, but are very
[08:49.740 --> 08:54.960]  important and influential. And this is what the process looks like. You just go to some website.
[08:55.200 --> 09:00.380]  This is an election for the state bar of Texas. It's a public URL. You just go to this special
[09:00.380 --> 09:04.900]  web page, and then you put in your information here, click submit, and you vote. And that's it.
[09:04.900 --> 09:12.060]  That's the whole story. I voted in one of these elections. My university has their alumni vote
[09:12.060 --> 09:16.540]  on the leadership of the organization. So I went to a page very similar to this,
[09:16.540 --> 09:23.140]  put in my information, and I made a typo in the information I put in. And I got to this error
[09:23.140 --> 09:29.260]  page. Now, the error page isn't so interesting, but the part that is interesting is the URL.
[09:29.980 --> 09:32.860]  And I want to tell you about that. So if we focus on that for a second,
[09:34.240 --> 09:40.180]  this is what that URL looks like. And there's two parameters, but there's this one parameter here
[09:40.180 --> 09:45.600]  that just has a bunch of numbers. It doesn't seem so interesting, but I may be being a little too
[09:45.600 --> 09:51.660]  curious a person. I'm sure this audience can relate. If you start playing around with these
[09:51.660 --> 09:56.060]  parameters and start putting code in that parameter, rather than the normal numbers
[09:56.060 --> 10:01.080]  the system expects, if you start putting code in that, in this case, if we put an instruction to
[10:01.080 --> 10:09.340]  wait for 30 seconds, the software actually executes that instruction. It's crazy. I mean,
[10:09.340 --> 10:14.720]  we just put something, a random thing in the URL, and we got the software to actually run that code.
[10:17.080 --> 10:22.220]  Now, getting the software to wait 30 seconds is pretty innocuous, but I, as a security
[10:22.220 --> 10:29.080]  researcher, know how serious a thing that is. This is called an SQL injection. And what it means is
[10:29.080 --> 10:35.000]  that, you know, in a traditional way a system works, there's the database that has all the
[10:35.000 --> 10:40.020]  important information about the system, about who voted and how they voted and so on. And then
[10:40.020 --> 10:45.060]  there's software that's a gatekeeper of that. So if a regular user tries to ask information they're
[10:45.060 --> 10:50.600]  not entitled to, like how did the X person vote, the gatekeeper makes sure that they're not given
[10:50.600 --> 10:57.780]  that information. And an SQL injection is really problematic because it allows us to bypass this
[10:57.780 --> 11:03.500]  gatekeeper, to ask the database directly, how did Alice vote? Or how about we change this particular
[11:03.500 --> 11:08.320]  vote? Or how about we add new votes to this database? And nobody would know because there's
[11:08.320 --> 11:22.280]  no paper backups. It's all electronic, these elections. So to recap, with this SQL injection
[11:22.280 --> 11:29.080]  vulnerability, just to visit, sorry I'll get out of the way, just to visit, just by visiting this
[11:29.080 --> 11:34.860]  one public URL and kind of messing with the parameters a little bit, we're able to do anything
[11:34.860 --> 11:41.720]  to the database. To view how people voted, to submit fake votes, and then to overwrite existing
[11:41.720 --> 11:46.540]  votes, to change how existing people voted. This is a very serious thing. All through that kind of
[11:46.540 --> 11:52.780]  URL parameter and putting special things in there. There's even a little bonus, there's a number four
[11:52.780 --> 12:01.360]  on this. The database is misconfigured in a way that allows an attacker to escape the confines
[12:01.360 --> 12:07.800]  of the database and take full control of the server. So an attacker in this situation can
[12:07.800 --> 12:14.060]  you know even kick out the legitimate owners of the server and disable their user accounts, can
[12:14.060 --> 12:20.060]  install software, they can install a backdoor. A backdoor means that even if the actual vulnerability
[12:20.060 --> 12:25.940]  the URL messing around stuff we've seen earlier, even if the vendor fixes that, if somebody has
[12:25.940 --> 12:31.040]  managed to install a backdoor, an attacker can continue to get in until the backdoor itself is
[12:31.040 --> 12:41.180]  fixed. So they really have total control of this machine. So we were talking about the impact
[12:41.180 --> 12:48.040]  earlier, there's about 2,200 elections affecting, started from 2001. So anybody can see how those
[12:48.040 --> 12:53.040]  elections, or an attacker could see how voters have voted in those elections. Lots of organizations
[12:53.040 --> 12:58.340]  you'd recognize, Teamsters, IBEW, Amnesty International, lots of universities, Yale
[12:58.340 --> 13:05.360]  University example, California State Bar, public pension systems in most of the states out there,
[13:05.360 --> 13:08.300]  and many, many more organizations like this.
