WEBVTT 00:09.470 --> 00:12.450 All right, we're going to get our next session started. 00:12.450 --> 00:27.390 It is my great pleasure to introduce Schema, who is going to be talking to us about flaws in a commercial voting system and how that can make its way into civil elections in the U.S. 00:27.390 --> 00:29.270 So this is some really interesting work. 00:29.270 --> 00:31.470 We were talking about online voting earlier. 00:31.630 --> 00:33.190 Now we have an example. 00:34.650 --> 00:35.190 Awesome. 00:35.190 --> 00:36.010 Thank you, Matt. 00:39.060 --> 00:40.680 How are we doing on volume? 00:40.680 --> 00:41.540 You guys hear me? 00:41.680 --> 00:42.240 Perfect. 00:42.280 --> 00:42.960 Fantastic. 00:42.960 --> 00:43.520 All right. 00:43.520 --> 00:44.300 I'm Schema. 00:44.300 --> 00:46.000 I'm super excited to be here. 00:46.180 --> 00:58.640 I've been attending DEF CON for a long time, but I'm excited to present, excited to take you on this journey of this kind of little pocket of the world that many people don't know about, including I didn't know about this. 00:58.640 --> 01:00.820 I'm excited to bring you on that journey. 01:01.420 --> 01:05.300 So at the root, elections are about power and influence. 01:05.500 --> 01:09.080 And we elect the best to lead us and put their trust in them. 01:09.080 --> 01:11.480 And with that trust comes a lot of controls. 01:11.960 --> 01:16.500 Since there's so much potential for abuse, we have controls around the power that comes with elections. 01:16.880 --> 01:21.480 But there's an area of elections where those controls are much weaker. 01:21.840 --> 01:25.280 And this is an area that doesn't get discussed at places like this. 01:25.280 --> 01:27.340 And I want to bring it out of the shadows. 01:27.340 --> 01:30.060 And that's private elections. 01:30.240 --> 01:34.200 So private elections are elections for private organizations. 01:34.200 --> 01:42.600 So think unions, Amnesty International, Harvard University, tons and tons of organizations elect their leaders. 01:42.980 --> 01:46.280 And the way those election works are very different than civil elections. 01:46.280 --> 01:49.240 And as we're going to see, there's some problems there. 01:49.800 --> 01:52.780 So first, I want to touch on why does this matter? 01:52.780 --> 01:55.260 Why should we care about private elections? 01:55.820 --> 01:58.160 Let's imagine you're a foreign adversary. 01:58.160 --> 02:08.120 And on one side, you have the option of, you know, co-opting state and local election, maybe getting a random congressman in a state that matters elected. 02:08.120 --> 02:09.640 And that's kind of interesting. 02:10.820 --> 02:13.900 On the other side, you have Harvard, these big NGOs. 02:13.900 --> 02:21.460 You can get to elect the president of Harvard University and a lot of these national and international organizations that are very influential. 02:22.080 --> 02:27.140 That second bucket has some very rich targets if you're a foreign adversary. 02:29.840 --> 02:37.840 Not only are the organizations themselves interesting as a place of influence, but private elections... I'm sorry, I hope you can hear me. 02:37.840 --> 02:41.620 Private elections are a stepping stone to major political offices. 02:42.080 --> 02:45.240 So here we have Justin Kitanji Brown-Jackson. 02:45.240 --> 02:47.400 She started on the Harvard board of overseer. 02:47.400 --> 02:51.460 That's how she started to kind of gain influence and eventually came to be on the Supreme Court. 02:51.460 --> 02:55.920 We have people that are involved with the American Medical Association, senators now. 02:56.960 --> 02:59.880 Ambassadors that got their start on these private elections. 02:59.880 --> 03:06.100 They're the stepping stone for a lot of big major positions in U.S. 03:06.100 --> 03:06.920 society. 03:08.680 --> 03:14.240 So private elections have much less controls and scrutiny than traditional civil elections. 