Nate Lawson II

WEBVTT
00:00:12.929 --> 00:00:13.679
Hello.
00:00:13.859 --> 00:00:17.579
Welcome to Security Cryptography, Whatever! I'm Deirdre.
00:00:18.030 --> 00:00:18.780
I'm David.
00:00:19.410 --> 00:00:20.609
Uh, I'm Thomas.
00:00:21.179 --> 00:00:25.320
and we are here again with part two of our chat with Nate Lawson.
00:00:25.320 --> 00:00:26.010
Hi, Nate
00:00:26.940 --> 00:00:27.120
Hi
00:00:27.570 --> 00:00:28.140
Hi.
00:00:28.710 --> 00:00:30.899
Who wants to summarize what we talked about last time?
00:00:31.589 --> 00:00:32.340
It was a lot.
00:00:33.179 --> 00:00:38.640
I think we were like starting with the idea that pretty much all of modern cryptography is somehow traceable to Nate Lawson.
00:00:40.109 --> 00:00:45.689
And then we talked about Nate's weird background and how it might have come to pass that that was the case.
00:00:46.920 --> 00:00:49.710
Did we settle on a cryptopals connection?
00:00:49.740 --> 00:01:07.989
Because there is a direct connection from cryptopals to the security class that is currently taught at the University of Michigan because I was nothing if not lazy in grad school, and reappropriated some of its content for a variety of the projects, including e equals three and padding oracles.
00:01:08.504 --> 00:01:14.004
I feel like the major Nate to modern cryptography connection is through Thai Duong.
00:01:14.265 --> 00:01:28.875
And I say that cuz Thai was working with Juliana Rizzo on the BEAST attack, like kind of roughly before he joined Matasano which is the consulting firm I was running like the mid two thousands, right?
00:01:29.234 --> 00:01:31.185
That was before Cryptopals.
00:01:31.484 --> 00:01:45.105
But he had joined us because of, I think, blog posts that we had written with Nate Lawson on the Mozilla e three RSA attack, and I think probably the CBC padding oracle thing.
00:01:45.525 --> 00:01:47.924
Um, and, and then CryptoPals happens.
00:01:48.254 --> 00:01:53.394
Um, and then CryptoPals gets you, I guess to some extent you, and then also people like Filippo Valsorda.
00:01:53.834 --> 00:01:56.834
Um, I don't know how credible any of this is, right?
00:01:56.834 --> 00:02:03.314
Because Thai Duong and Juliano Rizzo would've done amazing things with or without a blog post that, uh, that Nate inspired.
00:02:03.319 --> 00:02:05.984
But I'll, I'll make the connection anyways.
00:02:07.155 --> 00:02:07.575
Thanks.
00:02:07.674 --> 00:02:09.194
I, I think they stand well on their own.
00:02:10.275 --> 00:02:12.574
We have to say that, but I don't, I don't know how true it is.
00:02:14.175 --> 00:02:22.935
All right, so last time I think we kinda left off with, uh, Sony, which I don't know, we'll call this mid to late two thousands.
00:02:23.264 --> 00:02:24.585
So what comes next?
00:02:25.004 --> 00:02:25.495
Uh, yeah.
00:02:25.514 --> 00:02:32.264
So timeline wise, um, I left Cryptography Research in 2007, um, and started my own consulting company, Root Labs.
00:02:32.655 --> 00:02:47.805
And the real focus I was going after was this combination of embedded security crypto systems and what I call kernel or reverse engineering, which was just like any low level software that needs to talk crypto and work with devices.
00:02:48.074 --> 00:02:54.224
And it was kind of fun because in constrained systems, like embedded systems, you get to have very few resources.
00:02:54.854 --> 00:02:56.775
But you have challenging problems.
00:02:56.780 --> 00:02:59.625
Like for example, the attacker is holding your device in their hand.
00:03:00.224 --> 00:03:08.655
You've got kind of a little cheat code there, which is that a lot of the security things start on desktop software or server software.
00:03:08.655 --> 00:03:18.974
So, you know, if you're talking about memory corruption protections or things like that, that kind of starts on the server side or, or the browser side and gets deployed there first when you've got lots of cpu, lots of ram, et cetera.
00:03:19.455 --> 00:03:25.844
And then you've still got these old systems where it's using like 1990 C code and not so secure.
00:03:25.905 --> 00:03:30.525
And so you can make a big difference with just bringing the same ideas downstream to, to embedded devices.
00:03:30.555 --> 00:03:31.044
Okay.
00:03:31.335 --> 00:03:33.344
So, uh, yeah, so I launched a consulting company.
00:03:33.344 --> 00:03:47.235
I hired a couple people and my, my approach to hiring was always like, just go to college campuses, offer to give a guest lecture on crypto, and then whoever sort of sits in the front and pays attention, you know, offer, offer jobs to, so,
00:03:47.414 --> 00:03:48.585
Holy crap.
00:03:50.145 --> 00:03:51.134
It generally worked okay.
00:03:51.139 --> 00:03:56.414
Like people were actually asking questions and engaged, you know, were interested and, and it was kind of like an internship as well.
00:03:56.414 --> 00:04:02.715
It wasn't quite a full position, but, um, that was a lot of fun and we got to review a lot of systems.
00:04:02.745 --> 00:04:07.155
Uh, kind of a continuation of the style of work at Cryptography Research and design some systems.
00:04:08.319 --> 00:04:11.259
This is roughly the same time when you were working on the toll systems, right?
00:04:11.680 --> 00:04:13.990
Like that was, you did that while you were at Root Labs.
00:04:14.560 --> 00:04:15.789
The, the toll system thing is fun.
00:04:15.789 --> 00:04:17.500
You should, you should tell us about the toll system thing.
00:04:17.500 --> 00:04:19.720
I, I wanna hear the, I wanna hear the toll system story.
00:04:19.935 --> 00:04:21.384
I have no idea about the story,
00:04:21.490 --> 00:04:23.819
Like, are we talking about like turnpikes here?
00:04:24.584 --> 00:04:25.185
kind of like that.
00:04:25.214 --> 00:04:26.954
Yeah, it was, it was a, it was a fun thing.
00:04:27.314 --> 00:04:30.014
So, uh, in the Bay Area there's something called Fast Track.
00:04:30.285 --> 00:04:32.925
It's called Fast Pass in other parts of the country, things like that.
00:04:32.925 --> 00:04:40.394
And they have different systems, and this is an interesting connection between like embedded systems and that you've got these transponders in each.
00:04:41.024 --> 00:04:44.805
And also the poles, the light poles that transmit the signal to the car.
00:04:45.165 --> 00:04:55.665
And then you've also got governments and regulations involved here because there's all these things about, you know, traffic laws and, and regulation of how much money you can collect and how they do it and stuff like that.
00:04:55.694 --> 00:04:58.754
And not really a big focus on privacy at the time.
00:04:58.935 --> 00:05:00.345
Um, maybe it's gotten better since then.
00:05:00.345 --> 00:05:01.214
It's been been a while.
00:05:01.214 --> 00:05:02.055
Hopefully it's gotten better.
00:05:02.475 --> 00:05:06.735
Maybe cell phone tower location has actually become the bigger problem nowadays, nowadays.
00:05:07.125 --> 00:05:11.504
But, uh, what I did was I just decided to take apart a fast track transponder.
00:05:11.504 --> 00:05:15.435
I, I'd never actually used them, but I was slash like, I wonder how these are built.
00:05:15.439 --> 00:05:18.264
So, pulled it apart, found MSP430.
00:05:18.285 --> 00:05:23.355
So there's your link to MicroCorruption as far as the MSP430 the processor for that
00:05:23.754 --> 00:05:23.995
Right.
00:05:25.574 --> 00:05:29.175
And, uh, yeah, so MSP430 is a really power efficient process.
00:05:29.714 --> 00:05:31.274
Uh, kind of funky instruction set.
00:05:31.274 --> 00:05:39.194
But um, yeah, so I opened it up, um, tried to dump, jump dump the flash from it and sure enough, like the one I had was actually unlocked.
00:05:39.464 --> 00:05:41.204
Um, so I got flash image off of it.
00:05:41.475 --> 00:05:53.444
I got several transponders though and some of them were locked and, um, you know, Chris Tarnovsky, uh, was able to using like a laser, zap the fuse on it and um, unlock it so the flash can be read off it So
00:05:53.475 --> 00:05:55.754
Was that a laser at Root Labs?
00:05:55.754 --> 00:05:57.285
Did you, Do you have a laser?
00:05:57.404 --> 00:05:58.064
Oh, okay.
00:05:58.274 --> 00:06:00.555
No, I don't do any real, real physical securities.
00:06:00.555 --> 00:06:16.725
I've mostly just board level work of like, you know, soldering to, to surface mount is about the extent I go to no fuming nitric acid in, in my office yet But Chris is great at that stuff and uh, yeah, he was able to just, um, really quickly knock the MSP430 fuse out.
00:06:17.115 --> 00:06:28.334
So anyways, we looked, got the, um, firmware, I started reverse engineering it and I got to do something really fun, which I was going on vacation, so I printed out the entire firmware listing cuz it was, I think it was like 8K or something.
00:06:28.334 --> 00:06:29.024
It was pretty small.
00:06:29.350 --> 00:06:30.930
is what you do on your vacation.
00:06:31.860 --> 00:06:33.509
It's like a, it's like a crossword puzzle.
00:06:33.509 --> 00:06:42.089
You know, you've got an assembly listing and a pencil, and a pool, and you sit there by the pool and you, you mark up the assembly language listing with a pencil.
00:06:42.509 --> 00:06:46.949
I found a bunch of interesting things about the protocol it used and, and how it worked.
00:06:47.550 --> 00:06:54.720
It's kind of a neat thing because the, they, they wanna be low power and then make the battery last almost forever, so it doesn't actually transmit.
00:06:54.720 --> 00:07:08.430
Instead what it does is it changes the polarization of an antenna in the device to bounce back reflections to, to talk in the reverse channel so that it gets transmitted stuff and it gets a carrier wave and it, it modulates the carrier wave back to the transmitter to respond.
00:07:08.430 --> 00:07:08.670
Yeah.
00:07:08.839 --> 00:07:09.105
Hold on.
00:07:09.105 --> 00:07:09.615
I'm gonna stop you.
00:07:09.644 --> 00:07:10.454
I'm gonna stop you right there.
00:07:10.459 --> 00:07:13.644
You got that from a paper print out of the raw assembly listing?
00:07:14.545 --> 00:07:22.259
Yeah, well I looked at the board too, you know, I saw, I had photos of the board, so yeah, so I could see like how the, how the antenna was set up and stuff like that on the board.
00:07:22.379 --> 00:07:23.670
It was just PCB traces.
00:07:23.790 --> 00:07:26.220
Anyway, so I sawed a bunch of wires to it.
00:07:26.220 --> 00:07:33.269
My, my BlackHat presentation had like, uh, a picture of that on the front cover in order to be able to trace all the signals of my oscilloscope and things like that.
00:07:33.629 --> 00:07:35.370
And, uh, so I just played around with it a little bit.
00:07:35.730 --> 00:07:44.699
But on vacation I found that there looked like there was actually a exploitable stack overflow in this, so it had a message that was not really fully implemented.
00:07:44.759 --> 00:07:50.790
So they had a switch statement that was handling all the different messages, and one of'em was like an update process.
