Speaker 1: Hey everyone, and welcome back. Yeah, welcome back to another
Speaker 1: deep dive.
Speaker 2: It's a deep dive.
Speaker 1: You ready to get our hands dirty with some Oh
Speaker 1: yeah absolutely or p ORC or GTFO volume three.
Speaker 2: Yeah, digging right back in all right.
Speaker 1: So just a reminder for listeners just joining us for
Speaker 1: the first time, right, p WORC or GTFO Volume three
Speaker 1: is a book.
Speaker 2: It is a book, a real book. You can hold it.
Speaker 1: It's fantastic.
Speaker 2: Yeah.
Speaker 1: It's a collection of various security research and kind of
Speaker 1: proofs of concept, absolutely, and different kind of just deep
Speaker 1: dives into various aspects of security.
Speaker 2: Yep, and some hardware hacking.
Speaker 1: Yeah, hard we're hacking all sorts of things.
Speaker 2: Yeah, it's a really cool collection, really cool. Yeah.
Speaker 1: So we're going to kind of jump around to different
Speaker 1: sections from the book that that were really interesting. So
Speaker 1: you get a little sampler platter, Yeah.
Speaker 2: A little taste of everything.
Speaker 1: Hopefully to entice you to go check out the book
Speaker 1: for yourself.
Speaker 2: Yeah. Okay, so let's jump in.
Speaker 1: Let's jump right in. Yeah. First one we have is
Speaker 1: this one was interesting to me just because.
Speaker 2: That the target was so unexpected, unexpected, unexpected. Yeah, a
Speaker 2: children's toy.
Speaker 1: Yeah, who would have thought?
Speaker 2: So we have the uh, it's the Pokemon z Ring,
Speaker 2: that's right.
Speaker 1: And this is security researcher named Vicky Fou who actually
Speaker 1: decided to look into this and to break it, to
Speaker 1: break it, figure out how it worked, and.
Speaker 2: See what's going on.
Speaker 1: So what's interesting about the z ring is it uses
Speaker 1: ultrasonic frequencies which.
Speaker 2: Most people can't hear. Yeah, you and I probably can't hear.
Speaker 1: Yeah, we're getting old, I know, I know.
Speaker 2: And so she had to actually use a special equipment
Speaker 2: like in acilloscope to be able to see these sound waves.
Speaker 1: In an emulator to run the game and.
Speaker 2: An emulator, and so that she could really cool Yeah
Speaker 2: she could.
Speaker 1: I mean, it's just amazing to me. She went to
Speaker 1: these lengths to figure this out, but it paid off
Speaker 1: because she discovered some really interesting stuff.
Speaker 2: Yeah. So I guess kind of the first question.
Speaker 1: Like why why go to all this trouble for right?
Speaker 2: Right? Why break a kid's.
Speaker 1: To a children's toy? Yeah? What I think the you know,
Speaker 1: the answer is the same for a lot of security researchers.
Speaker 2: Curiosity. That's what drives a lot of this.
Speaker 1: It's just that curiosity of how does this thing work?
Speaker 2: Yeah? How does it work. What are its secrets?
Speaker 1: Yeah, what are its secrets?
Speaker 2: Can I control it? Can I make it do something
Speaker 2: it wasn't intended to do?
Speaker 1: Exactly? So I think for her it was kind of
Speaker 1: a personal challenge of like, yeah, okay, this thing uses sound.
Speaker 1: I want to figure out what sounds, what a secret
Speaker 1: sound it's using, and how it's doing.
Speaker 2: That, and how can I use those sound Yeah, kind
Speaker 2: of replicate that to do something else, right, exactly.
Speaker 1: So pretty cool.
Speaker 2: It is cool.
Speaker 1: Okay, So moving on to another one that I thought
Speaker 1: was really interesting and a little mind bending.
Speaker 2: This one's a little more technical.
Speaker 1: Yeah it is. This is the flush plus reload side
Speaker 1: channel attack.
Speaker 2: Wow.
Speaker 1: Yeah, So side channel attacks in general are just fascinating.
Speaker 2: Yeah, side channel attacks because.
Speaker 1: They're not what you think about when you think about
Speaker 1: like typical hacking.
Speaker 3: Right, it's not not like breaking You're not like breaking
Speaker 3: down the door, right.
Speaker 1: You're not brute forcing a password. Yeah, you're kind of
Speaker 1: like looking for these like subtle little hints that the
Speaker 1: system's giving off.
Speaker 2: Yeah, it's like eavesdropping.
Speaker 1: It is eavesdropping, rather than that's like the spycraft of hacking.
Speaker 2: Yeah exactly. That's really cool.
Speaker 1: So the flesh plus reload attack. Specifically, it kind of
Speaker 1: exploits the way that modern CPUs use this shared memory
Speaker 1: space called the L three cash. Yes, And so the idea.
Speaker 2: Is, so all the programs on your computer are sharing
Speaker 2: the space and accessing it to store data that they're
Speaker 2: using frequently. So it's like a common area.
Speaker 1: Yeah, like a whiteboard that everyone can exactly.
Speaker 2: It's like a whiteboard. And so what the attacker can
Speaker 2: do is they can basically flush a certain piece of
Speaker 2: memory from the cash.
Speaker 1: Force it out of the cash, Yeah, force it out.
Speaker 1: So it's like a racing part of the whiteboard.
Speaker 2: Yeah, raising part of the whiteboard, and then time how
Speaker 2: long it takes.
Speaker 1: And then see how long it takes for somebody else
Speaker 1: to write in that same spot.
Speaker 2: Yeah, for another process to write to that, Because.
Speaker 1: If the victim process was using that data recently, yeah,
Speaker 1: it's going to reload it back into the cash and
Speaker 1: it's going to be faster, and that's going to be faster.
Speaker 2: And so by timing how long that takes.
Speaker 1: You can infer it. You can infer what the victim
Speaker 1: process was doing.
Speaker 2: Yeah, what data they were accessing. That's crazy, it is crazy.
Speaker 2: It's like, so you can still data.
Speaker 1: Without even without directly accessing.
Speaker 2: It, directly accessing memory.
Speaker 1: Yeah, you're just watching. It's just like you're just watching
Speaker 1: what's happening in this shared space.