03:14.240 --> 03:19.500 And as we're going to see in this talk, their technical systems are highly vulnerable. 03:20.000 --> 03:20.840 Yeah. 03:21.080 --> 03:28.960 In this talk, I'm going to disclose a brand new zero-day vulnerability in a major provider of election software, private election software. 03:31.660 --> 03:33.200 The CVE number is here. 03:33.200 --> 03:34.740 This is a live CVE. 03:34.740 --> 03:37.420 There are approximately 2,000 elections that are affected. 03:37.420 --> 03:40.900 They're both civil elections, the kinds you're familiar with, and private elections. 03:40.900 --> 03:46.200 But this vendor runs many of many private elections. 03:46.200 --> 03:51.810 So we're going to focus on that part since it's so exploitable and such an interesting part that we don't talk a lot about. 03:55.190 --> 03:56.110 All right. 03:56.110 --> 04:10.910 Well, before we go diving deeper into private elections and what they are, I want to first make the point of just how much work is involved in the traditional way of spying, the traditional way of gaining influence in the U.S. 04:11.270 --> 04:24.290 Here we have this operation, this FBI operation, FBI Operation Ghost Story, where they caught a group of 10 Russian spies that had spent decades building their cover in the U.S. 04:24.290 --> 04:30.210 And because this is public information, we can kind of dig deep into just how much work was put into doing this. 04:33.440 --> 04:36.860 One of the spies is this gentleman here, Andre. 04:37.180 --> 04:40.160 He went by the name of Donald Howard Heathfield. 04:40.160 --> 04:41.340 That's a fake name. 04:41.340 --> 04:43.440 That's the name of a Canadian deceased person. 04:43.440 --> 04:45.200 So step one, you want to be a spy. 04:45.200 --> 04:47.960 You got to find some name and identity to take over. 04:48.080 --> 04:51.820 Step two, he got a degree at Harvard to get that legitimacy. 04:51.820 --> 04:55.980 So step two, you actually have to be admitted to Harvard, actually do the studying. 04:56.240 --> 04:57.800 And we're only in step two. 04:57.860 --> 04:58.940 Then he married. 04:58.940 --> 05:00.180 So he married in the U.S. 05:00.180 --> 05:02.580 He had children, legitimate children in the U.S. 05:02.580 --> 05:05.340 His children didn't know he was a spy, didn't know he was a Russian. 05:05.400 --> 05:07.100 Children believed the whole story. 05:07.680 --> 05:11.180 He bought a house out here and then he worked his way up like everybody. 05:11.180 --> 05:16.460 He started at the bottom of a company and then kind of moved his way up and eventually got more and more influence. 05:16.460 --> 05:19.100 He spent 20 years, 20 plus years doing this. 05:19.100 --> 05:22.080 This is what it takes to do things the traditional way. 05:22.300 --> 05:29.120 There's a lot of energy because there's so much, so much opportunity here to have tentacles everywhere in the U.S. 05:29.480 --> 05:32.440 Foreign adversaries spend a lot of time doing this. 05:37.870 --> 05:46.750 So if you wanted to become a spy in the U.S., there's that kind of path A, the traditional path, the laundry list of things, the decades you need to put in to get in that position. 05:47.690 --> 05:51.150 But if you want to take the shortcut, just become an elected official. 05:51.150 --> 05:54.170 Become an elected official of a private organization. 05:54.430 --> 05:55.890 Go straight to the top. 05:57.410 --> 05:58.510 I'm sorry. 05:59.670 --> 06:00.950 It is funny. 06:02.750 --> 06:09.970 So if you were to take that path B, here's the menu of organizations that you could put your people in and top leadership positions. 06:09.970 --> 06:14.990 You have unions, big major unions, auto workers unions, all sorts of industries. 06:15.330 --> 06:17.550 NGOs, we talked about those. 06:17.550 --> 06:20.570 Universities, all the major universities elect their leadership. 06:20.790 --> 06:26.490 Corporation, professional bodies, the associations that govern who gets to be a doctor, who gets to be a lawyer. 