00:07:51.329 --> 00:07:57.480
And I think they were using this maybe even in the factory for programming the board, uh, with a serial number or something like that.
00:07:57.600 --> 00:08:07.634
I'm not really sure exactly what they were using it for, but anyways, it had this reserved protocol, um, message that would, when you send it, it would like do an update, but it wasn't really well written.
00:08:07.634 --> 00:08:13.245
So it was supposed to have like a balance check on the update, but it was, I think they had a sign extension bug or something like that in the, the length check.
00:08:13.605 --> 00:08:21.714
And so you could actually send it and update with an incorrect length count and it would overwrite areas of flash that included the code area
00:08:21.714 --> 00:08:21.894
No.
00:08:22.105 --> 00:08:22.165
No.
00:08:22.165 --> 00:08:23.384
now get code execution
00:08:23.399 --> 00:08:24.000
Oh, no.
00:08:24.644 --> 00:08:27.644
And I was just like, okay, wow, this is crazy.
00:08:27.644 --> 00:08:35.174
So you can just like sit by the side of the road with an antenna and automate little box and like reprogram everybody's transponder to different serial numbers.
00:08:35.534 --> 00:08:39.884
You could reprogram the code and have code execution on it if you want, if you wanna do something funky with that.
00:08:41.654 --> 00:08:44.955
Yeah, free tolls, you know, give everyone the same 1, 2, 3, 4 id.
00:08:44.955 --> 00:08:48.674
So you can't really disable it because everybody's transponders that, or you have to do a recall.
00:08:48.674 --> 00:08:49.980
So it was pretty crazy.
00:08:50.190 --> 00:08:52.590
And so I wrote a blog post about this.
00:08:52.590 --> 00:09:03.299
I got a BlackHat talk, and I had offered, I knew that the, um, transit agencies probably were going to be not very happy to hear about this, given how many millions of these things they had deployed.
00:09:04.830 --> 00:09:06.179
I wasn't getting paid for it anyways.
00:09:06.179 --> 00:09:07.379
It was just a fun side project.
00:09:07.440 --> 00:09:16.139
So I didn't wanna get into a heavy like vulnerability disclosure kind of situation where I'm spending hours and hours trying to help someone fix their assembly lines of this thing.
00:09:16.440 --> 00:09:19.769
I just wanna like, give them information, hopefully get them to fix it.
00:09:19.769 --> 00:09:23.220
But of course there had to be some disclosure, otherwise they weren't gonna fix it at all.
00:09:23.250 --> 00:09:24.059
They're just gonna sit on it.
00:09:24.210 --> 00:09:28.740
So I, I talked actually to some local news programs and things like that, and they did some video on it.
00:09:29.009 --> 00:09:32.340
And of course the MTA was like saying, Oh yeah, this is no big deal.
00:09:32.429 --> 00:09:36.029
You know, it's, it takes a really sophisticated person to exploit this.
00:09:36.600 --> 00:09:41.639
I'm like, Yeah, once you know the bug, it's not that hard to exploit It's like one shot, one way.
00:09:41.669 --> 00:09:46.230
You just transmit it, broadcast it in a freeway and you, you, you got all the cars owned at that point.
00:09:46.710 --> 00:09:50.970
So yeah, so it kind of went back and forth and they just kind of, I think sat on it and died down.
00:09:51.029 --> 00:09:52.559
I don't know if they ever actually fixed it.
00:09:52.679 --> 00:09:59.159
I offered to help them like show up and give them a talk and explain the problem and, and walk them through the code so that their vendor could fix it.
00:09:59.610 --> 00:10:01.080
But, uh, they never took me up on it.
00:10:01.139 --> 00:10:02.700
So that's kind of where it ended up.
00:10:02.985 --> 00:10:03.595
mm-hmm.
00:10:04.320 --> 00:10:05.639
I didn't get sued though, which was great.
00:10:05.804 --> 00:10:21.495
That is great because there have been other like public transit agencies where you disclose problems with their, you know, their swipe cards and you know, all this sort of stuff, and they're like, not happy about it, So I was like a good thing you didn't get to
00:10:22.710 --> 00:10:26.279
This led into another side investigation, which was power meters.
00:10:26.549 --> 00:10:27.149
So,
00:10:27.735 --> 00:10:29.294
Like on the side of your house?
00:10:29.850 --> 00:10:30.330
Yes.
00:10:30.419 --> 00:10:38.759
Yeah, so the digital power meters they had, they were just in the process of swapping everyone's out for remote monitoring ones and I didn't like that idea either.
00:10:38.759 --> 00:10:44.279
So I, I went to try to buy one to reverse engineer it and it turns out that they don't wanna sell it to the public.
00:10:44.429 --> 00:10:49.559
Um, you know, the power meter companies are like, We need to know you're one of our approved vendors before we'll send it to you.
00:10:49.559 --> 00:10:50.279
So I was like, Okay,
00:10:50.985 --> 00:10:52.125
eBay at the time?
00:10:52.320 --> 00:10:53.340
not on eBay,
00:10:53.429 --> 00:10:53.700
Yeah.
00:10:54.120 --> 00:11:01.590
but, Good, good guess though, because it turns out that like, I was like, Wait a second, there's lots of remote power meter type monitoring things.
00:11:01.799 --> 00:11:02.879
There's water meters.
00:11:03.149 --> 00:11:08.340
So sure enough on eBay, the control board for the monitoring for water meters is there.
00:11:08.370 --> 00:11:10.740
And no one was really sensitive about water meters.
00:11:11.039 --> 00:11:12.870
So I was like, Great, I'll get that board instead.
00:11:13.320 --> 00:11:21.210
So I ordered it off eBay for I think$30 and took it apart with a dremel to get the case off and, and uh, cause they had it all waterproof and things and.
00:11:21.929 --> 00:11:25.049
You know, sure enough, MSP430 again, so I was like, Oh, I know these.
00:11:25.049 --> 00:11:31.019
So, so sure enough it's unlocked again, so dump the flash and start reverse engineering again.
00:11:31.559 --> 00:11:34.950
I didn't have a vacation, so I actually had to sit at home and reverse engineer this one, but.
00:11:35.595 --> 00:11:35.865
Yeah.
00:11:35.865 --> 00:11:44.115
I found that it used, um, a different protocol, but it was also similar in terms of the, the basic construction of it to the, uh, transponders.
00:11:44.595 --> 00:11:55.544
And there wasn't a remote update process, fortunately, but there were some other things about the handshake required for remote turnoff that was not really well implemented cryptographically.
00:11:56.085 --> 00:12:01.424
Um, they had made some attempts at crypto, whereas the transponder just broadcast out its serial number to anyone who queries it.
00:12:01.424 --> 00:12:05.835
So it wasn't really, there was no crypto there, but they had not really done much work.
00:12:05.835 --> 00:12:08.924
I, I don't remember exactly what the flaw was, but it was something really elementary.
00:12:08.985 --> 00:12:13.335
Maybe it was like same key in everything or, or something very, very rudimentary like that.
00:12:13.695 --> 00:12:15.945
So I was like, this is terrible.
00:12:16.034 --> 00:12:20.565
Because it's one thing to design something that you can do remote monitoring of power.
00:12:20.835 --> 00:12:22.365
It's another thing to have remote shutoff.
00:12:22.575 --> 00:12:30.105
And they wanted the remote shutoff because they wanted to be able to prevent rolling blackouts or give people sort of voluntary ways to opt into.
00:12:30.779 --> 00:12:35.820
We'll pay you a lower rate if you let us shut down your refrigerator or your, your house, you know, to save money.
00:12:35.899 --> 00:12:36.720
but still,
00:12:36.929 --> 00:12:38.639
But they hadn't had it all figured out.
00:12:38.759 --> 00:12:43.200
And it's like, I understand they only get to roll the trucks once to swap out the hardware.
00:12:43.649 --> 00:12:52.889
But at the same time, if you're gonna design a system with that kind of power, you really, or abilities, you know, you really need to think carefully about your, your crypto and, and your, your capabilities there.
00:12:52.889 --> 00:13:01.529
For example, having really strong secondary authentication for any actions you need to do, like two factor things like that, to, to, to launch an action.
00:13:01.590 --> 00:13:11.460
If you wanna shut off the mayor's power, probably there's some kind of log that goes through that you probably, you know, shouldn't just be any random city worker that can do that, or you know, the hospital or something.
00:13:11.879 --> 00:13:13.470
So, Yeah.
00:13:14.009 --> 00:13:14.190
Yeah.
00:13:14.190 --> 00:13:15.120
It's just, it's just terrible.
00:13:15.120 --> 00:13:19.860
So like, I was like, again, I was like, okay, remote monitoring, yes, there's privacy implications.
00:13:20.070 --> 00:13:27.450
They'll, they're gonna find out about my giant grow farm in the garage, but, um, or maybe I can spoof a grow farm at my neighbor's house, you know?
00:13:28.125 --> 00:13:28.845
Oh my God.
00:13:28.845 --> 00:13:30.884
This makes me think about swatting people.
00:13:30.914 --> 00:13:39.014
And like, if you swap people, they, they come with guns, but you could go like one level below and just be like, Oops, I turned your electricity off.
00:13:39.014 --> 00:13:40.845
Hur hur hur like an asshole.
00:13:41.445 --> 00:13:42.105
Exactly.
00:13:42.264 --> 00:13:43.784
A very elaborate way to swat somebody.
00:13:44.565 --> 00:13:45.254
Yeah, it is.
00:13:45.254 --> 00:13:51.884
Instead of a phone call and a, and a and a good little skit that you do to the, to the cops, you, you do a remote attack.
00:13:51.945 --> 00:13:52.514
I don't know.
00:13:52.845 --> 00:13:54.254
It's a lot easier to get away with
00:13:55.440 --> 00:14:06.000
There was like a run of time, like right after Obama got elected in'08, he had a bunch of high profile cabinet appoint appointees and one of his big ones was I think the Department of Energy.
00:14:06.269 --> 00:14:10.110
I can't remember the the name of the guy, but it was a whole big thing and there was
00:14:10.164 --> 00:14:12.794
think it was the physicist guy from MIT, that guy.
00:14:12.914 --> 00:14:13.304
Yeah.
00:14:13.470 --> 00:14:17.460
So like, there was a big push towards like smart grid stuff.
00:14:17.519 --> 00:14:19.235
There had been like a huge power outage.
00:14:19.235 --> 00:14:25.080
It was like a nation, like a, from like, you know, most of the eastern seaboard power outage a couple years before.
00:14:25.259 --> 00:14:27.759
So like getting the grid more resilient was a big thing.
00:14:27.899 --> 00:14:30.029
And like conservation was a big thing.
00:14:30.029 --> 00:14:33.480
So this is like this huge push towards smart grid stuff.
00:14:33.899 --> 00:14:40.409
And long story short, like pretty much every appsec firm in the world now has a story about how they could turn people's power off.
00:14:40.679 --> 00:14:45.809
Because there was like, I think there was like six or seven different vendors, um, that were doing different systems there.
00:14:46.200 --> 00:14:54.389
This is by the way, the reason why every time any kind of discussion about crypto protocols comes up, I ask people whether the counters in their counter mode encryption can wrap.
00:14:54.389 --> 00:15:02.340
I told that to Trevor Perrin once and he's like,"Is that a realistic concern?", like are you really gonna rap like a GCM counter or whatever?