Speaker 2: You're watching the patterns of access.
Speaker 1: Exactly and inferring information from that.
Speaker 2: Yeah, that's so cool.
Speaker 1: It is cool, but also kind of scary.
Speaker 2: Well, yeah, a little bit scary because.
Speaker 1: It means that our systems are leaking information in ways
Speaker 1: that you don't even realize.
Speaker 2: Yeah, and that it's not just about like securing the
Speaker 2: memory itself. It's about securing.
Speaker 1: Like goal systems, way everything interacts, weigh everything in act,
Speaker 1: timing the patterns, all that stuff. That's right, Okay, it's
Speaker 1: a whole new level of security.
Speaker 2: All right. So now we're gonna jump way back in time,
Speaker 2: way back to the retro days, the retro days of
Speaker 2: the Apple two.
Speaker 1: Ah, the Apple two classic classic, legendary machine.
Speaker 2: Legendary machine. And we have a story here about a
Speaker 2: group of uh, some dedicated hackers, hackers that wanted to
Speaker 2: crack a particular game.
Speaker 1: They did. They wanted to play it for free, gumble Gumball,
Speaker 1: a classic game.
Speaker 2: It was not easy, it was those days.
Speaker 1: Yeah, they didn't have the tools and the Internet that
Speaker 1: we have today.
Speaker 2: Right, they couldn't just they couldn't just google how to
Speaker 2: do it? Google it?
Speaker 1: Yea.
Speaker 2: So they had figured out themselves.
Speaker 1: So what made Gumball so hard?
Speaker 2: Well, the Apple two itself was a limited machine, had
Speaker 2: a very simple processor, not a lot of memory, right,
Speaker 2: so you have to be really clever to do anything
Speaker 2: interesting with it.
Speaker 1: So they had to really understand the system. Oh yeah,
Speaker 1: at a very low level.
Speaker 2: Intimately, you had to know it inside and out.
Speaker 1: So these two researchers, yeah, for Aim and Peter Ferry
Speaker 1: legends really just kind of like, yeah, painstakingly went through
Speaker 1: the code.
Speaker 2: Line by line, Yeah, trying to figure out how the
Speaker 2: protection worked. Yeah, they had to kind of learn the
Speaker 2: secret language of the game, the game's secret link.
Speaker 1: Yeah, it's like being a code breaker, you know, exactly
Speaker 1: back in the war. It's that kind of You've got
Speaker 1: this encrypted message, you've got to figure out the key.
Speaker 2: You've got to figure out the cipher, you've.
Speaker 1: Got to crack the code. And what they did, what
Speaker 1: it was doing, it's amazing.
Speaker 2: Yeah, that's pretty cool.
Speaker 1: It is cool.
Speaker 2: So I guess the.
Speaker 1: So why is the story important today?
Speaker 2: Yeah? So why is this important. You know, why should
Speaker 2: we care about you know, why does this matter to us?
Speaker 2: Some retro hackers cracking this old game on this old system.
Speaker 1: For one thing, it shows that the spirit of hacking
Speaker 1: has been around for a long time. It's not it's
Speaker 1: not a new thing. It's not like kids these days
Speaker 1: with their computers, right, this has been going on since
Speaker 1: the dawn of computing.
Speaker 2: This is like a fundamental human desire. It's about curiosity
Speaker 2: to figure out how things.
Speaker 1: Pushing the limits of what's possible.
Speaker 2: And then I think also it shows that even seemingly
Speaker 2: simple systems can have.
Speaker 1: Like the Apple, it seems simple, you can have these
Speaker 1: like hidden but.
Speaker 2: Under the hood, there's a lot of complexity, complexities in that,
Speaker 2: and if you're willing to dig deep, you can find
Speaker 2: really interesting stuff.
Speaker 1: You can find those and exploit them exactly.
Speaker 2: So it's kind of a it's inspiring. It's inspiring, it
Speaker 2: is it is. Yeah, okay, all right, so let's move
Speaker 2: on to something a little more modern. All right, So
Speaker 2: let's move on to something a little more modern, little
Speaker 2: more high tech.
Speaker 1: And this is an interesting technique.
Speaker 2: Yeah, this is one of my favorites.
Speaker 1: Actually, Zero copy networking.
Speaker 2: Yeah, zero copy networking. So what is it's all about?
Speaker 1: Zero copy networking.
Speaker 2: Yeah, efficiency, getting the most out of your hardware.
Speaker 1: It's kind of like in the realm of high performance, high.
Speaker 2: Performance computing, real time systems.
Speaker 1: Yeah, anything where latency matters, millisecond counts.
Speaker 2: Yeah, this is where zero copy comes in.
Speaker 1: Yeah, because traditional networking involves a lot of copying data.
Speaker 2: Yeah. So the problem that it solves is that normally
Speaker 2: when you send data over a network, right, there's a
Speaker 2: lot of copying that happened.
Speaker 1: From the CPU to the kernel, from.
Speaker 2: The CPU to the CURL, the.
Speaker 1: Kernel to the network card, the network call, all these
Speaker 1: different buffers and all that copying takes time.
Speaker 2: It takes time, it consumes CPU cycles, and it uses resource.
Speaker 1: It slows things down. So zero copy networking.
Speaker 2: So the idea is, can we just skip all that?
Speaker 1: Can we just cut out the middle man the middle man?
Speaker 1: Let the data flow directly from the application memory straight
Speaker 1: from point A to point B to the network card. Yeah,
Speaker 1: without all those extra stops along the way.
Speaker 2: So how do they actually how do they do that?
Speaker 2: Do that?
Speaker 1: Well? It involves a few tricks. Yeah, One is using
Speaker 1: something called DMA.
Speaker 2: DMA direct memory access.
Speaker 1: Direct memory access yeah, which allows the network card to
Speaker 1: access memory right directly without going through the CPU.
Speaker 2: So the CPU can be doing other things exactly.
Speaker 1: The CPU is like, hey, network card, you handle this,
Speaker 1: You handle this.
Speaker 2: I'm busy, I've got other things to do. I'm playing
Speaker 2: a game over here.
Speaker 1: I'm rendering this video.
Speaker 2: Don't bother me. So DMA is one part of it, right.