06:26.490 --> 06:28.790 You could put your people in those positions. 06:28.790 --> 06:32.450 Pension funds, billions of dollars that gets spent. 06:32.450 --> 06:35.410 You could have your people deciding where that money goes. 06:35.430 --> 06:36.310 This is attractive. 06:36.310 --> 06:37.250 I want this. 06:37.250 --> 06:38.330 I'm interested. 06:38.710 --> 06:41.290 And I'm sure a foreign adversary is, too. 06:45.560 --> 06:59.200 So now that we've established that these elections are influential and juicy targets for a foreign adversary, I want to make a second point, which is that these elections are a lot easier to attack than traditional civil elections. 06:59.960 --> 07:02.240 The big reason is polling. 07:02.600 --> 07:07.380 Traditional elections have a lot of polling, third-party polling, leading up to the elections. 07:07.440 --> 07:12.280 By the day the election comes, we already kind of know who's going to win. 07:12.500 --> 07:15.340 And there's a lot of visibility and focus on that. 07:15.340 --> 07:17.940 And if things don't line up with the polls, people are going to notice. 07:17.940 --> 07:19.180 There's a lot of scrutiny. 07:19.440 --> 07:21.580 There's no polling in private elections. 07:21.980 --> 07:23.140 These are a lot more open. 07:23.140 --> 07:26.480 And these elections are all electronic, no paper record. 07:26.800 --> 07:31.000 I think the crowd knows how dangerous all electronic elections are. 07:31.000 --> 07:31.960 And here we have it. 07:31.960 --> 07:43.900 We have just this explosive mix of very powerful positions, no way to reconcile whether those numbers make any sense with third-party polling, and all electronic elections. 07:43.900 --> 07:45.760 To me, that's pretty scary. 07:49.140 --> 07:52.380 If you're like me, you've never heard about private elections before this. 07:52.380 --> 07:53.860 I definitely haven't. 07:53.860 --> 08:01.320 It's kind of the boring areas like this that foreign adversaries actually tend to attack, rather than the very visible things. 08:06.960 --> 08:13.940 So far we've been discussing a theoretical vulnerability in election software. 08:14.320 --> 08:16.580 I want to get to the practical now. 08:16.700 --> 08:25.540 In this part of the talk, I'm going to disclose a zero-day vulnerability in one of the big major providers of private election software. 08:25.700 --> 08:29.400 I mentioned earlier, there are about 2,000 elections affected. 08:29.400 --> 08:30.860 It's a live CVE. 08:31.060 --> 08:36.960 And to tell you the story about this, I want to tell you about my journey, about how I discovered this. 08:37.240 --> 08:51.200 I voted in one of these private elections, and I realized that there's basically this one vendor that handles all these private elections you've never heard about, but are very important and influential. 08:51.560 --> 08:53.420 And this is what the process looks like. 08:53.420 --> 08:54.960 You just go to some website. 08:55.200 --> 08:57.580 This is an election for the state bar of Texas. 08:57.780 --> 08:58.960 It's a public URL. 08:58.960 --> 09:04.280 You just go to this special web page, and then you put in your information here, click submit, and you vote. 09:04.280 --> 09:04.900 And that's it. 09:04.900 --> 09:07.180 That's the whole story. 09:07.860 --> 09:09.520 I voted in one of these elections. 09:09.520 --> 09:14.440 My university has their alumni vote on the leadership of the organization. 09:14.500 --> 09:21.000 So I went to a page very similar to this, put in my information, and I made a typo in the information I put in. 09:21.960 --> 09:23.960 And I got to this error page. 09:24.260 --> 09:29.260 Now, the error page isn't so interesting, but the part that is interesting is the URL. 09:29.980 --> 09:31.160 And I want to tell you about that. 09:31.160 --> 09:36.240 So if we focus on that for a second, this is what that URL looks like. 09:37.380 --> 09:41.500 And there's two parameters, but there's this one parameter here that just has a bunch of numbers. 