00:15:02.370 --> 00:15:05.190
Cause it's, it's a, it's a huge, like realistically it's, it's a huge counter.
00:15:05.195 --> 00:15:05.580
Right?
00:15:05.730 --> 00:15:17.429
It's because I worked on some Smart meter thing, which was all embedded crypto where they were doing like a full on bidirectional RF protocol and the, the message head room they had was very, very small.
00:15:17.549 --> 00:15:22.259
So they were doing counter mode, but with a very short, truncated counter, which you could easily wrap.
00:15:22.470 --> 00:15:25.919
That's like, that's actually not really a super realistic problem, but it's a thing I keep bringing up.
00:15:26.190 --> 00:15:31.409
Just like, you know, logging into a web app the first time with quote OR quote quote equals quote thinking that's, they keep popping up.
00:15:31.559 --> 00:15:37.080
It's like, someday I will find another system where you can actually exploit it by wrapping its counter or whatever.
00:15:37.409 --> 00:15:37.980
Yeah.
00:15:37.980 --> 00:15:38.460
I don't know.
00:15:38.460 --> 00:15:46.620
It's all those systems were super fun to work with, but like, did you ever, on any of these projects get to the point where you were directly transmitting back?
00:15:46.860 --> 00:15:50.340
Like did you have a transmitter for the, either the toll stuff or for the smart meter stuff?
00:15:52.049 --> 00:15:56.370
No And, uh, there's a specific reason why the answer is no on that.
00:15:56.700 --> 00:16:02.730
So there's a fine line between disclosing something and making yourself a target for various kinds of retaliatory action.
00:16:02.730 --> 00:16:03.779
And that's, uh, that was.
00:16:03.809 --> 00:16:04.350
Definitely.
00:16:04.409 --> 00:16:05.730
Seems total, it seems totally fair.
00:16:05.735 --> 00:16:05.909
Right?
00:16:05.909 --> 00:16:08.970
But like if you're on like an actual contracted test with a vendor, right?
00:16:08.975 --> 00:16:11.460
Like, it seems like that's, that's well within bounds.
00:16:11.465 --> 00:16:20.429
But I've been talking to people every time I hear somebody that's done an RF project, it's like, one of the first questions I asked is like, do you actually have the whole RF stack implemented?
00:16:20.429 --> 00:16:25.409
Or are you just using, you know, a device that you, you know, reversed as a modem for it?
00:16:25.409 --> 00:16:25.799
Right?
00:16:25.919 --> 00:16:37.529
I haven't really talked to anyone yet that's done it, but I'm, I'm curious to see if anyone was actually built the whole, you know, kind of communication stack for any of these systems, or if they've just injected code into, you know, a meter or whatever.
00:16:37.784 --> 00:16:44.654
Yeah, for these cases, I mean the um, Fast Track transponder was actually very easy to tap into.
00:16:44.654 --> 00:16:53.205
And so I built my own connector and I could drive around using my laptop and my PCs oscilloscope and record all the IDs of the light poles as we drove past them.
00:16:53.210 --> 00:16:55.514
Cause what they do is they have two different protocols.
00:16:55.514 --> 00:16:57.284
One was like, What's your serial number?
00:16:57.465 --> 00:16:58.934
The other one's, what's your serial number?
00:16:58.934 --> 00:16:59.595
And beep.
00:17:00.075 --> 00:17:08.505
And that one's for, you go through the Toll plaza and the, what's your serial number was for monitoring the speed of highway traffic on various segments of the freeway.
00:17:08.894 --> 00:17:16.075
And so one of the things that, the thought experiments I did and, and talked about my blog a bit, was how could you actually design this in a privacy preserving way?
00:17:16.464 --> 00:17:18.569
With the same basic hardware restrictions.
00:17:18.599 --> 00:17:26.609
So you're, you're driving around on a highway, you don't want to broadcast a persistent ID every you go and create a log on their systems of everywhere you've been.
00:17:27.240 --> 00:17:32.910
So is there a way to calculate the average speed of traffic on various segments of the highway without doing that?
00:17:32.910 --> 00:17:38.160
And there's lots of different protocols you could do if you thought of privacy actually mattering when you designed it.
00:17:38.789 --> 00:17:44.579
Which the, uh, the government probably didn't think is a concern when they deployed these things.
00:17:44.585 --> 00:17:44.910
Wow.
00:17:44.910 --> 00:17:45.390
Okay.
00:17:45.599 --> 00:17:57.890
I mean, if you're, if I was in charge of, of designing like this smart grid stuff back in the day, I might do something like at a control port, like a physical control port for a peripheral bus onto the, the meter or something like that and be like, okay.
00:17:58.470 --> 00:18:08.309
Once we decide how we're gonna do control stuff, maybe people who opt into it will mail them something, you know, a little package that they can just go plug onto the side of their meter with a consumer accessible kind of thing.
00:18:08.309 --> 00:18:13.410
It's like, you wanna opt into this program of saving money, then plug this into the side of your house, kind of thing.
00:18:13.410 --> 00:18:17.940
You know, it's very easy to do user friendly, and once you plug it in, you're now a part of this thing.
00:18:18.000 --> 00:18:25.289
If you don't plug into it, then you're not opted in and someone can easily tell if a given house is participating in this remote shutoff kind of situation,
00:18:25.369 --> 00:18:28.275
can only opt into this remote shutoff thing.
00:18:28.305 --> 00:18:32.384
You will not be deployed to you by default, uh, by the government.
00:18:33.210 --> 00:18:33.480
right.
00:18:33.484 --> 00:18:36.450
And, and yeah, and, and turned on already before they figured everything out.
00:18:36.525 --> 00:18:36.855
Yeah.
00:18:37.680 --> 00:18:38.250
I'm pretty sure.
00:18:38.250 --> 00:18:45.539
I'm pretty sure some of the motivation for remote shutoff is just minimizing truck rolls for actually shutting people off.
00:18:45.599 --> 00:18:51.809
So like, yeah, the opt-in thing, it addresses one of their stories, but probably not the real story they have.
00:18:51.809 --> 00:18:52.079
Right.
00:18:52.085 --> 00:18:54.480
Which is just, it costs us money to shut people off.
00:18:54.480 --> 00:18:57.150
Wouldn't it be nice if we could like have a cron job that shuts people off?
00:18:58.095 --> 00:18:58.755
Absolutely.
00:18:59.085 --> 00:19:01.815
Yeah, no cost savings was, I think, the bigger reason for that.
00:19:01.875 --> 00:19:03.224
Not, not for load shifting.
00:19:03.644 --> 00:19:06.884
This is Root Labs in the two thousands, late two thousands.
00:19:07.095 --> 00:19:08.714
2008, 2009.
00:19:08.819 --> 00:19:09.089
Okay.
00:19:09.390 --> 00:19:17.130
Um, there was something you were working on about 2011 about some sort of mobile payment system.
00:19:17.519 --> 00:19:18.869
Can you tell us about that?
00:19:19.440 --> 00:19:21.690
Some sort of mobile payment system.
00:19:21.900 --> 00:19:22.410
Yeah.
00:19:22.470 --> 00:19:26.099
I don't know what sort, there was some sort of mobile payment system.
00:19:26.105 --> 00:19:26.390
Um,
00:19:27.265 --> 00:19:29.204
Well, it doesn't really matter to specifics.
00:19:29.204 --> 00:19:31.184
It's what matters is how, how it works.
00:19:31.545 --> 00:19:33.974
So I was, um, yeah, another vacation.
00:19:34.005 --> 00:19:40.515
I, it sounds like I took lots of vacations, but I really didn't, uh, I was like, you know, driving down the freeway and I got a call on my phone.
00:19:41.240 --> 00:19:45.494
and someone was like, who I knew casually was like, Hey, we're designing this new device.
00:19:45.525 --> 00:19:48.615
It's gonna be, you know, mobile payment system, it needs security.
00:19:49.065 --> 00:19:50.744
And uh, we need it yesterday.
00:19:51.105 --> 00:19:53.714
And I was like, Okay, yeah.
00:19:53.775 --> 00:19:55.515
Um, sure I'd be happy to help with that.
00:19:55.755 --> 00:20:00.704
And that ended up being the same weekend that the tsunami hit, uh, hit Japan.
00:20:01.184 --> 00:20:04.065
And, uh, so it was like very memorable to me.
00:20:04.244 --> 00:20:10.214
It, it was like, uh, being on vacation and hearing that, uh, tsunami warnings going off in California because of the, um, the sirens from that.
00:20:11.174 --> 00:20:11.505
Yeah.
00:20:11.505 --> 00:20:13.305
So that was a propitious start.
00:20:13.394 --> 00:20:26.684
Uh, but when I got back, I was, I talked to the company more and what they were doing was they had a design firm who was helping them build this new device and it's gonna be a, you know, payment terminal and accept credit cards and all this.
00:20:26.684 --> 00:20:27.825
So they wanted it to be secure.
00:20:27.944 --> 00:20:29.805
And it's kind of interesting, some of the requirements for it.
00:20:30.630 --> 00:20:35.069
You know, they wanted it to use as little flash as possible, as little storage as possible to make it cheap.
00:20:35.279 --> 00:20:37.319
You wanted long battery life as well.
00:20:37.440 --> 00:20:40.200
Uh, so you didn't have to keep replacing the battery on it.
00:20:40.319 --> 00:20:44.519
And also security wise, you know, you think, oh yeah, just encrypt everything.
00:20:44.519 --> 00:20:48.359
But, um, actually with, um, payment system, sometimes you don't wanna encrypt everything.
00:20:48.359 --> 00:20:59.220
Like, uh, for example, you wanna leave like the last four digits of the credit card number in the clear so that intermediate device can present a dialogue to the user and, you know, help them understand what's going on, Things like that.
00:20:59.819 --> 00:21:03.299
So they said, we're gonna do this and it's gotta fit in.
00:21:03.420 --> 00:21:08.849
I think the original requirement was 4K and I was like, Okay, 4K for what?
00:21:08.849 --> 00:21:13.529
And they're like, Well, we're gonna do like 1K for the card swipe handling.
00:21:13.529 --> 00:21:19.500
Like the, the logic for that 1K for AES, 1K, I can't remember what the, the third 1K was for.
00:21:19.500 --> 00:21:21.779
And then 1K for like, everything else.
00:21:21.930 --> 00:21:24.450
And I was like, So the, the encryption protocol?
00:21:24.450 --> 00:21:24.630
Yeah.
00:21:24.660 --> 00:21:25.049
Yes.
00:21:25.259 --> 00:21:26.700
The, uh, message sizzling.
00:21:26.700 --> 00:21:27.089
Yes.
00:21:27.119 --> 00:21:27.509
And so,
00:21:27.734 --> 00:21:28.734
asymmetric crypto
00:21:30.734 --> 00:21:34.515
Yeah, so there, uh, asymmetric crypto didn't really fit in this.
00:21:34.575 --> 00:21:38.505
It was a, a really, again, a really small device, micro controller basically.
00:21:38.924 --> 00:21:42.194
And, uh, didn't have any acceleration for, for public key crypto.
00:21:42.194 --> 00:21:50.865
So what we did was we were gonna build something off of symmetric crypto and there was some negotiation over which 1K bucket was gonna be holding which functionality.