Speaker 2: Another part is using specialized drivers okay, like PFR im PFR,
Speaker 2: which are designed specifically for high performance networking. They bypass
Speaker 2: a lot of the traditional networking stacks.
Speaker 1: So they cut out all all.
Speaker 2: The layers, the bureaucracy of the networking.
Speaker 1: Stack, the unnecessary red tape.
Speaker 2: Exactly, just get the data where it needs to go.
Speaker 2: Just get the data there as fast as possible. That's
Speaker 2: the goal.
Speaker 1: So what kind of applications would this be really useful for?
Speaker 2: Oh, so many things, so many things. Think about like
Speaker 2: high frequency trading where microseconds matter, milliseconds matter. If you
Speaker 2: can shave off right, if you can get you're trade in,
Speaker 2: you can make a lot of money a few milliseconds
Speaker 2: before the other guy.
Speaker 1: Real time streaming. You don't want your video to lag.
Speaker 2: Yeah, you don't want You want it to be smooth buffering.
Speaker 1: Yeah, so any application gaming aiming where you need that
Speaker 1: low latency.
Speaker 2: Where low latency is critical. So this is kind of
Speaker 2: like zero copy networking can really.
Speaker 1: Make a difference under the hood.
Speaker 2: It's the secret sauce, secret sauce that makes things fast.
Speaker 1: Yeah, that you don't see, but it's there, work in
Speaker 1: its magic.
Speaker 2: It's working hard behind the scenes.
Speaker 1: That's cool.
Speaker 2: Yeah. Okay, so all right, what's next?
Speaker 1: What's next?
Speaker 2: What other cool stuff do we have on our list
Speaker 2: in this book?
Speaker 1: All right, so this one is a hardware hack.
Speaker 2: Oh, hardware hacking. This is called the I Love Hardware Hacking.
Speaker 1: The ip flip Wixer trick.
Speaker 2: D I p flip wixer trick. That's a mouthful, it is,
Speaker 2: but it's a really cool trick.
Speaker 1: It is a cool trick. Yeah, so uh what is it?
Speaker 1: This is from Joe.
Speaker 2: Grant, Joe grand the King of hardware hacking. Yeah, he's amazing.
Speaker 1: So the idea is, how do you reprogram a device
Speaker 1: without any special tools, without any special tools.
Speaker 2: Without any special never hacking.
Speaker 1: You know you've got You're stuck on a desert island.
Speaker 1: All you've got is a paper clip and a piece
Speaker 1: of chewing gum. Yeah, and you've got to reprogram.
Speaker 2: This device shoelace, and somehow, somehow you do it reprogrammed.
Speaker 2: That's Joe Gran he's the master of that.
Speaker 1: So in this particular case, he is exploiting the the.
Speaker 2: Ftd I chick, the FTDI chick, which is a very
Speaker 2: common chip used for USB to serial communication.
Speaker 1: Right, So if you've ever used like an Urduen or
Speaker 1: a Raspberry.
Speaker 2: Pie or any kind of embedded device, you've probably used
Speaker 2: an FTDI chip. You've probably seen it. Yeah, these little chips,
Speaker 2: they're everywhere. And so what he figured out is that
Speaker 2: there's a way.
Speaker 1: To uh reconfigure.
Speaker 2: We can figure the gpio pins.
Speaker 1: The gpo opins on the fly on the floor, which
Speaker 1: is kind of unusual.
Speaker 2: So gpio pins are basically like little.
Speaker 1: Switches you can turn on and off, and they could
Speaker 1: be used for all sorts of things.
Speaker 2: Yeah, they can be used to control LEDs or motors
Speaker 2: or sensors or whatever you want, all sorts of things.
Speaker 2: And so he figured out a way to reconfigure.
Speaker 1: Those to use those pins, to use those pins redirect
Speaker 1: the cereal data to redirect.
Speaker 2: The serial data. So instead of going to.
Speaker 1: The normal to basically reprogram the chair the device.
Speaker 2: It's going back to the FTDI.
Speaker 1: Chip, the FTDI chip itself and reprogramming it, which is
Speaker 1: so clever.
Speaker 2: It is so clever. It's like using the device's own
Speaker 2: defenses against it.
Speaker 1: Yeah, it's like turning its own power against it, exactly.
Speaker 1: And so, so how does he actually do this?
Speaker 2: The way he does this is by using specific key strokes,
Speaker 2: Like so, if you press the right combination of keys, it.
Speaker 1: It triggers a mode switch.
Speaker 2: It triggers this mode switch and FTDI chip. Yeah, and
Speaker 2: then suddenly the serial data is and then suddenly the
Speaker 2: serial data is going to.
Speaker 1: The data is flowing in a different direction to the chip. Yeah,
Speaker 1: you can reprogram it.
Speaker 2: It's wild.
Speaker 1: It is wild. It's like, so what does this It's
Speaker 1: like a secret back door, yeah, into the chip.
Speaker 2: So what's the takeaway here?
Speaker 1: So what can we learn from this?
Speaker 2: Why is this important?
Speaker 1: Besides the coolness factor, besides being super cool?
Speaker 2: I mean, it's just so cool, it's super cool. Yeah,
Speaker 2: what's the practical lesson here? I think the lesson is
Speaker 2: that I think it teaches us to think outside the box.
Speaker 1: To think outside the box, and to not don't assume.
Speaker 2: That you need specialized tools.
Speaker 1: Assume that you need these to do amazing things especial
Speaker 1: Sometimes the tools you need are right in front of you.
Speaker 1: You just have to know how to use them.
Speaker 2: Sometimes the things you have in a different way can
Speaker 2: be used for something completely different than they were intended for.
Speaker 1: It's about creativity, and that's about resourcefulness. It's about that
Speaker 1: hacker spirit, the hackers, you know, finding a way even
Speaker 1: when it seems impossible. Okay, okay, so one more, one more,
Speaker 1: one more for this segment.
Speaker 2: For this segment, and then we'll hit me with it.
Speaker 2: We'll take a break. So this one is a little
Speaker 2: bit more in the.
Speaker 1: Weeds, a little more technical.
Speaker 2: Yeah, okay, so this is about uh.
Speaker 1: Static ELF relocations.