[13:16.680 --> 13:23.020]  So in this section of the presentation, I want to talk a lot about a bit about the process of
[13:23.020 --> 13:27.880]  discovering and reporting this vulnerability. It's a very concerning thing, it's a very shocking thing
[13:27.880 --> 13:33.860]  to discover. And when you discover something like this, it's difficult to approach the vendor
[13:33.860 --> 13:38.690]  directly, like who am I to reach out to the vendor and say, hey, everything is broken here. Will they
[13:38.690 --> 13:44.710]  believe me? Will they trust me? Will I be able to reach out to the right person to get a hold of
[13:44.710 --> 13:53.170]  them and get them to pay attention? In this case, I had the assistance of CISA. CISA is an agency
[13:53.170 --> 13:57.690]  part of the Department of Homeland Security, and they do exactly this. And I want to bring them up
[13:57.690 --> 14:02.730]  to, if anybody in this audience is thinking about exploring election vulnerabilities, private or
[14:02.730 --> 14:08.370]  otherwise, they're a fantastic player. They do exactly this. They help researchers like I am
[14:09.170 --> 14:14.010]  disclose vulnerabilities to the vendor. And they're the government, and the vendor pays
[14:14.010 --> 14:18.130]  attention when the Department of Homeland Security is knocking, saying, hey, there's something wrong
[14:18.130 --> 14:22.730]  with your software. And in this case, they very much did, thanks to CISA's help. If you're ever
[14:22.730 --> 14:30.710]  considering doing a vulnerability disclosure, I couldn't say enough good things about them.
[14:30.710 --> 14:35.070]  Very technically savvy team. Very competent. They're amazing to work with.
[14:35.070 --> 14:39.690]  This is the URL. You put your report there, and they'll be in touch to help remediate it.
[14:41.590 --> 14:47.330]  And since we're talking about remediation, I want to give you an update on how things stand
[14:47.330 --> 14:51.910]  with this particular private election vendor that is responsible for a lot of private elections.
[14:52.190 --> 14:56.350]  They have taken steps to remediate the vulnerability we just talked about,
[14:56.350 --> 15:01.770]  by hardening their web application firewall. But one thing they haven't yet done,
[15:01.770 --> 15:06.730]  and I want to highlight, is we don't know if people have exploited this vulnerability.
[15:10.130 --> 15:13.610]  There's certainly the potential there, but we don't know if it's happened. And the only people
[15:13.610 --> 15:19.270]  that really have a chance to know is the vendor. So the vendor has yet to commit to do a forensic
[15:19.270 --> 15:23.950]  audit of their logs to see if there's ever been an attack, if they have evidence of an attack.
[15:23.950 --> 15:28.370]  They haven't committed yet to publicly disclose if they do or don't find something. That's still
[15:28.370 --> 15:37.130]  something that's up in the air. And that's it. I wanted to introduce you to the world of private
[15:37.130 --> 15:40.670]  election software. I'll take some questions from here. But to me, this was a fascinating
[15:40.670 --> 15:57.860]  and intriguing little part of the world. Thank you. Awesome. Oh, yeah. I can hear. I'll repeat
[15:57.860 --> 16:08.570]  your question. Do you know what I'm talking about? Yes, I do. Yeah. Maybe you can talk a
[16:08.570 --> 16:12.050]  little bit about that, where you think it's at. You can just repeat. Sure, sure. You'll say it
[16:12.050 --> 16:18.470]  better than me. Yeah, absolutely. The question is around pending legislation that will require
[16:18.990 --> 16:24.090]  organizations to disclose vulnerabilities like this. Or when they've been breached and what was
[16:24.090 --> 16:27.810]  grabbed. Yeah, when they've been breached and what was grabbed. I don't know the exact details,
[16:27.810 --> 16:33.150]  but it's my understanding that the legislation that's most likely to pass only affects public
[16:33.150 --> 16:39.410]  companies, which this organization is not. There's a lot of these random one-off vendors. This is a
[16:39.410 --> 16:44.850]  very small organization. They're probably like a 10-15 person company. And I don't know if you're
[16:44.850 --> 16:50.570]  familiar with that XKCD comic where there's like a whole pile of things that are built up. And then
[16:50.570 --> 16:55.310]  there's that one little note at the bottom that everything depends on. It's very much like this.