00:21:51.285 --> 00:21:57.884
And so the design firm, I don't know if you've worked with design firms before, but they're very good on like, kind of industrial design.
00:21:58.125 --> 00:22:09.555
They're pretty good at rapid prototyping, but in terms of making something production ready, they tend to not be so focused on cost reduction and design for manufacturing, testability, things like that.
00:22:09.795 --> 00:22:11.835
and long term maintenance of the code.
00:22:12.644 --> 00:22:13.454
Absolutely.
00:22:13.454 --> 00:22:13.815
Yeah.
00:22:13.904 --> 00:22:18.944
So there was a bit a tug of war between us where I was like, you know, well you should really own this part of it.
00:22:19.005 --> 00:22:22.994
And they're like, Well, this is, no, this is, we don't have room for this because we got all this other stuff.
00:22:22.994 --> 00:22:25.755
So basically everything kept getting shoved into my 1K bucket.
00:22:26.295 --> 00:22:40.065
Until I was left with, once the card had been swiped all the protocol handling for it, all the, uh, cipher mode stuff and, uh, a lot of the message swizzling and the error handling and things like that.
00:22:40.125 --> 00:22:44.894
So all that was in this 1K bucket and I, I was like, well, I think I can make it fit.
00:22:44.894 --> 00:22:49.484
But, you know, and AES itself was, was one 1K of it as well.
00:22:49.815 --> 00:22:52.484
So we got down to designing it and working on it.
00:22:52.484 --> 00:23:04.845
And I really wanted to get this right once because it was gonna be, you know, millions of device recall if something was really bad about this, a big reputation hit and, and a lot of potential damage.
00:23:04.845 --> 00:23:08.835
Even, even if the actual risk to individual users of the device was low.
00:23:08.835 --> 00:23:10.644
If, if there was a, a bug in the software.
00:23:11.505 --> 00:23:16.394
So at the time it was very difficult to do, um, AEAD modes.
00:23:16.694 --> 00:23:29.325
There was OCB, there was like XEX, there was a few different modes, sort of the big giant AES modes, the two pass modes, and there was also, uh, one pass modes, which was OCB but that was patented.
00:23:29.325 --> 00:23:30.805
And so nobody really
00:23:30.839 --> 00:23:39.089
was gonna say, like, I don't, I don't think you had OCB had quote unquote air quotes, OCB at the time, 2011 because of patents.
00:23:39.089 --> 00:23:43.140
You only, we've only got it in the past few years because it came out of patent.
00:23:43.755 --> 00:23:44.115
Right.
00:23:44.654 --> 00:23:44.835
Yeah.
00:23:44.835 --> 00:23:50.174
So the company didn't want OCB and actually the first thing I offered to them was like a tweaked XTEA mode.
00:23:50.825 --> 00:23:55.184
And the reason for that was to buy back some of that 1K from AES implementation itself.
00:23:55.184 --> 00:23:57.765
But they're like, No, no, for standards reasons, it's gotta be AES.
00:23:57.795 --> 00:23:58.785
And I was like, Okay, fine.
00:23:58.964 --> 00:23:59.444
So
00:23:59.654 --> 00:24:00.644
And no GCM.
00:24:00.974 --> 00:24:03.644
no GCM, no too heavy weight for a microcontroller.
00:24:04.125 --> 00:24:04.394
Alright.
00:24:04.394 --> 00:24:04.694
Okay.
00:24:04.970 --> 00:24:07.724
all the polynomial multiplies would, would be too heavy for it.
00:24:08.055 --> 00:24:08.474
So,
00:24:08.839 --> 00:24:09.244
Okay.
00:24:09.464 --> 00:24:10.634
For the, uh, authenticator.
00:24:10.934 --> 00:24:18.345
So I scoured the literature for what other modes can be turned into a one pass mode that's also tiny to implement.
00:24:18.855 --> 00:24:20.325
And I came across this thing.
00:24:20.565 --> 00:24:28.484
I think it's probably the only time or the biggest market use of this particular mode, I've never seen it used anywhere else, but it's called CCFB so everyone knows
00:24:28.515 --> 00:24:28.694
heard of
00:24:28.775 --> 00:24:39.404
CFB and CFB itself is not really often used, or even in the past it wasn't, CBC was much more common, but cipher feedback mode, this one had a counter cipher feedback mode.
00:24:39.734 --> 00:24:46.785
So it was a combination of counter mode for encryption and cipher feedback mode for creating authenticator tag for that.
00:24:46.785 --> 00:24:49.335
And um, it was a kind of a clever mode I thought.
00:24:49.755 --> 00:24:59.055
And I needed to tweak it to be really tiny, to fit the authenticated data portion because like I said, like the last four digits of the credit card number, you need to authenticate that, but not encrypt.
00:24:59.714 --> 00:25:09.105
And so CCFB was pitched as a two pass mode, but with like a wink and a smile because it could be actually implemented as a one pass mode, but they didn't wanna look like they were infringing on patents.
00:25:09.345 --> 00:25:12.795
So, so they specified it as a two pass.
00:25:12.799 --> 00:25:16.875
But if you just implemented the two passes, as in, in a single pass, you could, you could do that.
00:25:16.880 --> 00:25:18.494
There weren't dependencies between the two passes.
00:25:18.734 --> 00:25:43.244
So like a one pass mode here, and maybe I'm just wrong about it, or maybe I'm demystifying it, you never know with me, but like one pass mode in an authenticated cipher, we're talking about the two operations of first encrypting it, you know, transforming plain text, decipher text, and then also creating some kind of, you know, tag or mac or hash that goes, the end of that verifies that the, you know, that the whatever you've decrypted matches what was encrypted in the first place.
00:25:43.244 --> 00:25:43.634
Right.
00:25:43.724 --> 00:25:55.634
And then one pass and two best refers to how many times like the cipher core or whatever cipher core, you know, there might be different ones for authentication and encryption, but like however many times that's to go span the input, right?
00:25:55.634 --> 00:26:02.234
Like a one pass thing is simultaneously encrypting and authenticating in the same one cryptographic sweep across the plain text.
00:26:02.444 --> 00:26:08.204
And a two pass mode is potentially, you know, going twice over once to encrypt and then once to create the authentication tag.
00:26:08.355 --> 00:26:08.714
That's right.
00:26:08.714 --> 00:26:08.924
Right.
00:26:08.964 --> 00:26:10.095
I'm, I'm pretty sure I'm right about that.
00:26:10.980 --> 00:26:11.730
Yes, that's correct.
00:26:11.970 --> 00:26:16.859
At the time, there weren't, uh, other than ocb, which is patented, there weren't very many one pass modes.
00:26:16.859 --> 00:26:18.750
In fact, I think this was the only other one I knew of.
00:26:18.869 --> 00:26:21.569
So this one was explicitly in the public domain, which was cool.
00:26:21.720 --> 00:26:31.230
So I modified it rather than doing the, It did have a separate authenticated data pass, but again, due to memory constraints, I only had less than a kilobyte of RAM to work with as well.
00:26:31.500 --> 00:26:38.160
So what I ended up doing was I actually ended up reusing the card swipe buffer as it went along for variable storage.
00:26:38.250 --> 00:26:44.670
So parts of the card data that were no longer used became counters and stuff, which is not a good programming practice, but was necessary in this particular environment.
00:26:44.910 --> 00:26:49.440
Did you ever run in into any issues with that, or did you check everything?
00:26:49.589 --> 00:26:52.000
Yeah, I would just be so scared to do that.
00:26:52.400 --> 00:26:54.119
Yeah, uh, I was too.
00:26:54.569 --> 00:26:56.819
I very carefully, uh, speced it out.
00:26:56.940 --> 00:26:59.160
I designed the code to be really, really, really small.
00:26:59.160 --> 00:27:02.759
Like not just small compilation, but small source code as well.
00:27:03.059 --> 00:27:05.220
And the messages were all fixed size.
00:27:05.250 --> 00:27:06.240
Everything was fixed size.
00:27:06.390 --> 00:27:15.000
Even if there was a few bites wasted here and there, by keeping everything fixed size, it avoided having length fields that could then lead to buffer, overflows, overflows, whatever.
00:27:15.119 --> 00:27:19.319
And yeah, so it'd be like, you know, what's the maximum, uh, name that compare on a credit card?
00:27:19.349 --> 00:27:20.730
Okay, this number of characters.
00:27:20.970 --> 00:27:24.660
So we're not gonna try to compress it or throw away spaces or anything like that.
00:27:24.690 --> 00:27:27.000
We'll, just like this field is always this size.
00:27:27.210 --> 00:27:36.359
So in order to convert this one pass mode into, to do authenticated data without this extra step it had for the authenticator, cuz we didn't have time or space for that.
00:27:36.539 --> 00:27:44.640
What it did was it just encrypted the authenticated portion of the data, the clear text data, but threw away the, the, the key stream for those, that part of the message.
00:27:45.000 --> 00:27:50.490
And, uh, it was a very small hack, but you know, you could prove that it degenerates back to the original case of encrypting it.
00:27:50.819 --> 00:27:53.339
Uh, but you'd basically exposing some plain texts and throwing away key.
00:27:54.164 --> 00:28:00.555
So I did that in order to avoid temporary variables, did things like moving things around in the buffer by swapping repeatedly.
00:28:00.674 --> 00:28:05.234
So it's like, reverse this string, reverse this string, and then swap them by reversing the whole thing.
00:28:05.625 --> 00:28:12.615
So I did stuff like that, like repeated reversals, and that's kind of an interesting way to swap multi bite fields without actually explicitly swapping them.
00:28:12.884 --> 00:28:15.944
Did some, some little hacks like that and then basically built
00:28:15.990 --> 00:28:20.250
That's ho I just, the picture just crystallized in my head of what you're doing there.
00:28:20.490 --> 00:28:21.089
That's horrible.
00:28:21.734 --> 00:28:25.964
Yeah, so that was to get the last four digits into the clear text authenticated data field.
00:28:26.384 --> 00:28:34.815
Uh, so I knew a fixed offset, like encrypt all these bites up to here, and then beyond that, don't encrypt these bites and then pass off the authenticator tag at the end.
00:28:34.815 --> 00:28:45.015
And so all the plaintext stuff had to be gathered together at the end of the message so that we could just have a single switch instead of switching on and off between cipher text or not, uh, which would've made the code more complicated.
00:28:45.075 --> 00:28:49.095
So yeah, so you do like reverse a part of it, reverse the other part of it, and then reverse the whole thing.
00:28:49.410 --> 00:28:52.140
What, like what horrible 1980s Dr.
00:28:52.140 --> 00:28:53.549
Dobbs nonsense is this?
00:28:53.609 --> 00:28:54.450
Where did you get that?
00:28:56.115 --> 00:28:56.954
I just came up with it.
00:28:56.954 --> 00:29:06.765
Honestly, like, I mean there's a lot of stuff of swapping via repeated XORs, for example, that's used in in some kinds of things, and that that kind of stuff comes also when you're doing hardware design.
00:29:06.765 --> 00:29:12.434
Like if you're design FPGAs or ASICs there's a lot of tricks you do like that because wires are free.
00:29:12.434 --> 00:29:21.914
In ASICs, you're just connecting one spot on the chip to another spot, so you can swap wires all you want to, and it costs zero resources when you're moving data from one part of the chip to the other.
00:29:22.575 --> 00:29:24.105
So this was that kind of thing.