09:41.500 --> 09:46.820 It doesn't seem so interesting, but I may be being a little too curious a person. 09:46.820 --> 09:48.840 I'm sure this audience can relate. 09:49.680 --> 10:06.660 If you start playing around with these parameters and start putting code in that parameter, rather than the normal numbers the system expects, if you start putting code in that, in this case, if we put an instruction to wait for 30 seconds, the software actually executes that instruction. 10:07.740 --> 10:09.180 It's crazy. 10:09.180 --> 10:14.720 I mean, we just put something, a random thing in the URL, and we got the software to actually run that code. 10:17.080 --> 10:24.720 Now, getting the software to wait 30 seconds is pretty innocuous, but I, as a security researcher, know how serious a thing that is. 10:24.720 --> 10:26.860 This is called an SQL injection. 10:28.140 --> 10:39.380 And what it means is that, you know, in a traditional way a system works, there's the database that has all the important information about the system, about who voted and how they voted and so on. 10:39.420 --> 10:42.200 And then there's software that's a gatekeeper of that. 10:42.440 --> 10:51.840 So if a regular user tries to ask information they're not entitled to, like how did the X person vote, the gatekeeper makes sure that they're not given that information. 10:52.440 --> 11:01.960 And an SQL injection is really problematic because it allows us to bypass this gatekeeper, to ask the database directly, how did Alice vote? 11:01.960 --> 11:04.400 Or how about we change this particular vote? 11:04.520 --> 11:07.200 Or how about we add new votes to this database? 11:07.200 --> 11:09.460 And nobody would know because there's no paper backups. 11:09.460 --> 11:11.440 It's all electronic, these elections. 11:20.080 --> 11:35.860 So to recap, with this SQL injection vulnerability, just to visit, sorry I'll get out of the way, just to visit, just by visiting this one public URL and kind of messing with the parameters a little bit, we're able to do anything to the database. 11:35.960 --> 11:43.720 To view how people voted, to submit fake votes, and then to overwrite existing votes, to change how existing people voted. 11:43.720 --> 11:45.540 This is a very serious thing. 11:45.540 --> 11:49.380 All through that kind of URL parameter and putting special things in there. 11:50.140 --> 11:54.020 There's even a little bonus, there's a number four on this. 11:54.220 --> 12:04.620 The database is misconfigured in a way that allows an attacker to escape the confines of the database and take full control of the server. 12:05.420 --> 12:17.400 So an attacker in this situation can you know even kick out the legitimate owners of the server and disable their user accounts, can install software, they can install a backdoor. 12:17.600 --> 12:31.680 A backdoor means that even if the actual vulnerability the URL messing around stuff we've seen earlier, even if the vendor fixes that, if somebody has managed to install a backdoor, an attacker can continue to get in until the backdoor itself is fixed. 12:31.680 --> 12:34.880 So they really have total control of this machine. 12:39.560 --> 12:46.400 So we were talking about the impact earlier, there's about 2,200 elections affecting, started from 2001. 12:46.520 --> 12:51.820 So anybody can see how those elections, or an attacker could see how voters have voted in those elections. 12:51.980 --> 13:08.300 Lots of organizations you'd recognize, Teamsters, IBEW, Amnesty International, lots of universities, Yale University example, California State Bar, public pension systems in most of the states out there, and many, many more organizations like this. 13:16.680 --> 13:25.260 So in this section of the presentation, I want to talk a lot about a bit about the process of discovering and reporting this vulnerability. 13:25.440 --> 13:28.920 It's a very concerning thing, it's a very shocking thing to discover. 