Speaker 2: Static ELF relocations.
Speaker 1: Wow, that's a mouthful, but it's an important concept.
Speaker 2: The security implications, especially.
Speaker 1: If you're working with like low level systems. Yeah, embedded systems.
Speaker 2: ELF is the operating system kernels, executable and linkable format.
Speaker 1: That's right. It's basically it's the standard format programs are
Speaker 1: for executable files on.
Speaker 2: Linux sort on Linux and any.
Speaker 1: Other Unix like systems. Yeah, so it's pretty important.
Speaker 2: And so when we talk about static ELF relocations we're
Speaker 2: talking about. UH. A statically linked binary.
Speaker 1: Aesthetically linked binary is often seen is like a self
Speaker 1: contained unit, more secure. It's got everything it needs than dynamically.
Speaker 1: All the libraries are built.
Speaker 2: In linked binary.
Speaker 1: It's like a standalone program. You don't need anything else
Speaker 1: to run it.
Speaker 2: Because it's self contained. What this research show there's.
Speaker 1: A catch is that even there's always a catch, statically
Speaker 1: linked binaries can still have there's no such thing as perfect.
Speaker 2: Security vulnerabilities relating to these relocations static binaries. The idea
Speaker 2: is even though there's statically.
Speaker 1: Linked, even though they still contain relocation tables, which are
Speaker 1: basically instructions for how to load the different parts of
Speaker 1: the program into memory at run time. So even though
Speaker 1: the libraries are statically linked, there's still this there's still
Speaker 1: this table of information this function needs to be loaded
Speaker 1: at this address. Assumption this data needs to be loaded
Speaker 1: at this address.
Speaker 2: Is here, and so on, this data is here.
Speaker 1: And attackers can exploit and an attacker those relocation tables
Speaker 1: to do nasty things like shared library injection.
Speaker 2: Shared library inject.
Speaker 1: Which is a classic attack which is basically where you
Speaker 1: trick the program, picking the program into loading a malicious
Speaker 1: library loading your code instead of the legitimate one, and
Speaker 1: then your code gets executed.
Speaker 2: So that's crazy.
Speaker 1: It is crazy.
Speaker 2: Because you think it's like, okay, you think you're saying
Speaker 2: statically linked.
Speaker 1: Because you've got this statically linked binary self contained, but
Speaker 1: there's still these subtle ways that attackers can get in
Speaker 1: and mess things up.
Speaker 2: Yeah, that's so cool.
Speaker 1: It is cool, and it's a good reminders.
Speaker 2: But what does this tell us that security is hard?
Speaker 2: In general?
Speaker 1: Security is never easy, and it's not about you can't
Speaker 1: just rely on building the wall or one assumption.
Speaker 2: You have to understand the system deeply and you have
Speaker 2: to be constantly deep looking for new ways.
Speaker 1: Yeah. Attacks, it's like try to get in never ending
Speaker 1: is a never ending battle arms race, the arms race
Speaker 1: of security.
Speaker 2: Yeah, okay, all right.
Speaker 1: So that's it for this segment. So we've covered We've
Speaker 1: covered a lot of grounds quite a bit, from hacking
Speaker 1: children's toys to cracking retro games to exploiting the intricacies
Speaker 1: of modern CPU's children's toys. It's been a wild ride.
Speaker 2: Cracking retro games.
Speaker 1: We're gonna take a quick break the deep dark, but
Speaker 1: drink stretch.
Speaker 2: Your lads to static binaries and.
Speaker 1: We'll be back with more amazing stuff from PAC or
Speaker 1: GTFO Volume three.
Speaker 2: We'll be right back.
Speaker 1: Stay curious, Welcome back to the deep dive.
Speaker 2: All right, so we are back back into.
Speaker 1: The depths of PFEE or GTFO with.
Speaker 2: PAC or GTFO Volume three, Volume three. That's right, and
Speaker 2: we're gonna jump right into the next. Uh okay, hacker,
Speaker 2: what do we have? Interesting concept that we found.
Speaker 1: In what's next on the menu?
Speaker 2: So this one is kind of a technique. Okay, it's
Speaker 2: not really a hack.
Speaker 1: I guess it's a defensive technique.
Speaker 2: Yeah, it's a defensive technique called anti keylogging with noise.
Speaker 2: And this is from a researcher named Mike Myers.
Speaker 1: Mike Myers, Yeah he's a clever guy. So, uh, I
Speaker 1: guess first off, like, yeah, what's a keylogger is? Basically,
Speaker 1: it's a piece of software against it that sits on
Speaker 1: your computer yea, and it records every keystroke you make. Yeah,
Speaker 1: so everything you type, everything you type, your passwords, yeah,
Speaker 1: your credit card numbers, yeah, all your separate love letters,
Speaker 1: your deep dark secret it's all being recorded.
Speaker 2: So it's basically like why this keylogger a digital spot.
Speaker 1: It's a digital spy that's sitting on your shoulder.
Speaker 2: And it's scary because watching everything you do, you don't
Speaker 2: know what's there.
Speaker 1: Right, you don't know it's there.
Speaker 2: It's running silently in.
Speaker 1: The background, siphoning off your data. So how do you
Speaker 1: defend against that?
Speaker 2: So how do you tough problem defend against something like that,
Speaker 2: because it's just Mike Myers came up with this idea
Speaker 2: sitting there of.
Speaker 1: Using noise to drown out the signal.
Speaker 2: So the idea is to flood.
Speaker 1: Instead of trying to prevent the keylogger from recording your keystrokes.
Speaker 2: The keylogger was so much do you.
Speaker 1: Just overwhelm it with so much, so much garbage that
Speaker 1: it can't tell that it can't the real key strike,
Speaker 1: extinguish the real from the fig So it's like, so
Speaker 1: it's like creating a smoke screen to hide your real movement.
Speaker 2: Like a digital a digital smoke screen, folk screen.
Speaker 1: That's a great analogy. So how do you do that?
Speaker 1: How do you generate this noise?
Speaker 2: Generate that noise?
Speaker 1: That's the tricky part. Can't be too random because then
Speaker 1: because then it's obvious, it'll be obvious that it's fake. Right,
Speaker 1: it's like somebody just banging on the keyboard. Yeah, it
Speaker 1: has to be believable.