00:29:24.974 --> 00:29:25.994
But anyways, it succeeded.
00:29:26.025 --> 00:29:33.375
I was able to get everything into one kilobyte, all the message channeling the checks on the, the authenticator, the encryption mode, all listen to theirs.
00:29:33.404 --> 00:29:34.484
I was really proud of that code.
00:29:34.515 --> 00:29:40.994
I built a fuzzer for it and shipped, like when I deliver when I delivered to the customer, I'm like, Here's the code that implements it.
00:29:41.055 --> 00:29:44.295
It compiles down into less than the kilobyte for the micro controller.
00:29:44.714 --> 00:29:56.085
You can also compile it in, uh, it's C code, but you can compile on the host side and here's a plugin API for using it to, to decrypt on the host side once you receive these encrypted credit card numbers.
00:29:56.565 --> 00:29:58.065
And I fuzz the heck out of this thing.
00:29:58.065 --> 00:30:00.855
Like I fuzzed every bit of the message, you know, and all these different things.
00:30:00.855 --> 00:30:05.984
So, you know, I'm really reasonably confident with fixed size messages and even, even this kind of funky handling and stuff like that.
00:30:05.984 --> 00:30:11.625
This actually is correct in terms of the implementation, but it took a lot of time.
00:30:11.625 --> 00:30:20.144
I mean, at CRI we would often say if you wanna have high assurance in a system, you have to spend 10 times the resources on verification as you do on designing a system.
00:30:20.684 --> 00:30:24.704
And so I really did put a lot of time into that as far as the verification stage.
00:30:24.704 --> 00:30:27.795
It wasn't just like, hack out some code and there you go, ship it and I'm done with the project.
00:30:28.394 --> 00:30:30.434
So yeah, that actually it worked, It shipped.
00:30:31.605 --> 00:30:38.144
I got the wonderful news at the end of the project that, well, actually the design firm couldn't fit their stuff into their, their one kilobytes.
00:30:38.144 --> 00:30:43.154
So we're going with the 8K parts of a 4K part, and I was like, I just tore my hair out over this one.
00:30:43.160 --> 00:30:43.545
K.
00:30:44.234 --> 00:30:46.484
It's also a problem that no one is ever gonna have again.
00:30:46.694 --> 00:30:47.805
Everything now is just arm.
00:30:47.954 --> 00:30:48.224
Right.
00:30:48.345 --> 00:30:49.365
It's very disappointing.
00:30:49.575 --> 00:30:52.994
I have a question like why the obsession with doing a single pass mode in the first place?
00:30:53.000 --> 00:30:53.265
Right?
00:30:53.444 --> 00:30:54.825
You're just burning compute there.
00:30:54.825 --> 00:30:55.785
Not actually code space.
00:30:55.785 --> 00:30:56.085
Right.
00:30:56.835 --> 00:30:59.805
well there's a very limited amount of RAM that was part of it.
00:31:00.494 --> 00:31:03.224
And also there was a latency issue.
00:31:03.255 --> 00:31:12.525
So when you swipe a credit card through a terminal, you wanna be able to show the user immediately that you have a valid swipe, that you know their four digits of their numbers correct, things like that.
00:31:12.525 --> 00:31:14.325
Like you wanna be able to present to'em that it succeeded.
00:31:14.325 --> 00:31:15.674
Otherwise they're gonna try to swipe again.
00:31:16.125 --> 00:31:19.275
And so it would've taken a few seconds to do like a two pass mode.
00:31:19.545 --> 00:31:24.944
Whereas with the one pass mode, I mean already AES on an eight bit micro controller is pretty slow, just AES.
00:31:25.295 --> 00:31:25.714
Huh?
00:31:26.174 --> 00:31:31.575
I, I don't know what implementation we ended up using, but it was not optimized for afit micro controllers.
00:31:31.575 --> 00:31:37.545
So it was just one of those things where it's like, okay, we're running, I think as maybe 16 megahertz, I don't remember exactly, 12 or 16.
00:31:38.055 --> 00:31:45.105
So everything was just like fit, fit it as little time as possible, latency wise, and as, as few resources possible to make the chip cheap.
00:31:45.599 --> 00:31:49.440
And this was for swipes, not for chips at the time, I assume, right?
00:31:49.619 --> 00:31:58.380
Cause it had been for chips, apparently it's okay to make people wait like eight minutes for a chip to go through, based on my experience, uh, uh, with point of sale systems.
00:31:58.545 --> 00:32:09.494
I mean, sometimes people care more about the quality of things when you, when it's the first version of it, you know, it's a reputation thing and it's like, then you get focused on cost and things kind of have a race to the bottom in terms of quality after that.
00:32:09.740 --> 00:32:15.480
Well, like the chip reader also takes custody of your, of your card while it's doing the thing and then tells you when you can have it back.
00:32:15.779 --> 00:32:18.359
So you have like a, you have, you have a lot of leeway there, right.
00:32:18.359 --> 00:32:22.319
But when people are swiping, they, they can autonomously swipe over and over again until it never works.
00:32:23.279 --> 00:32:23.700
Huh?
00:32:24.390 --> 00:32:27.450
I'm developing opinions about latency and, uh, payment card systems.
00:32:27.450 --> 00:32:29.880
Now, I didn't, I didn't, I didn't have'em before, but now I do.
00:32:30.029 --> 00:32:31.319
My opinions are that David is wrong.
00:32:34.454 --> 00:32:49.934
Um, I think you said that they needed to use AES for reasons, for standards reasons, but I think I was just double checking that Chacha Poly, which was supposed to be much nicer for software only implementations of an AEAD was available at this time, but they just didn't wanna use
00:32:50.204 --> 00:32:51.494
not on an eight bit micro, right?
00:32:51.500 --> 00:32:54.444
Like you'd still be, cuz Chacha wants a multiplier, doesn't it?
00:32:54.454 --> 00:32:55.404
Am I wrong about that?
00:32:56.204 --> 00:32:57.315
I forget, I dunno,
00:32:57.755 --> 00:33:00.825
I don't remember either, but there was much better choices nowadays.
00:33:00.825 --> 00:33:04.035
So by describing it this way, I'm not saying this is the recommended way to do it now, but
00:33:04.424 --> 00:33:05.234
Oh, sure, sure, sure.
00:33:05.444 --> 00:33:13.105
But yeah, I was just sort of like, oh, if you're doing like a, a lower capability device, like the thing I would reach for first would be Chacha Poly, just because like that.
00:33:13.529 --> 00:33:25.799
It's explicitly supposed to be for, uh, lower power, lower capability devices as opposed to to AES G C I, which is sort of like the gob standard for a device if you just need an AEADs.
00:33:25.799 --> 00:33:38.519
Now, although we will have other people be like, that is like fragile mode that you should use OCB or you know, whatever, the less difficult to implement, uh, less likely to break on you, uh, AEADs mode now
00:33:38.654 --> 00:33:40.065
Those, those people are right too.
00:33:40.065 --> 00:33:40.305
Right.
00:33:40.305 --> 00:33:48.674
But like the big, the big distinction between Poly 1305 and uh, and GCM is that you don't need a care like to, to get like a constant time implementation.
00:33:48.674 --> 00:33:52.575
You don't need a careless multiplication instruction for, for Poly 1305.
00:33:52.579 --> 00:33:53.724
And you would for GCM,
00:33:54.450 --> 00:33:55.140
I think that's right.
00:33:55.140 --> 00:33:56.059
That sounds correct,
00:33:56.154 --> 00:34:04.634
I mean, because of PCI people wanted to use AES so that they would not get flagged for a non-standard crypto and all these other things.
00:34:04.634 --> 00:34:11.684
Even the mode I was using was something that caused some pause of like, why isn't it GCM or why isn't it, you know, AEX or whatever it was, you know,
00:34:11.985 --> 00:34:15.164
It's like, because you only gave me 1K, like Jesus.
00:34:15.344 --> 00:34:15.974
Exactly.
00:34:17.175 --> 00:34:22.394
If you want the boring crypto, boring crypto, according to the PCI standard, I need more room.
00:34:22.545 --> 00:34:22.815
Right.
00:34:23.264 --> 00:34:23.894
Exactly.
00:34:24.480 --> 00:34:33.539
So if you were going to add some, if you were gonna for some reason add symmetric cryptography to Apple II Karateka, what would you have used instead of AES?
00:34:33.599 --> 00:34:35.400
Would it have been a TEA derivative?
00:34:35.684 --> 00:34:35.954
Yeah.
00:34:36.014 --> 00:34:41.025
I mean that was my first inclination was XXTEA or whatever at, at the time.
00:34:41.324 --> 00:34:46.034
And possibly making it a little more robust by doing like a multi key combination of it.
00:34:46.420 --> 00:34:47.579
now you'd use NSA Spec
00:34:48.675 --> 00:34:49.005
I don't know.
00:34:49.695 --> 00:34:50.414
that's a good question.
00:34:52.094 --> 00:34:53.144
I'm not sure exactly.
00:34:53.445 --> 00:34:59.894
I mean my be, if I had unlimited resources at the time, uh, public key crypto obviously would've been the choice, not the symmetric key system.
00:35:00.195 --> 00:35:07.724
Cuz when you have symmetric crypto only on a consumer device that's in the millions, you end up with a key management problem.
00:35:07.724 --> 00:35:17.355
And so that was a whole separate part of the design, which was like, how do you do key trees for both in a factory being able easily create the right key for the right device.
00:35:17.684 --> 00:35:19.125
Uh, so they each had a unique key.
00:35:19.215 --> 00:35:22.304
And then do the production step of, of personalizing each one with this key.
00:35:22.815 --> 00:35:30.704
And then also revocation if you need to be able to say, you know, this terminal's been compromised, we've caught it, sending spoofed credit card numbers or whatever out of it.
00:35:31.034 --> 00:35:33.375
Don't accept messages from this thing ever again.
00:35:34.364 --> 00:35:37.605
And so that, that kind of stuff happens on the, the production side and the server side.
00:35:37.610 --> 00:35:38.925
And it's definitely important to think about that.
00:35:39.914 --> 00:35:46.454
Was there anything on these small devices that had to remember, deny listed connections or keys or anything like that?
00:35:46.454 --> 00:35:46.664
Okay.
00:35:46.664 --> 00:35:46.905
Good.
00:35:47.099 --> 00:35:47.449
No,
00:35:47.460 --> 00:36:00.300
No, not, not necessarily, but it, it's kind of funny when you think about what are the attacks, if you've got these, you know, cheap payment terminals all over the place and people can, can swipe a card through it, like what's actually gonna be happening when it's in the, the real world.
00:36:00.510 --> 00:36:07.530
So people could take them apart, extract it the AES key from their device and create a full clone of it and lie about it.
00:36:07.530 --> 00:36:12.360
Inject all kinds of credit card numbers off of dumps they found on the internet into this thing and try to get money out of it.
00:36:12.780 --> 00:36:16.679
But that's not, not likely to happen because it's very easy to revoke that number.
00:36:16.949 --> 00:36:21.599
And also you see like 10,000 credit cards come through one terminal in a day or something like that.
00:36:21.599 --> 00:36:23.219
You know, probably something weird's going on.
00:36:23.909 --> 00:36:29.340
There's a lot of stuff you can do on the physical side as well, because when people swipe things, it's human driven.