[16:55.310 --> 16:58.330]  I don't know if that legislation would affect them, but I wouldn't be surprised if they're
[16:58.330 --> 17:01.970]  exempt from it. Because they're just such a tiny player, but so many of us depend
[17:01.970 --> 17:06.210]  on them doing their job right and paying attention and kind of having scrutiny on that. So
[17:06.210 --> 17:10.010]  I don't know if it affects them directly. I don't know if you knew, because it's been
[17:17.610 --> 17:23.410]  blocked. That's right, yeah. Today the comment here was that many organizations are not required
[17:23.410 --> 17:27.650]  to disclose a breach when it happens. And suddenly you just find your information on the dark web,
[17:27.650 --> 17:32.110]  and you might not even know which organization is responsible for it, right? That is very much
[17:32.110 --> 17:41.750]  the status quo. We do need to get that fixed for sure. Fantastic. Yeah, absolutely. Thank you so
[17:41.750 --> 17:45.550]  much for the work that you've done. Thank you. You're why I'm here. You're a hero. This is
[17:45.550 --> 17:50.590]  amazing, right? Thank you. I looked up the CVE. I've noticed that it's not disclosed yet. Thank
[17:50.590 --> 17:57.910]  you for doing responsible disclosure. My question is, has the vendor been giant jerks about this,
[17:57.910 --> 18:02.470]  or have they been like, oh, wow, thank you, we can fix this, given a timeline, etc.?
[18:02.470 --> 18:09.430]  Yeah, the question was, how has the vendor responded to this? And the response, I think,
[18:09.430 --> 18:14.230]  has been quite effective, in big part because CISA is involved. So I want to emphasize again,
[18:14.230 --> 18:18.750]  if you're thinking of doing this, involve an organization like CISA. They're fantastic.
[18:19.350 --> 18:24.390]  They've been taking steps at remediating the vulnerabilities we talked about here, but
[18:24.690 --> 18:30.410]  a lot of their systems are just very old. They run on a very old version, very old database called
[18:30.410 --> 18:35.870]  Sybase. And it's missing a lot of the security features we expect in modern databases. But
[18:35.870 --> 18:39.250]  they're just stuck with it. You know, they built this thing decades ago, and it's working,
[18:39.250 --> 18:44.010]  at least, you know, working, but still has security problems, right? So they're in this
[18:44.010 --> 18:47.610]  tough spot where they're trying to fight their demons in their tech debt that they have,
[18:47.610 --> 18:52.890]  and make the best out of that. So my impression is that they're earnestly trying, but also
[18:52.890 --> 18:59.110]  the tech stack is in a difficult position for them to quickly remediate everything completely.
[19:00.410 --> 19:01.930]  Does that answer your question?
[19:05.150 --> 19:13.670]  So since we can't read up on the CVE yet, you're not wanting to tell us what company that is?
[19:13.670 --> 19:19.270]  That's right. I'd rather not disclose the company since I want to give them a chance to do as many
[19:19.270 --> 19:22.590]  steps as they can, fully resolving the vulnerability. They've done a lot. There's
[19:22.590 --> 19:25.490]  still some stuff on their plate. I don't want to give them a chance.
[19:25.850 --> 19:27.730]  The election community might want to know.
[19:27.730 --> 19:32.150]  Absolutely. I will publish a paper with the full details, including naming the vendor.
[19:36.950 --> 19:42.050]  So have you recommended to them and or they recommended their customers mitigating controls?
[19:42.190 --> 19:46.570]  So I mean, simply put it behind a WAF, right? Like that would help quite a bit.
[19:46.610 --> 19:47.050]  Yeah.
[19:47.070 --> 19:48.250]  Attempts for SQL Induction.