Speaker 2: It has to sounds to sound like someone is actually
Speaker 2: typing even though it's not.
Speaker 1: Yeah, so you have to consider things like typing speed,
Speaker 1: use of the shift keys, the frequency of different letters,
Speaker 1: and all that stuff.
Speaker 2: It's like you're trying to trying to.
Speaker 1: Mimic human behavior, behavior, but without actually being human. It's
Speaker 1: all an illusion. So it's a really So it's like.
Speaker 2: You're creating a it's a challenge digital puppet.
Speaker 1: It's a challenge to create this believable noise. It's just
Speaker 1: typing gibberish.
Speaker 2: But it's effective if you can do it right. So
Speaker 2: I guess, So, what's the lesson here?
Speaker 1: Was this?
Speaker 2: What can we learn.
Speaker 1: From this tell us about security in general?
Speaker 2: I think it highlights the concept of obfuscation. Obfuscation which
Speaker 2: is basically making things harder to understand, even if you
Speaker 2: can't completely hide.
Speaker 1: Them, try to prevent the attack.
Speaker 2: Sometimes the best defense.
Speaker 1: They're just trying is to just make it so difficult,
Speaker 1: make it harder for the attacker that they give.
Speaker 2: Up to get what they want. So it's kind of.
Speaker 1: Like hiding a needle in a haystack, like hiding a needle.
Speaker 1: Make the haystack so big that nobody can find the
Speaker 1: needle that.
Speaker 2: It's just not worth the effort to try to find it.
Speaker 1: So that's obfuscation.
Speaker 2: Okay, cool, all right, all right, so what else we got?
Speaker 1: Moving on to something completely different?
Speaker 2: Okay, this one is, uh, this sounds interesting. Ethernet over GDB,
Speaker 2: Ethernet over GDB? What is that?
Speaker 1: That sounds I'm intrigued, crazy.
Speaker 2: Yeah, so break it down for me.
Speaker 1: First off, what is GDB?
Speaker 2: So? GDB is the gn you debugger. It's a tool
Speaker 2: that programmers use to analyze code, debug to step through
Speaker 2: code line by line, to inspect various to figure out
Speaker 2: what's going wrong, what's going on?
Speaker 1: So it's a very powerful tool for understanding how software works.
Speaker 2: So you're telling me, so we can use Micah Elizabeth
Speaker 2: Scott this debugging tool. It was a brilliant researcher.
Speaker 1: To send data over figured out a way to use GDB.
Speaker 2: How is that as a makeshift even pace?
Speaker 1: How is that even possible?
Speaker 2: It's mind blowing? Yeah, So basically, how did she do it?
Speaker 2: She figured out how to use the GDB protocol Okay,
Speaker 2: which is the language that GDD uses basically to communicate,
Speaker 2: to send and receive protocol work packets. So it's like.
Speaker 1: It's like speaking a wrench Ethernet using GDB through GDBA.
Speaker 1: It's crazy, it's like using a wrench. But why in
Speaker 1: a nail?
Speaker 2: Why would you even.
Speaker 1: You know it's not the right tool for the job, want.
Speaker 2: To do this? But it worked, Yeah, if you know
Speaker 2: how to use it, So why go through all that trouble?
Speaker 1: Right?
Speaker 2: Why bother to use GDD to send.
Speaker 1: Imagine you're working on a tiny embedded system lacket like
Speaker 1: the woods in your car, when you could.
Speaker 2: Just use it for your smart appliances, an Ethernet cable that.
Speaker 1: Doesn't have a built in network card.
Speaker 2: Yeah right.
Speaker 1: Traditionally you wouldn't be able to get network access to
Speaker 1: that device because but with this technique, isn't you can't.
Speaker 1: You can use GDB okay to basically give it a
Speaker 1: voice on the network.
Speaker 2: So it's like giving network giving a voice intivity.
Speaker 1: To these devices that were previously.
Speaker 2: Silent and these devices that were previously cut off. Next GAT, Yeah,
Speaker 2: that's pretty cool. It's pretty cool.
Speaker 1: So I guess the takeaway here is.
Speaker 2: What's the lesson that you can use.
Speaker 1: Tools in unexpected ways.
Speaker 2: I think it teaches us that limitations can breed creativity.
Speaker 1: Yeah right, Necessity is the mother.
Speaker 2: Sometimes when you're faced of invention.
Speaker 1: With a constraint, it forces you to think differently, to
Speaker 1: find a new outside that you wouldn't have thought of otherwise.
Speaker 2: The box.
Speaker 1: So it's like those escape room puzzles.
Speaker 2: Yeah, like an escape row where you have.
Speaker 1: To use everyday objects unconventional ways. You've got to solve
Speaker 1: the puzzle.
Speaker 2: You've got this thing and you have to think.
Speaker 1: Like it's like, okay, how can I how can I.
Speaker 2: Use this thing?
Speaker 1: Use this in a way it wasn't that was not intended,
Speaker 1: intended to be used to achieve my goal.
Speaker 2: Go achieve my goal.
Speaker 1: And that's what Michael Elizabeth Scott did with this ethernet
Speaker 1: over GDB hack.
Speaker 2: That's cool. Yeah, okay, so all right, what's next?
Speaker 1: Moving on? Hit me to another vulnerability.
Speaker 2: Okay, another vulnerability.
Speaker 1: This one is, uh, where are we going now? In
Speaker 1: the Windows Control panel?
Speaker 2: The Windows Control panel? That's right, okay, everyone's familiar with
Speaker 2: that favorite thing. We've all used it to change our settings,
Speaker 2: to customize our computers.
Speaker 1: This vulnerability was discovered by a researcher right named Jeff
Speaker 1: Cheppell Jeff, And what did he find? He was basically digging.
Speaker 3: Indeed, he was looking into into how the how the
Speaker 3: control panel handles Control panel CPL modules, which are basically
Speaker 3: programs that add functionality to the control panel.
Speaker 2: Okay, so they're like plugins. So it's like they extend
Speaker 2: the functionality of the control.
Speaker 1: Panel, the control panel. And what he found was he.