00:36:29.670 --> 00:36:34.199
And so there are natural variations in the timing, for example, of like nobody swipes like a robot,
00:36:34.394 --> 00:36:34.885
Yeah.
00:36:36.105 --> 00:36:38.505
If you do it right, you get a one kilohertz tone through it.
00:36:38.534 --> 00:36:43.844
Uh, as far as the rate, you, you wanna have a solid one kilohertz, uh, swipe rate, uh, which is an audio band.
00:36:43.844 --> 00:36:45.284
But, but most people don't do that.
00:36:45.284 --> 00:36:51.375
So you'll, you'll get like wow and flutter from old tape systems when people slow down and speed up as they swipe or whatever.
00:36:51.644 --> 00:36:56.385
And so from that kind of thing, you can actually know a bit more about whether something's legit or not.
00:36:56.775 --> 00:36:59.655
But yeah, that's the, the kinds of attacks that were kind of interesting to think about.
00:36:59.655 --> 00:37:05.894
Were, are people gonna use this to launder credit cards that they've compromised through other systems through this to try to extract money from it?
00:37:06.344 --> 00:37:15.224
Are they gonna try to like, use it to like double spend stuff like, uh, benefit cards or some kind of like, uh, coupon codes or whatever, like gonna be things like that.
00:37:15.465 --> 00:37:30.585
Are people gonna like, try to use to repurpose this, buy a bunch of these, like the QCAT scanner and then reuse it to launch their own business of some kind by, by, by cloning it and saying, We've got these things for cheaps or free, you know, like, so let's just pick up a thousand of them and then start our own competitor.
00:37:32.750 --> 00:37:35.489
Nate and I have friends who've done things like that, which is why Nate's concerned about it.
00:37:35.489 --> 00:37:35.730
So,
00:37:36.679 --> 00:37:37.210
I see.
00:37:38.355 --> 00:37:42.494
We have a friend that like with this first million dollars he made or something like that is amazing.
00:37:42.494 --> 00:37:47.235
But his first million dollars, I think he purchased 800 mirrors for his house just because he could.
00:37:47.625 --> 00:37:49.994
And uh, So he just had mirrors everywhere?
00:37:51.224 --> 00:37:52.425
Just to look at themselves.
00:37:52.965 --> 00:37:53.684
Nah, I don't know.
00:37:53.684 --> 00:37:56.744
I think he's just like, Oh, I could buy like thousands of these so I'm gonna do it
00:37:59.025 --> 00:37:59.414
right.
00:37:59.474 --> 00:38:03.405
of us stop right before that, so I'm gonna do it part, but this person like just goes and does it.
00:38:03.855 --> 00:38:08.414
that reminds me I need to get a mirror for my wall Um,
00:38:08.489 --> 00:38:20.130
The founder of Justin TV bought like three or four massive like sculptures of dragons or dinosaurs or something that he just left in his garage and was like, Well, I guess we could do this.
00:38:20.925 --> 00:38:25.514
This is before there was Alibaba and like the joke got old because there's really nothing you can save.
00:38:25.514 --> 00:38:30.704
You can't just go type a query and buy a million of right now like goats or, Yeah.
00:38:32.505 --> 00:38:34.094
So you get the payment card thing.
00:38:34.155 --> 00:38:36.315
You're uh, you're doing consulting stuff.
00:38:36.735 --> 00:38:40.425
You didn't stay at, uh, just consulting for that long.
00:38:40.425 --> 00:38:40.635
Right.
00:38:40.635 --> 00:38:42.855
Like I remember talking to you during this time, right?
00:38:42.855 --> 00:38:44.775
Like you have a startup after this.
00:38:45.360 --> 00:38:45.719
Yeah.
00:38:45.840 --> 00:39:03.150
Uh, something that CRI did really well, which I was impressed with and I always wanted to do myself, was also, uh, was to use consulting as a way to sort of pay the bills and do solve fun problems for people, but also like to get ideas about a startup or, or, um, things that it could design.
00:39:03.329 --> 00:39:04.980
This is the kiss of death here, by the way.
00:39:05.010 --> 00:39:06.539
Like Tom and Nate.
00:39:06.539 --> 00:39:08.280
Tom and Nate's startup advice.
00:39:09.150 --> 00:39:09.300
It.
00:39:09.630 --> 00:39:20.250
It's not good general advice for startups to start with consulting, but it has worked for some people I know and myself, and it's not that you're getting ideas from your customers and then you're building a competing product or something like that.
00:39:20.340 --> 00:39:21.090
It's not like that.
00:39:21.360 --> 00:39:23.400
Instead, it's you, you look for unmet needs.
00:39:23.405 --> 00:39:23.650
It.
00:39:24.179 --> 00:39:28.889
I would sell this to all of my customers if I had a product that could do X.
00:39:29.010 --> 00:39:30.239
And nobody creates this yet.
00:39:30.420 --> 00:39:45.090
And it's really fun because, you know, YC uh, went through Y Combinator later on and they tell you to like, you know, talk to customers, talk to customers like repeatedly, and talking to customers is great if you have a reason to talk to customers or are good at it or have an in or whatever.
00:39:45.389 --> 00:39:53.400
But consulting is a great way that you're forced to talk to customers and forced to pay attention to their needs and problems because they're asking you to solve some problem that they think they have.
00:39:53.639 --> 00:39:59.130
And it may not be the actual problem that they really do have, but that's sort of where the insight comes from, is being able to be exposed to it.
00:39:59.489 --> 00:40:07.320
Whereas if you just showed up off the street and said, I'm a startup person, I've got an idea how to solve your problem, and that they're not gonna always tell you, Oh no, our problem is actually this other thing.
00:40:08.099 --> 00:40:17.369
So yeah, in 2011 I had been doing a lot of reverse engineering, so the work on embedded systems had kind of led into more reverse engineering on the software side.
00:40:17.925 --> 00:40:22.425
And I was doing actually kind of bulk reverse engineering, I call it.
00:40:22.695 --> 00:40:40.934
Like I'd scripted a bunch of stuff and I was helping a company with, I was looking for like say GPL license infringement and other kinds of, of license infringement where it's like, we've got this thing and it's GPL, but people are putting it in their devices and then selling it and they're not paying us royalties and we have a dual license, you know, for it.
00:40:41.025 --> 00:40:45.284
So we wanna go after them for gpl, for taking the open source version of it and just not paying us.
00:40:45.315 --> 00:40:50.744
And so I did it by hand a bit, you know, Ida Pro and, and scripts and things like that, but got really boring really quickly.
00:40:50.954 --> 00:41:03.375
So I was like, okay, if I could dump the firmware from any device and then dump them into some kind of system that could tell me all the code that was inside this thing, you know, we're talking relatively large stuff.
00:41:03.380 --> 00:41:05.264
Libraries, not like single functions.
00:41:05.594 --> 00:41:12.014
If I could tell me all the libraries that are, that were used to build this thing with some confidence level, then I could make this self-service.
00:41:12.019 --> 00:41:22.875
And then the customer is then just like, Uploading a bunch of software into this web service or whatever, and it's telling them, you know, Hey, I found these four libraries in it with 90% confidence or whatever.
00:41:23.324 --> 00:41:28.545
Then you could tie this into their royalty system of like mailing letters to the company.
00:41:28.545 --> 00:41:35.715
It's like, type in the address of the company where you got this thing and, and we'll send them a letter that says, you know, hey you GPL infringed our thing, you know, here's the code.
00:41:36.164 --> 00:41:42.045
Maybe even send him a nice little comparison of the, the flow graphs of the two programs or whatever to say, Hey, here's how the evidence or whatever.
00:41:42.525 --> 00:41:43.394
You know, pay up or whatever.
00:41:43.425 --> 00:41:44.775
So I thought that was kind of cool.
00:41:44.835 --> 00:41:47.684
Always been a fan of, of Halvar, really smart person.
00:41:47.684 --> 00:41:50.505
And, and um, you know, the bindiff work was pretty amazing.
00:41:50.925 --> 00:41:55.425
So I was like, well, bindiff is great at finding like patches that are missing in things.
00:41:55.635 --> 00:42:02.835
But most of the tools that you see for reverse engineering are human centric and they focus on finding a needle in a haystack.
00:42:03.105 --> 00:42:06.405
It's like, you wanna find this one comparison instruction.
00:42:06.409 --> 00:42:08.385
Is it assigned or an unsigned comparison?
00:42:08.385 --> 00:42:09.974
Because otherwise there's a vulnerability here.
00:42:10.289 --> 00:42:12.389
And that's one important problem to solve.
00:42:12.420 --> 00:42:17.309
But there's also a different problem to solve, which is like, I've got a million pieces of software.
00:42:17.369 --> 00:42:27.239
A person can never look at them, Can you with some threshold of confidence, tell me high level things about this software such as does it contain this library or not?
00:42:27.300 --> 00:42:30.900
To some level confidence regardless of what obfuscation, someone's applied to it.
00:42:31.230 --> 00:42:38.579
Um, like obfuscation tools, again, not individual recoding something by hand or something like that to say that does this basically look the same thing?
00:42:38.699 --> 00:42:53.849
So I started trying to build that system and uh, originally it was focused on this problem of like, go after customers that are licensers technology firms that are licensing stuff and help them make more money basically off of their portfolio.
00:42:54.405 --> 00:42:55.574
From companies that aren't paying them.
00:42:55.815 --> 00:42:56.894
So I got that going.
00:42:57.105 --> 00:43:01.875
And it turns out though, that there aren't very many firms that actually want to pay for that kind of service.
00:43:02.085 --> 00:43:10.005
There's a bunch of companies that do like open source license management stuff like black duck software and things like that, but it's all source code based, not binaries.
00:43:10.005 --> 00:43:21.135
This is all based on binaries and there's some some money to be made there, but although it's a relatively small market, but there was not really a huge market of people that were like, Yeah, just, we're just wanna feed binaries into this thing and tell me who, who to send lenders to.
00:43:21.644 --> 00:43:28.844
So there was a while there where things were not going well revenue wise, and I was trying to pivot and I was like, Okay, what do we do next?
00:43:29.054 --> 00:43:30.425
We've got this capability.
00:43:31.065 --> 00:43:38.864
Actually even had come up with some cool ways to do like at scale binary analysis and uh, similarity analysis as well.
00:43:39.344 --> 00:43:43.125
And I was like, Okay, what other problems can we solve that might, might actually be successful?
00:43:43.514 --> 00:43:46.664
And um, at the time the app stores were kind of taking off.
00:43:47.550 --> 00:43:49.739
This is like early 2010s.
00:43:49.800 --> 00:43:54.030
So it was like by 2012, 2013 timeframe, I was pivoting.
00:43:54.570 --> 00:43:56.489
And it was like, okay, app stores are taking off.
00:43:56.550 --> 00:43:58.019
There's millions of apps now.
00:43:58.710 --> 00:44:03.179
And if there's millions of apps, what things can we tell people about all these apps?
00:44:03.179 --> 00:44:08.039
Because it's a black box, especially on, on, on iOS, where you don't even get to inspect the binaries in most cases.
00:44:08.159 --> 00:44:10.260
And so we built a system that would crawl app stores.
00:44:10.260 --> 00:44:23.519
We were crawling the iTunes app store, Google Play, a bunch of Chinese Android stores and just, um, by this time we, we, what we had was we had intermediate language, we'd, um, air quotes, decompile, uh, it wasn't full de compilation.