[19:48.250 --> 19:51.910]  I think there's two questions here.
[19:52.130 --> 19:58.230]  Has a vendor alerted their customers here and have they put it behind a WAF?
[19:58.230 --> 19:59.650]  Is that capturing the questions?
[19:59.650 --> 20:00.050]  Yeah.
[20:00.190 --> 20:01.310]  So let me start with the second one.
[20:01.310 --> 20:02.390]  They have put it behind a WAF.
[20:02.390 --> 20:04.930]  That's been pretty effective, but there's still stuff to do.
[20:05.230 --> 20:07.590]  On the first question, they're planning a public announcement.
[20:07.590 --> 20:08.790]  I haven't seen it live yet.
[20:08.790 --> 20:10.370]  They know that this talk is happening.
[20:11.810 --> 20:17.490]  I don't think the customers have been made aware yet, but they are planning to make them aware.
[20:18.250 --> 20:22.570]  And there's also a CISA alert that's going out Monday covering this.
[20:22.570 --> 20:23.770]  So, yeah.
[20:27.130 --> 20:30.630]  In today's times, I don't know.
[20:30.630 --> 20:35.910]  It seems to me, I personally, do you find it embarrassing that companies are still
[20:35.910 --> 20:39.790]  having basic SQL injection vulnerabilities?
[20:40.110 --> 20:45.650]  The question is, do I find it embarrassing that companies still have SQL injection vulnerabilities?
[20:45.650 --> 20:47.070]  Yes, absolutely.
[20:47.070 --> 20:47.510]  It is.
[20:47.510 --> 20:48.250]  This is nuts.
[20:48.250 --> 20:49.090]  This is crazy.
[20:49.090 --> 20:52.870]  You go to a website, and you type stuff in the URL, and you have access to the database.
[20:52.870 --> 20:54.330]  This is insanity.
[20:54.530 --> 20:58.250]  And we've known about these failures for a very, very long time.
[20:58.250 --> 21:01.430]  But it kind of goes back to this concept I was saying earlier.
[21:01.430 --> 21:06.090]  There's just these random vendors you've never heard about in some nook of the world
[21:06.090 --> 21:08.810]  that so many critical things depend on.
[21:08.810 --> 21:12.070]  And they've been operating this business for decades, and it works.
[21:12.070 --> 21:14.550]  And they're not necessarily growing their business.
[21:14.550 --> 21:16.590]  They've sort of captured all the business there is to grow.
[21:16.590 --> 21:19.610]  They don't really have incentive to tear it down and make it better.
[21:19.610 --> 21:20.750]  It's just it's working.
[21:20.790 --> 21:24.950]  There's a lot of things like this, especially in critical infrastructure.
[21:25.190 --> 21:26.690]  So it is an embarrassment.
[21:26.690 --> 21:29.350]  But I also don't see it going away very much.
[21:29.890 --> 21:30.650]  Yeah.
[21:31.030 --> 21:31.790]  Yeah.
[21:33.150 --> 21:34.410]  Hey, thank you for the talk.
[21:34.410 --> 21:35.590]  That was really cool.
[21:36.090 --> 21:40.610]  So now that you've found this vulnerability in one of the, as you said, many vendors,
[21:40.610 --> 21:44.710]  have you considering doing it systematically for all the other online vendors,
[21:44.710 --> 21:48.170]  just to see if this maybe is more widespread than just this one?
[21:48.170 --> 21:49.850]  I have. I definitely have.
[21:49.990 --> 21:54.050]  There is one vendor that has a formal bug bounty program,
[21:54.050 --> 22:01.170]  and their system gets a lot more attention from security researchers
[22:01.170 --> 22:02.910]  because there's a bit of money there.
[22:03.590 --> 22:06.350]  So there's definitely opportunity to research this.
[22:06.410 --> 22:08.990]  I haven't gone as deep as I wanted to,
[22:08.990 --> 22:10.550]  because this has been so all-consuming,
[22:10.550 --> 22:13.410]  and especially helping the vendor get to the finish line and remediation
[22:13.410 --> 22:15.430]  has been most of what I've been focused on.
[22:15.790 --> 22:25.630]  I think we're good then.
[22:25.630 --> 22:27.170]  Yeah, thank you very much.