Speaker 2: Found there's something subtle, subtle flaws in how these modules
Speaker 2: to these modules are are loaded and executed, loaded, which
Speaker 2: could potentially allow an attacker to run their.
Speaker 1: Own code, some code and disguised as one of these modules.
Speaker 2: So it's like you're sneaking in. It's like sneaking in
Speaker 2: delicious code through the back door.
Speaker 1: Disguised as a harmless plug in.
Speaker 2: That's crazy, It's pretty sneaky.
Speaker 1: So how is that even possible?
Speaker 2: How is that even possible? How do you smell?
Speaker 1: Comes down to the way that software interacts with the
Speaker 1: operating system. So it's not just.
Speaker 2: There are often a code itself, complex steps involved in
Speaker 2: loading and running a program, how it interacts, and even
Speaker 2: small errors in those steps can create opportunities for attackers.
Speaker 2: So it's like a chain reaction.
Speaker 1: Chain reaction one week link.
Speaker 2: One week link can bring down the whole system.
Speaker 1: Can break the whole thing. So what is this reason?
Speaker 2: So what's the lesson here to us? What can we
Speaker 2: learn from Jeff Chappel's work security? Yeah, I think it highlights.
Speaker 1: What's the takeaway here the importance of secure coding practices.
Speaker 1: So it's not just right you have to write good code,
Speaker 1: but you also have.
Speaker 2: To secure code carefully. Consider in time of a program
Speaker 2: life cycle.
Speaker 1: From the moment it's loaded to the moment it's executed.
Speaker 1: More creatles, every step along the way has to be secure.
Speaker 2: You've got to make sure otherwise there's a potential secure.
Speaker 1: The entire way for vulnerability. So it's not just about
Speaker 1: the code itself.
Speaker 2: The whole systems is.
Speaker 1: Being secure that the code runs in.
Speaker 2: Yeah, that's yeah, it's a holistic view keep security.
Speaker 1: It's not just about it's not just one one piece,
Speaker 1: one thing, it's about the whole puzzle.
Speaker 2: Yeah all right, Okay, what's next? So we're getting close
Speaker 2: to the end here.
Speaker 1: Moving on? What else do we have to something a
Speaker 1: little bit more theoretical? Theoretical? I like theoretical.
Speaker 2: I think it's still reletive. It's important to security. Yeah,
Speaker 2: so this is about.
Speaker 1: Hit me with it.
Speaker 2: Hash function, hash function, kudo fixed points, fixed points. Wow,
Speaker 2: that's a mouthful. That's a mouthful. All right, let's break
Speaker 2: it down off.
Speaker 1: What's a hash function?
Speaker 2: So, a hash function is a fundamental building block of cryptography,
Speaker 2: wire and security. So it's basically a function that takes
Speaker 2: some input and produces they're everywhere a fixed size output
Speaker 2: called a hash they're used for or a hash value,
Speaker 2: everything from password storage. The key property the hash functional
Speaker 2: signatures is that it's one way, meaning you can easily
Speaker 2: calculate the hash of an but you can't.
Speaker 1: It's very difficult to go backwards in other way to
Speaker 1: find the input.
Speaker 2: So and just the hash like a one way street.
Speaker 1: It's a one way function.
Speaker 2: So what does this have to do with pseudo fixed points?
Speaker 2: Pseudo fixed points you keep talking about.
Speaker 1: A pseudo fixed point is essentially a program that outputs
Speaker 1: its own hash.
Speaker 2: Value pseudo fixed points.
Speaker 1: So it's a program that can calculate. So it's a
Speaker 1: program its own fingerprint that spits out in a sense fingerprint.
Speaker 2: That's pretty weird. Yeah right, how do you even do that?
Speaker 1: Well, there are a couple of ways make a program.
Speaker 1: One way is to use a technique to that called
Speaker 1: quins quins Quinn's programs that can print their own source code.
Speaker 2: Okay, so it's a program.
Speaker 1: So it's like a snake that can swallow its own tail, print.
Speaker 2: Out its own code. It's a self replicating program.
Speaker 1: So it's like a program that can look.
Speaker 2: You can use that technique create a hash functions pseudo
Speaker 2: fixed point. This is me because if the program can
Speaker 2: print its own source code, it can also calculate its
Speaker 2: own hash and then output that hash as it's output.
Speaker 2: So that's one way to create a pseudo fixed point.
Speaker 2: The other way is to use why should we Care
Speaker 2: fixed points, which is a more mathematical concept.
Speaker 1: Which why should we care about?
Speaker 2: But it's basically a program and hash function that could
Speaker 2: be transformed pseudo fixed points into itself a series of operations,
Speaker 2: implication program, it's this that's its.
Speaker 1: Own it's tell us in a funhouse mirror about security.
Speaker 2: Right, why is this a problem?
Speaker 1: It's a little bit trippy, Yeah, but it seems very
Speaker 1: It's a powerful technique and you can use it to
Speaker 1: create these hash function practical pseudo fixed points.
Speaker 2: Application here.
Speaker 1: Yeah, so Why is this a vulnerability?
Speaker 2: Why is this important for security? Yeah, well, can attacker.
Speaker 1: Imagine an attacker wants to bypass a security mechanism that
Speaker 1: relies on hash values, so.
Speaker 2: He's using hashes.
Speaker 1: So for example verify, Let's say you have a system
Speaker 1: that uses hashes to verify that.
Speaker 2: An attacker can create the integrity of files. One of
Speaker 2: these programs that outputs you if you download a file hash,
Speaker 2: you can calculate its hash. They can base and compare
Speaker 2: it to the hash the system that was published by
Speaker 2: the author of the file, and if the hashes.
Speaker 1: Match malicious program you know.
Speaker 2: Hasn't been tampered with legitimate, right, But so they're basically if.
Speaker 1: An attacker can create a file.
Speaker 2: Merging that has a digital fingerprint.
Speaker 1: A specific hash, they can basically.
Speaker 2: To bypass the security mechanisms.
Speaker 1: So it's like creating a fake ID for a file.
Speaker 2: Yeah.
Speaker 1: So it's like, so it looks legitimate, we think we're safe,
Speaker 1: even though it's not because we're using So that's why
Speaker 1: these pseudo fixed points are dangerous. But because they allow
Speaker 1: attackers to potentially bypass security mechanisms that rely on hash.