00:44:23.519 --> 00:44:27.000
It was more of a, a rough translation into this higher level ir.
00:44:27.000 --> 00:44:28.889
Cool kids would call lifting, right?
00:44:29.010 --> 00:44:29.130
Yeah.
00:44:29.340 --> 00:44:30.900
Yes, yes, exactly.
00:44:31.320 --> 00:44:32.489
And it didn't need to be precise.
00:44:32.489 --> 00:44:38.760
Again, it wasn't like the point of it was not to be precise and do lots of crunching on it with lots of CPU cycles to tell exactly what it's doing.
00:44:38.764 --> 00:44:43.800
It was just like, do you roughly have these kinds of data flows or these control flow combinations of things?
00:44:44.565 --> 00:44:48.164
at a high level and then identifying libraries and things.
00:44:48.164 --> 00:44:52.844
So it's like, okay, we, we'll just tell like every SDK or or library that's compiled into these apps.
00:44:52.844 --> 00:44:57.344
Cuz in iOS who was static linking for Android, a lot of times it's dynamic linking, which was like trivial.
00:44:57.375 --> 00:45:00.795
But then it was kind of like, okay, how do apps compare across platforms?
00:45:00.795 --> 00:45:05.594
Like how do Android apps by the same vendor compared to the iOS apps and what insights can we gain?
00:45:05.985 --> 00:45:17.264
And it started taking off, actually we started getting big name customers like Google and Facebook, and they were really interested in our data because we would have like high numbers of apps going through these things.
00:45:17.264 --> 00:45:22.485
You know, thousands and thousands of apps we were analyzing and we were pulling down updates as soon as they're published.
00:45:23.219 --> 00:45:27.960
Uh, updating, sending people differential stuff like, Hey, this library just got added to this app.
00:45:28.110 --> 00:45:30.119
Someone added in a new analytics library to it.
00:45:30.300 --> 00:45:33.900
We were telling people trends and we could say like, Here are the top libraries for games.
00:45:33.929 --> 00:45:39.030
You know, people are using this Unity 3D Libraries versus, you know, Unreal Engine or whatever.
00:45:39.360 --> 00:45:41.309
And, uh, that started really taking off.
00:45:41.309 --> 00:45:41.880
It was fun.
00:45:42.059 --> 00:45:46.469
And, um, we joined Y Combinator kind of to see like, can we get some actual funding?
00:45:46.469 --> 00:45:48.719
Cuz this is all bootstrapped off the consulting revenue originally.
00:45:49.349 --> 00:45:51.929
And we were profitable, but not hugely so.
00:45:52.199 --> 00:45:55.710
And so we went to Y Combinator and worked on turning this into a bigger business.
00:45:55.715 --> 00:46:02.760
And at the same time, I, I came up with an idea that was this I really proud of as like a, like a business model, even if it's not technically that that interesting.
00:46:03.150 --> 00:46:10.590
But it was like, we're crawling all these apps, we got all this data on them, what things can we also reuse as in a different market?
00:46:10.679 --> 00:46:16.679
And so at the time, again, like developers didn't really have good views into what libraries they were even including their apps.
00:46:16.679 --> 00:46:20.775
Like sometimes a developer would be surprised when you tell'em, Oh, you've linked this and it's like, Oh really?
00:46:20.775 --> 00:46:24.945
You know, it's like, oh yeah, because we linked this in and it pulled in this other library's dependency.
00:46:24.945 --> 00:46:35.625
And so they'd have, uh, there's a crash reporting library in iOS that you'll have like three or four copies of the same crash reporting library because every analytics library also links against it and it's statically linked.
00:46:35.625 --> 00:46:40.574
And so you pulled in multiple versions of the same library and it's terrible code bloat, but
00:46:40.695 --> 00:46:50.204
For, for Rust users, right now, if you wanna avoid this, there's a tool called Cargo Deny that lets you eliminate conflicting different versions of a deep, deep dependency.
00:46:50.204 --> 00:46:50.625
So
00:46:51.704 --> 00:46:53.025
It's an amazing future.
00:46:53.355 --> 00:46:53.864
I like it.
00:46:54.224 --> 00:46:56.144
But yeah, this is like terrible.
00:46:56.175 --> 00:47:02.114
Like it was like you're getting static blobs dumped on top of static blobs, all with depending on the same underlying things, but different versions.
00:47:02.804 --> 00:47:07.155
And so this is obviously a security problem and there's a security supply chain problem there as well.
00:47:07.545 --> 00:47:10.514
So it was like, well, we can resell this data to developers.
00:47:10.605 --> 00:47:14.925
If we just go after like the most recent CVEs or whatever in mobile apps.
00:47:15.375 --> 00:47:19.574
We know what the most popular libraries are, so we can say we've got this cve.
00:47:20.144 --> 00:47:24.764
You've got this library that's in 20,000 apps, notify 20,000 developers.
00:47:24.764 --> 00:47:28.184
You all have the security problem to update your dependency of whatever it is.
00:47:28.724 --> 00:47:33.644
So it's like, oh yeah, someone would probably pay five bucks a month for this, or 10 bucks a month for this notification service.
00:47:33.855 --> 00:47:41.534
So what we did was we just, again, we ranked CVEs by number of apps that have that library to find the ones to actually build signatures for.
00:47:41.864 --> 00:47:45.135
And then we took those top CVEs and, or, you know, patches.
00:47:45.135 --> 00:47:48.585
Even if someone didn't even have cvs, it'd just be like a, a branch on GitHub or whatever.
00:47:48.585 --> 00:47:52.965
Cuz again, security handling across open source libraries isn't always the greatest.
00:47:53.170 --> 00:47:53.519
no
00:47:54.405 --> 00:47:54.585
Yeah.
00:47:55.364 --> 00:47:56.474
And so we just like, okay.
00:47:56.969 --> 00:48:02.760
Let's create a signature for this, dump it into our latest scans of the app stores, and they'll be like, Okay, there's 20,000 apps with a thing.
00:48:02.909 --> 00:48:14.010
And we've created a UI for people to just like, this is like a weekend project of like, you could go in and enter the apps that you use and it would tell you which things were vulnerable to which problems.
00:48:14.250 --> 00:48:16.679
And we dumped a couple different bin bugs into that.
00:48:16.920 --> 00:48:23.159
And then we said, you know, hey, if you, if you sign up with us, we'll give you advanced notice of these kinds of problems as we find them in the future.
00:48:23.699 --> 00:48:27.989
And so we got, I think in a week or two, we had 3000 developers actually sign up,
00:48:28.505 --> 00:48:28.994
Yeah.
00:48:29.940 --> 00:48:31.769
yeah, for monitoring their apps.
00:48:31.875 --> 00:48:32.625
Good for them.
00:48:32.699 --> 00:48:39.539
me was, yeah, I mean, going from like, you know, tens of customers to 3000 instantly was kind of cool even if they weren't paying for anything yet.
00:48:39.929 --> 00:48:42.989
And that was kind how we got to the scale and got our initial seed round.
00:48:43.170 --> 00:48:48.929
And, uh, I think, I still think there's a, a really big market there for helping developers with insights to their code.
00:48:49.260 --> 00:48:53.309
I mean, they're just like GitHub Copilot for example, and other things like that that are.
00:48:53.730 --> 00:48:58.349
They're helping people build stuff, but also just giving people insights into the things you've already done.
00:48:58.590 --> 00:49:00.179
It's like, Hey, you built this app this way.
00:49:00.719 --> 00:49:05.730
You might have these problems or someone's watching over your shoulder to make sure if there's security problems in the future, we'll let you know.
00:49:05.965 --> 00:49:07.574
That's wild because you built.
00:49:08.250 --> 00:49:27.840
You built something that's not, you know, a hundred percent every time it's not supposed to be foolproof, but you're literally looking at the binary and, you know, creating this, you're lifting it to some other representation, which is theoretically even better in a certain way than like, I have a package dot j or I have a cargo.com.
00:49:27.840 --> 00:49:30.210
All, I have all my dependencies listed.
00:49:30.570 --> 00:49:36.420
But like the end of the day, you are the, the blob that you're trying to execute is the source of truth.
00:49:36.809 --> 00:49:50.130
And like nowadays, you've got Dependabot, which is now owned by GitHub, and so like, it'll do a lot of those things that you had to build from scratch, but it is depending on an encoding of all of your dependencies all the way down.
00:49:50.400 --> 00:49:52.409
Um, if you don't have that, you're out of luck.
00:49:52.409 --> 00:49:56.010
Like if you're just writing C and you just stick it on GitHub, it's just sort.
00:49:56.849 --> 00:49:57.750
you, you don't get no.
00:49:57.750 --> 00:50:05.590
Depend upon how, like we would need a source dna because like, there's no way to just like go look up those dependency versions and associate them with the CVE.
00:50:05.590 --> 00:50:18.239
And I don't think they do any, They rely on like the Rust security advisory project or whatever, which like humans filing like security alerts against versions of crates and things like that.
00:50:18.539 --> 00:50:20.670
Um, whereas you were doing it all by hand.
00:50:20.670 --> 00:50:21.989
You weren't even doing cvs.
00:50:21.989 --> 00:50:27.030
You were just like, this is a bad branch of this library that someone has compiled into their project.
00:50:27.210 --> 00:50:28.530
You might wanna fix that.
00:50:29.010 --> 00:50:29.760
That's a lot of work.
00:50:30.429 --> 00:50:30.960
it was.
00:50:31.199 --> 00:50:39.480
There's also like the, like the advantage of looking at the binary, you can also tell if code's actually being used, um, like 99% of depend about alerts are useless.
00:50:39.480 --> 00:50:39.750
Right.
00:50:39.755 --> 00:50:44.250
They're like, you know, JavaScript prototype injection problems and JavaScript that you don't even use.
00:50:44.255 --> 00:50:44.670
Right?
00:50:44.675 --> 00:50:47.610
But if you're looking at the binary, yeah, you can see if it's dead code or.
00:50:48.599 --> 00:50:48.929
Yeah.
00:50:48.929 --> 00:50:49.409
Yeah.
00:50:49.949 --> 00:50:56.099
That was one of our competitive advantages actually, when we were doing the analytics data, was this, a lot of this is by hand.
00:50:56.099 --> 00:51:06.659
There's a lot of grunt work that you do by hand to get things off the ground, but by hand, we identified what were the important public APIs of all these libraries because library isn't just like one function that does one thing.
00:51:06.659 --> 00:51:08.070
It's usually like a collection of things.
00:51:08.625 --> 00:51:16.545
From larger companies like Google and Amazon, they offer entire SDKs with like maps and game analytics and whatever, all the stuff thrown in there.
00:51:16.934 --> 00:51:20.505
And it's like, okay, which parts of the Maps SDK is this app using?
00:51:20.505 --> 00:51:24.764
Is it using the fine grain location tracking or is it using like geofencing?
00:51:25.215 --> 00:51:42.344
And so we would categorize and hand label some of these different APIs and we knew which APIs were important because again, we could sum them up across all the apps in our collection and say, Okay, what are the top five functions that are called from outside of the library, but from the apps itself, uh, across a huge collection of apps.
00:51:42.375 --> 00:51:49.005
And then we'd say, Okay, let's hand label those top five functions as you know, geofencing or whatever the functionality was of that one by looking in the docs.