13:29.320 --> 13:38.220 And when you discover something like this, it's difficult to approach the vendor directly, like who am I to reach out to the vendor and say, hey, everything is broken here. 13:38.220 --> 13:39.770 Will they believe me? 13:40.130 --> 13:41.450 Will they trust me? 13:41.450 --> 13:46.370 Will I be able to reach out to the right person to get a hold of them and get them to pay attention? 13:47.070 --> 13:49.970 In this case, I had the assistance of CISA. 13:49.970 --> 13:56.690 CISA is an agency part of the Department of Homeland Security, and they do exactly this. 13:56.750 --> 14:05.230 And I want to bring them up to, if anybody in this audience is thinking about exploring election vulnerabilities, private or otherwise, they're a fantastic player. 14:05.330 --> 14:06.370 They do exactly this. 14:06.370 --> 14:11.950 They help researchers like I am disclose vulnerabilities to the vendor. 14:12.270 --> 14:19.070 And they're the government, and the vendor pays attention when the Department of Homeland Security is knocking, saying, hey, there's something wrong with your software. 14:19.070 --> 14:22.110 And in this case, they very much did, thanks to CISA's help. 14:22.230 --> 14:30.710 If you're ever considering doing a vulnerability disclosure, I couldn't say enough good things about them. 14:30.710 --> 14:32.810 Very technically savvy team. 14:32.810 --> 14:33.670 Very competent. 14:33.670 --> 14:35.070 They're amazing to work with. 14:35.070 --> 14:35.850 This is the URL. 14:35.850 --> 14:39.690 You put your report there, and they'll be in touch to help remediate it. 14:41.590 --> 14:51.910 And since we're talking about remediation, I want to give you an update on how things stand with this particular private election vendor that is responsible for a lot of private elections. 14:52.190 --> 14:59.330 They have taken steps to remediate the vulnerability we just talked about, by hardening their web application firewall. 15:00.090 --> 15:06.730 But one thing they haven't yet done, and I want to highlight, is we don't know if people have exploited this vulnerability. 15:10.130 --> 15:13.030 There's certainly the potential there, but we don't know if it's happened. 15:13.030 --> 15:16.190 And the only people that really have a chance to know is the vendor. 15:17.010 --> 15:23.950 So the vendor has yet to commit to do a forensic audit of their logs to see if there's ever been an attack, if they have evidence of an attack. 15:23.950 --> 15:28.050 They haven't committed yet to publicly disclose if they do or don't find something. 15:28.050 --> 15:29.870 That's still something that's up in the air. 15:34.470 --> 15:35.330 And that's it. 15:35.330 --> 15:37.910 I wanted to introduce you to the world of private election software. 15:37.910 --> 15:39.090 I'll take some questions from here. 15:39.090 --> 15:42.910 But to me, this was a fascinating and intriguing little part of the world. 15:42.910 --> 15:43.730 Thank you. 15:52.720 --> 15:53.440 Awesome. 15:55.080 --> 15:55.900 Oh, yeah. 15:55.900 --> 15:56.660 I can hear. 15:57.200 --> 15:58.380 I'll repeat your question. 15:58.380 --> 16:06.990 Do you know what I'm talking about? 16:06.990 --> 16:07.350 Yes, I do. 16:07.350 --> 16:07.610 Yeah. 16:07.610 --> 16:10.190 Maybe you can talk a little bit about that, where you think it's at. 16:10.190 --> 16:11.210 You can just repeat. 16:11.210 --> 16:11.530 Sure, sure. 16:11.530 --> 16:12.430 You'll say it better than me. 16:12.430 --> 16:13.350 Yeah, absolutely. 16:13.650 --> 16:21.930 The question is around pending legislation that will require organizations to disclose vulnerabilities like this. 16:21.930 --> 16:24.250 Or when they've been breached and what was grabbed . 16:24.250 --> 16:26.410 Yeah, when they've been breached and what was grabbed. 16:26.490 --> 16:36.270 I don't know the exact details, but it's my understanding that the legislation that's most likely to pass only affects public companies, which this organization is not. 16:36.610 --> 16:38.870 There's a lot of these random one-off vendors. 