Speaker 2: Values, that's mind blowing.
Speaker 1: Yeah, it's a little bit mind bending, but it's important
Speaker 1: to understand because it shows that even these fundamentals, cryptographic
Speaker 1: techniques that has security, subtle weaknesses attackers can exploit.
Speaker 2: There's some way.
Speaker 4: Security is security constant arms. It's just a matter of
Speaker 4: the attackers are all ways finding it, trying to find
Speaker 4: new ways to break things, and the defenders always trying
Speaker 4: to stay one step ahead.
Speaker 1: Very cool, Yeah, it's exciting.
Speaker 2: Yeah, to challenge.
Speaker 1: Okay, keeps things interesting.
Speaker 2: So moving on, all right, what else? We got something
Speaker 2: a little more?
Speaker 1: One more for this segment?
Speaker 2: Fun?
Speaker 1: Okay, fun hit me?
Speaker 2: So this is project Okay.
Speaker 1: Let's have some fun.
Speaker 2: World video game video games. I love video games, the
Speaker 2: technical intricacies. So what kind of video games shenanigans are
Speaker 2: we talking about here? Of hash collisions, religions, and it's
Speaker 2: called I like where this is going. MT five S
Speaker 2: the MD five ne e S polyglot.
Speaker 1: I know that sounds amazing.
Speaker 2: Is that crazy?
Speaker 1: Break it down for me? So what in the world?
Speaker 2: What is a polyglot?
Speaker 1: Is an MT five ne e S polyglot?
Speaker 2: Well, in this context sounds like something alot is a
Speaker 2: file doctor that is valid in multiple formats. So in
Speaker 2: this case we have a file that is the file
Speaker 2: valid e s RAM, which just that games are stored
Speaker 2: in on the Nintendo Entertainment systems. And that's also a
Speaker 2: valid PDF document, so you can open it up.
Speaker 1: Host speaker, Welcome back everyone to the final part of
Speaker 1: our deep Dive into Poscy or GTFO Volume three.
Speaker 2: It's been quite a journey, it has been. We've seen
Speaker 2: some amazing stuff we have, from hardware hacking to software exploitation.
Speaker 1: Yeah, from the very low level to the very high level,
Speaker 1: it's all connected.
Speaker 2: Well, come step up with a few more a few
Speaker 2: more gems from the book, interesting things, okay that we
Speaker 2: found in the book. What do we got?
Speaker 1: So? This first one is a a Kraken story game.
Speaker 1: And this is a Sega Genesis.
Speaker 2: Game, Oh Sega Genesis called Peer Solar and the Great
Speaker 2: Architects Pure Solar.
Speaker 1: I don't know if you've ever heard of this game.
Speaker 2: I have heard of this game. It's a classic, a
Speaker 2: homebrew RPG. Homebrew, that's right.
Speaker 1: So it wasn't like that.
Speaker 2: It wasn't like an official and officially re cress.
Speaker 1: It was made by independent developers.
Speaker 2: It was actually cool. We at least way after the Genesis,
Speaker 2: way after the Genesis was even popular popular, so so
Speaker 2: they were really pushing the limits.
Speaker 1: They were really what the hardware could do, pushing the
Speaker 1: limits of the hardware.
Speaker 2: Yeah, and really impressive game.
Speaker 1: The copy protection was a cracking itt tough, was no
Speaker 1: easy feat.
Speaker 2: So how did they do it?
Speaker 1: How did they actually crack this?
Speaker 2: Yeah? What were the challenging game?
Speaker 1: Well, first of all, they had to figure out how to.
Speaker 2: Yeah, how do you even get the code? Get the
Speaker 2: code off a cartridge?
Speaker 1: With the cartridge right, we're not.
Speaker 2: Talking about like downloading a ROM file talking about from
Speaker 2: the internet, the physical cartridge. This is a physical cartridge.
Speaker 1: So they had to So you have to find a
Speaker 1: way somehow to dump the ROM data from the cartridge
Speaker 1: off of it.
Speaker 2: Which is a challenge in itself, but they figured it out.
Speaker 1: They were able to do that.
Speaker 2: They did and then thanks and now they got the code.
Speaker 2: They had a code. But then they had to actually
Speaker 2: do you crack it? That's the secret it worked? Yeah,
Speaker 2: so they had to so they had to dive in
Speaker 2: this assembly can dive into the assembly code, the.
Speaker 1: Ones and zero's the machine language, get it understand, trying
Speaker 1: to figure out what it was doing, how.
Speaker 2: It worked, and specifically.
Speaker 1: Where's the copy protection?
Speaker 2: Copy protection? What does it work? Mechanism work, So it's
Speaker 2: like detective work. This is like detective work.
Speaker 1: You're following the clues, trying to piece together the puzzle
Speaker 1: of how this game is protecting itself.
Speaker 2: The execution paths. Yeah, trying to figure out.
Speaker 1: It's really challenging.
Speaker 2: Okay, when does it get But they were up to
Speaker 2: the task protection they were. It happens if they had
Speaker 2: the skills, and it determinates what happens if it succeeds
Speaker 2: to crack this game, and they had to kind of
Speaker 2: like saw that together.
Speaker 1: It's amazing.
Speaker 2: It's out of work compressive that goes into something like
Speaker 2: this of reverse engineering is a testament. So I guess
Speaker 2: the takeaway here to their skill.
Speaker 1: And their dedication, you know, even something. So what's the
Speaker 1: lesson here? Can we learn relatively simple from these hackers, like.
Speaker 2: A video game actually very complex, that even seemingly systems
Speaker 2: can have incredible depth skills of knowledge, and that cracking
Speaker 2: them requires a unique blend engineer of technical skill, creativity,
Speaker 2: and perseverance.
Speaker 1: So it's not just about it's about thinking outside the.
Speaker 2: Box, thinking outside the box, and not giving up when
Speaker 2: things get tough.
Speaker 1: Yeah, because and I think that's something that.
Speaker 2: Cracking something like this, we see it takes a lot
Speaker 2: of patience.
Speaker 1: Throughout a lot of trial and error this book and
Speaker 1: a lot of just banging your head against the wall
Speaker 1: that these research sometimes until you finally breakthrough.