16:38.870 --> 16:40.810 This is a very small organization. 16:41.210 --> 16:44.090 They're probably like a 10-15 person company. 16:44.090 --> 16:50.190 And I don't know if you're familiar with that XKCD comic where there's like a whole pile of things that are built up. 16:50.190 --> 16:53.730 And then there's that one little note at the bottom that everything depends on. 16:53.730 --> 16:55.310 It's very much like this. 16:55.310 --> 16:59.150 I don't know if that legislation would affect them, but I wouldn't be surprised if they're exempt from it. 16:59.150 --> 17:06.210 Because they're just such a tiny player, but so many of us depend on them doing their job right and paying attention and kind of having scrutiny on that. 17:06.210 --> 17:07.850 So I don't know if it affects them directly. 17:07.850 --> 17:10.010 I don't know if you knew, because it's been 17:17.610 --> 17:18.190 blocked. 17:18.310 --> 17:19.210 That's right, yeah. 17:19.490 --> 17:25.350 Today the comment here was that many organizations are not required to disclose a breach when it happens. 17:25.350 --> 17:31.230 And suddenly you just find your information on the dark web, and you might not even know which organization is responsible for it, right? 17:31.330 --> 17:33.170 That is very much the status quo. 17:33.170 --> 17:34.850 We do need to get that fixed for sure. 17:37.250 --> 17:38.050 Fantastic. 17:39.630 --> 17:40.850 Yeah, absolutely. 17:41.010 --> 17:43.010 Thank you so much for the work that you've done. 17:43.010 --> 17:43.470 Thank you. 17:43.470 --> 17:44.510 You're why I'm here. 17:44.510 --> 17:45.270 You're a hero. 17:45.270 --> 17:46.310 This is amazing, right? 17:46.310 --> 17:46.970 Thank you. 17:47.110 --> 17:48.530 I looked up the CVE. 17:48.530 --> 17:50.450 I've noticed that it's not disclosed yet. 17:50.450 --> 17:52.270 Thank you for doing responsible disclosure. 17:52.490 --> 18:02.470 My question is, has the vendor been giant jerks about this, or have they been like, oh, wow, thank you, we can fix this, given a timeline, etc.? 18:02.470 --> 18:07.870 Yeah, the question was, how has the vendor responded to this? 18:07.870 --> 18:12.810 And the response, I think, has been quite effective, in big part because CISA is involved. 18:12.810 --> 18:17.530 So I want to emphasize again, if you're thinking of doing this, involve an organization like CISA. 18:17.530 --> 18:18.750 They're fantastic. 18:19.350 --> 18:26.910 They've been taking steps at remediating the vulnerabilities we talked about here, but a lot of their systems are just very old. 18:26.990 --> 18:31.430 They run on a very old version, very old database called Sybase. 18:31.990 --> 18:35.750 And it's missing a lot of the security features we expect in modern databases. 18:35.750 --> 18:36.790 But they're just stuck with it. 18:36.790 --> 18:43.230 You know, they built this thing decades ago, and it's working, at least, you know, working, but still has security problems, right? 18:43.350 --> 18:49.270 So they're in this tough spot where they're trying to fight their demons in their tech debt that they have, and make the best out of that. 18:49.270 --> 18:59.110 So my impression is that they're earnestly trying, but also the tech stack is in a difficult position for them to quickly remediate everything completely. 19:00.410 --> 19:01.930 Does that answer your question? 19:05.150 --> 19:13.670 So since we can't read up on the CVE yet, you're not wanting to tell us what company that is? 19:13.670 --> 19:14.110 That's right. 19:14.110 --> 19:21.650 I'd rather not disclose the company since I want to give them a chance to do as many steps as they can, fully resolving the vulnerability. 19:21.650 --> 19:22.410 They've done a lot. 19:22.410 --> 19:24.030 There's still some stuff on their plate. 19:24.030 --> 19:25.490 I don't want to give them a chance. 19:25.850 --> 19:27.730 The election community might want to know. 19:27.730 --> 19:28.350 Absolutely. 19:28.350 --> 19:32.150 I will publish a paper with the full details, including naming the vendor. 19:36.950 --> 19:42.050 So have you recommended to them and or they recommended their customers mitigating controls? 19:42.190 --> 19:44.370 So I mean, simply put it behind a WAF, right? 19:44.370 --> 19:46.570 Like that would help quite a bit. 19:46.610 --> 19:47.050 Yeah . 19:47.070 --> 19:48.250 Attempts for SQL Induction. 19:48.250 --> 19:51.910 I think there's two questions here. 19:52.130 --> 19:58.230 Has a vendor alerted their customers here and have they put it behind a WAF? 19:58.230 --> 19:59.650 Is that capturing the questions? 19:59.650 --> 20:00.050 Yeah. 20:00.190 --> 20:01.310 So let me start with the second one. 20:01.310 --> 20:02.390 They have put it behind a WAF. 20:02.390 --> 20:04.930 That's been pretty effective, but there's still stuff to do. 20:05.230 --> 20:07.590 On the first question, they're planning a public announcement. 20:07.590 --> 20:08.790 I haven't seen it live yet. 20:08.790 --> 20:10.370 They know that this talk is happening. 20:11.810 --> 20:17.490 I don't think the customers have been made aware yet, but they are planning to make them aware. 20:18.250 --> 20:22.570 And there's also a CISA alert that's going out Monday covering this. 20:22.570 --> 20:23.770 So , yeah. 20:27.130 --> 20:30.630 In today's times, I don't know. 20:30.630 --> 20:39.790 It seems to me, I personally, do you find it embarrassing that companies are still having basic SQL injection vulnerabilities? 20:40.110 --> 20:45.650 The question is, do I find it embarrassing that companies still have SQL injection vulnerabilities? 20:45.650 --> 20:47.070 Yes, absolutely. 20:47.070 --> 20:47.510 It is. 20:47.510 --> 20:48.250 This is nuts. 20:48.250 --> 20:49.090 This is crazy. 20:49.090 --> 20:52.870 You go to a website, and you type stuff in the URL, and you have access to the database. 20:52.870 --> 20:54.330 This is insanity. 20:54.530 --> 20:58.250 And we've known about these failures for a very, very long time. 20:58.250 --> 21:01.430 But it kind of goes back to this concept I was saying earlier. 21:01.430 --> 21:08.810 There's just these random vendors you've never heard about in some nook of the world that so many critical things depend on. 21:08.810 --> 21:12.070 And they've been operating this business for decades, and it works. 21:12.070 --> 21:14.550 And they're not necessarily growing their business. 21:14.550 --> 21:16.590 They've sort of captured all the business there is to grow. 21:16.590 --> 21:19.610 They don't really have incentive to tear it down and make it better. 21:19.610 --> 21:20.750 It's just it's working. 21:20.790 --> 21:24.950 There's a lot of things like this, especially in critical infrastructure. 21:25.190 --> 21:26.690 So it is an embarrassment. 21:26.690 --> 21:29.350 But I also don't see it going away very much. 21:29.890 --> 21:30.650 Yeah. 21:31.030 --> 21:31.790 Yeah. 21:33.150 --> 21:34.410 Hey, thank you for the talk. 21:34.410 --> 21:35.590 That was really cool. 21:36.090 --> 21:48.170 So now that you've found this vulnerability in one of the, as you said, many vendors, have you considering doing it systematically for all the other online vendors, just to see if this maybe is more widespread than just this one? 21:48.170 --> 21:48.530 I have. 21:48.530 --> 21:49.850 I definitely have. 21:49.990 --> 22:02.910 There is one vendor that has a formal bug bounty program, and their system gets a lot more attention from security researchers because there's a bit of money there. 22:03.590 --> 22:06.350 So there's definitely opportunity to research this. 22:06.410 --> 22:15.430 I haven't gone as deep as I wanted to, because this has been so all-consuming, and especially helping the vendor get to the finish line and remediation has been most of what I've been focused on. 22:15.790 --> 22:15.890 I 22:23.890 --> 22:25.630 think we're good then. 22:25.630 --> 22:27.170 Yeah, thank you very much.