Speaker 2: Yeah, so they're not afraid to it's inspiring. Just keep
Speaker 2: trying it is.
Speaker 1: It's a good lesson for life in general, I think
Speaker 1: the answer. Yeah, Okay, all right, so what's next?
Speaker 2: So moving on what other hacking adventures to something a
Speaker 2: little bit more.
Speaker 1: What we have in store?
Speaker 2: Low level, A low level. This is about uh.
Speaker 1: Getting down to the bits and bytes.
Speaker 2: Writing secure a right, I like get code for our
Speaker 2: ICV architecture RSCV.
Speaker 1: That's a hot topic these days.
Speaker 2: Our SCV is a relatively.
Speaker 1: It's a new processor architecture architecture. It's gaining a lot
Speaker 1: of popularity.
Speaker 2: It's open source.
Speaker 1: Because it's open source.
Speaker 3: It's gaining very flexible, a lot of traction, a lot
Speaker 3: of potential industries.
Speaker 2: Yeah, and so so why is secure coding the challenge
Speaker 2: here is important for ri CV?
Speaker 1: Okay, Well, just like any other process or architecture, ri
Speaker 1: A s c V has its own unique.
Speaker 2: Core instructions registers not careful. You can introduce vulnerability being
Speaker 2: a new language into your code. Yeah, except if you make.
Speaker 1: A grammatical But the stakes are higher because if you
Speaker 1: make a mistake of security vulnerability to exploit.
Speaker 2: It, take over your system to deal your data done, Bailey.
Speaker 1: All sorts of bad things really took. So secure coding
Speaker 1: is crucial for any RSCV processor architecture code development, but
Speaker 1: especially for a new one. First off, like RI s
Speaker 1: CV is because we're still learning someone.
Speaker 2: Out the potential pitfalls.
Speaker 1: Yeah, why is it important?
Speaker 2: We're still discovering new vulnerability.
Speaker 1: Shell code is basically a small piece.
Speaker 2: Of shell code. Shell code is basically a small piece
Speaker 2: of code that's a designed to exploit a vulnerability to
Speaker 2: the system. So it's often used as part of an exploit.
Speaker 2: So let's say you find a vulnerability in the program.
Speaker 2: You can write some.
Speaker 1: Shell code deep understanding that.
Speaker 2: Will take advantage of that vulnerability and give you control
Speaker 2: of the system. So it's a very powerful technique.
Speaker 1: In this case, they had to. It's also very dangerous.
Speaker 2: Because if it falls into the wrong hands r I
Speaker 2: s CV whisperer, So you have to be very careful.
Speaker 1: The architectures.
Speaker 2: When you're writing shell code.
Speaker 1: The deepest secrets, you.
Speaker 2: Have to make sure that it's not going to secure
Speaker 2: show do anything unintended.
Speaker 1: So he had the master do you want.
Speaker 2: To accidentally crash the system or instruction?
Speaker 1: The register calling conventions give.
Speaker 2: The attacker more control than you intended. So it's a
Speaker 2: delicate balance between the power and syntax of a new lege.
Speaker 1: It's a challenging field, but it's also very rewarding.
Speaker 2: Much higher states if you can do it right. Yeah,
Speaker 2: so because if you miss what.
Speaker 1: Can we learn from Gone Bailey's.
Speaker 2: Work A security hole? I think it shows the challenges
Speaker 2: of adapting security practices to new and emerging technologies.
Speaker 1: So what does this tell us as we scurrey.
Speaker 2: In general push the boundaries of computing.
Speaker 1: What's the lesson here? We need to make sure a
Speaker 1: highlight the doors wide open attack.
Speaker 2: An ongoing process. We can't just assume one thing is
Speaker 2: new technology that.
Speaker 1: It's automatically secure.
Speaker 2: We need to evolve ourselves talking about security.
Speaker 1: From the ground up. We have to design our systems
Speaker 1: with security in mind.
Speaker 2: Building a new house from the.
Speaker 1: Very beginning, you want.
Speaker 2: To you want to building a house, It structurally sounds
Speaker 2: on a solid foundation and secure.
Speaker 1: From the ground up.
Speaker 2: From the ground up.
Speaker 1: To start thinking about reinforcements until.
Speaker 2: You have to think about it from.
Speaker 1: The start caves in to start.
Speaker 2: That's a great analogy thinking about reinforcements. So that's what
Speaker 2: this whoc or gtf O I think that's all about.
Speaker 1: It's about proactively identifying and mitigating identifying these vulnerabilities. It's
Speaker 1: not just about finding the vulnerabilities, it's also about.
Speaker 2: How to fix them, how to mitigate them, building a
Speaker 2: more sharing that knowledge community.
Speaker 1: With the community.
Speaker 2: It's not just about sharing knowledge finding the.
Speaker 1: Problem to make the world a safer place. It's a noble.
Speaker 2: Goal and I think that's what's really inspiring. We need
Speaker 2: more people about this book like that in the world.
Speaker 2: A celebration of human curiosity. We're willing to share their
Speaker 2: knowledge ingenuity and it feels celebration.
Speaker 1: Yeah. It's a great community to be a part of
Speaker 1: our collaboration and this book is a great example of that.
Speaker 2: And it's a reminder that we all have a role
Speaker 2: to play for.
Speaker 1: Our deep dive into sc or GTFO Volume three Technology.
Speaker 1: I hope you enjoyed it. I hope you learn.
Speaker 2: Something and more securely for everyone.
Speaker 1: It's inspired you.
Speaker 2: Yeah, so go out there.
Speaker 1: That's a wrap and hack something a deep dive responsibly
Speaker 1: of course.
Speaker 2: Yeah. And to POSSE or GTFO.
Speaker 1: Stay safe, Volume three, Stay Curious.
Speaker 2: We hope you enjoyed it.
Speaker 1: We'll see you next time for another year JEP dive
Speaker 1: into the world.
Speaker 2: Of security research.
Speaker 1: To keep hacking, hacking, keep learning, weap learning and pushing
Speaker 1: the boundaries.
Speaker 2: Pushing the possible until next time of what's possible.
Speaker 1: Stay curious and stay secure.
Speaker 2: Stay curious, all right, and stay secure and stay