00:51:49.454 --> 00:51:53.655
And then we could tell the marketers or people that were subscribing to this data feed.
00:51:54.764 --> 00:52:04.994
Which parts of Google APIs are taking off this month, and which parts are being let used less and being replaced with competitors' information or competitors' APIs.
00:52:05.000 --> 00:52:06.945
I mean, so that, that was really interesting.
00:52:06.949 --> 00:52:17.054
And actually that's something that I, I've always loved as a business model, which is take a whizbang technology and give it to the least technical people in a way that they can use it.
00:52:17.235 --> 00:52:25.065
So in this case, it's like, give marketers Ida Pro at scale, And it's like marketers are people that buy marketing data.
00:52:25.065 --> 00:52:29.715
Like they, they're never gonna be able to learn IDA Pro and be able to decompile an app and figure out what it's doing.
00:52:30.195 --> 00:52:31.574
Um, and certainly not at scale.
00:52:31.994 --> 00:52:39.074
And so, but if they had that data, they can make really interesting decisions about how they, they change their competitive strategies or their marketing strategies.
00:52:39.230 --> 00:52:39.719
Yeah.
00:52:40.454 --> 00:52:50.324
Yeah, so around the time I think that, that you had had exited, um, was when we were starting to try and figure out how to spin Censys out into a startup.
00:52:50.534 --> 00:52:52.094
And I remember I passed through Illinois.
00:52:52.724 --> 00:53:01.065
Um, and so I, I talked to Thomas and I was like, Well, we got like these network insights, but they're like, good at some stuff and not other stuff.
00:53:01.070 --> 00:53:09.675
And no one really wants to pay for like TLS vulnerabilities, but it seems like, knowing what's on your network and like what server software would be good.
00:53:09.914 --> 00:53:16.454
And oh, by the way, has anyone ever thought of like bulk reversing a bunch of things in the app store and saying what libraries they use?
00:53:16.784 --> 00:53:21.224
And Thomas is like, Well, the good news is you hit the nail on the head on that one.
00:53:21.375 --> 00:53:24.824
The bad news is you should have met Nate a few years earlier.
00:53:25.175 --> 00:53:28.304
Um, and I am kicking myself for not joining his company
00:53:30.150 --> 00:53:31.739
was that you David, or was that Thomas?
00:53:32.474 --> 00:53:42.195
that that was Thomas for his said he was kicking himself for, for not joining Source DNA um, and my claim to fame is I came up with the idea for Source DNA independently five years late.
00:53:42.480 --> 00:53:42.809
There you
00:53:43.065 --> 00:53:43.905
No, that's great.
00:53:44.775 --> 00:53:47.835
Yeah, and it's, it's all, it's all different iterations of the same thing.
00:53:47.894 --> 00:53:58.784
I mean, we had some defic deficiencies in terms of, there was one app where they had backport a fix, like just a point fix for a specific problem without backporting the entire point version of the library.
00:53:59.025 --> 00:54:03.735
And so we identified it, misidentified it as, or correctly identify, I guess, as the old library.
00:54:04.079 --> 00:54:06.269
Because we didn't look for this one branch that had changed.
00:54:06.269 --> 00:54:12.389
And so it's like, yes, if you're trying to prove that this one app is vulnerable or not, we're not the tool for that.
00:54:12.420 --> 00:54:13.679
Like we don't solve that very well.
00:54:14.099 --> 00:54:16.920
But yeah, there's, so there's ups and and downs to each of these approaches.
00:54:16.925 --> 00:54:36.960
But you know, when people go and try to attack this same problem different ways, you, you, you can take different angles at, And the one, the one I thought was kind of the unique insight for us was that if you're doing things at scale with lots of different data, your approach to it is very different from the traditional reverse engineering route where you're with like, with microscope and tweezers, with a single binary, like the traditional reverse engineering.
00:54:37.380 --> 00:54:49.260
But like counting the number of function calls from a labeled API cuz it's, you know, you got a symbol for it or whatever like that from every bit of code, which.
00:54:49.815 --> 00:55:00.644
Most unique possible in, in that app, you can kind of find the boundaries between APIs and libraries because in the library things will have kinda the same type signatures, the same, same set of code.
00:55:00.644 --> 00:55:10.244
You identified that and it's like, okay, if I've got a caller who only appears in 10 apps, that could be a wrapper library that this developer uses around this thing.
00:55:10.485 --> 00:55:15.764
If it's from a million apps, it's a public API because nobody owns them at all million apps on the app store.
00:55:15.824 --> 00:55:21.614
So you can kind of do these things in aggregate or statistically that otherwise would require really sophisticated
00:55:22.054 --> 00:55:27.434
First of all, I like how when Dave retails anything I've done, I'm a 1950s movie producer.
00:55:27.764 --> 00:55:29.735
Hey kid, the good news.
00:55:31.054 --> 00:55:32.070
Chomping out my cigar.
00:55:32.250 --> 00:55:33.539
This is like a thing with me though.
00:55:33.539 --> 00:55:37.619
Like the reversing thing here is, um, I don't know, I spend too much time on message boards, right?
00:55:37.619 --> 00:55:44.190
But there's like a, there's a common perception among technical people of what serious, serious reverse engineering looks like.
00:55:44.489 --> 00:55:51.659
And that perception is Nate pretending to take a vacation while reading assembly with a, you know, pen and paper, right?
00:55:51.900 --> 00:55:56.639
But like in reality, like everyone's using tools, everyone's looking at higher level abstractions.
00:55:56.639 --> 00:56:01.260
Like you're not, like, you don't start at the first line and then read a straight line all the way through the code, right?
00:56:01.260 --> 00:56:10.320
Like I, I remember like, like finally getting this through my head, like in the mid aughts with, uh, I think it was Pedram Amini, the pme or whoever did Pai Mei.
00:56:10.440 --> 00:56:11.809
Apologies to whoever did Pai Mei.
00:56:11.809 --> 00:56:19.619
But that was like, um, it was like setting debugger trace points on every, you know, at the beginning of every basic block in a program, which is trivial.
00:56:19.619 --> 00:56:20.639
It's just a loop around.
00:56:20.844 --> 00:56:22.945
Sounds complicated, but it's not complicated at all, right?
00:56:22.945 --> 00:56:34.375
Like, so you take the assembly, you, uh, you mark every basic block, and then you run to get a baseline trace of which base of which break points get hit, and then you like rerun it and then do something different with the application.
00:56:34.375 --> 00:56:38.905
Like send a message or push a button or whatever, and then you just see which different things get lit up, right?
00:56:38.909 --> 00:56:48.594
Like, and, and right away you've gone from the entire, you know, disassembly of the program to like a tiny set of functions that you have to go read, and you can really quickly get a sense of the structure.
00:56:48.715 --> 00:56:49.974
And that's a simple idea, right?
00:56:49.974 --> 00:57:04.824
But like, if you're looking, you know, across every application on the app store, there's like a million other things you could probably come up with to get, like structural stuff from, and that that's before you get into the fact that you're, like, you, you're not looking at raw assembly, usually you're looking at the lifted assembly, which is, you know, much higher level than the raw assembly and stuff.
00:57:04.824 --> 00:57:07.135
But I just, I feel like people have this general idea.
00:57:07.875 --> 00:57:11.414
What binaries are doing is unknowable, that you really need source code.
00:57:11.414 --> 00:57:16.065
That source code is critical for security and like it's, it's better to have source code than not have source code.
00:57:16.070 --> 00:57:18.255
Like, I'm not, I'm not making that crazy claim, right?
00:57:18.405 --> 00:57:24.405
But there are ways in which binary analysis is superior in source code, and it's certainly not as opaque as people think it is.
00:57:25.469 --> 00:57:26.010
Absolutely.
00:57:26.010 --> 00:57:26.159
Yeah.
00:57:26.159 --> 00:57:36.000
On the hit tracing, one of the cool things about it that a lot of people didn't realize who were thinking about it in the abstract is that once you've had the initial trace, you remove those break points.
00:57:36.000 --> 00:57:39.510
And now that the binder runs a lot faster, and a lot of people thought, Oh, it's too slow.
00:57:39.510 --> 00:57:42.179
You won't be able to set break points on every, every basic block.
00:57:42.630 --> 00:57:46.769
Um, but once you've removed those, all you care about is if any remaining break points get hit.
00:57:46.949 --> 00:57:51.570
That also goes to a reverse engineering process I like to apply, which is probabilistic.
00:57:51.630 --> 00:57:57.150
So you just set random break points in the binary and count how many times they get hit.
00:57:57.150 --> 00:57:59.940
It's kinda like how profiling works when you're using like G Prof or whatever.
00:57:59.945 --> 00:58:02.519
It's like you just, just randomly sample the call stack.
00:58:02.925 --> 00:58:09.135
And soon you get an idea of how the program's working, where it's spending most of its time when you're doing certain things where, where it does those things.
00:58:09.135 --> 00:58:14.114
You know, I'm working, interacting with UI it's in this area of the code and sending network traffic, it's in this area of the code.
00:58:14.114 --> 00:58:18.914
And so a, a lot of this stuff can be done in a kind of sloppy manner at first.
00:58:19.155 --> 00:58:23.534
And then once you know the high level of where you're looking for things, you can zoom in on the parts you care about.
00:58:25.094 --> 00:58:26.594
So what did we learn from all of this
00:58:28.905 --> 00:58:36.014
Well, I mean, uh, as far as cryptography goes, we were talking before about cryptography being brittle versus robust and how you, how you design it.
00:58:36.255 --> 00:58:45.375
And I always like to think of the different design principles that you apply to the whole system to avoid having exploits or, or avoid having additional complexity that you have to deal.
00:58:46.155 --> 00:58:50.445
And for example, consider just like a simple web cookie, HTTP cookie.
00:58:50.954 --> 00:58:56.295
You could have one where it's encrypted and authenticated and you send data to the client.
00:58:56.300 --> 00:58:59.505
The client sends it back to you, you verify it before you trust the data, things like that.
00:58:59.625 --> 00:59:04.244
Or you could have a PRNG that spits out opaque IDs and you just send opaque IDs.
00:59:04.244 --> 00:59:08.204
So the client, you store everything on the server side and a database or wherever, and you look it up by opaque id.
00:59:08.385 --> 00:59:14.414
And the latter doesn't sound very good, like it has additional server resources, you know, all these things like that.
00:59:14.804 --> 00:59:27.525
But depending on the system and how many users you have or, or the, the characteristics of it, it may be worthwhile for the security tradeoff because given an opaque id, the attacks against that are maybe a small number of attacks against that.
00:59:27.530 --> 00:59:29.835
If your PRNG's weak or your entropy's bad or whatever.
00:59:30.405 --> 00:59:36.675
But you know, if you have an encrypted and authenticated cookie, there's many, many, many, many, many more ways that can fail.
00:59:36.679 --> 00:59:39.735
You can wrap counters and Thomas's favorite attack.
00:59:39.885 --> 00:59:44.505
You know, you can have your side channel attacks against the key used to decrypt the cookie.
00:59:44.894 --> 00:59:49.755
By, by doing time, time attacks or whatever, there are attacks against like padding oracle attacks.
00:59:49.784 --> 00:59:57.824
You know, like all these different things suddenly are in within scope and now you have to know a lot more about crypto and rule out a lot more things in your design implementation.
00:59:58.244 --> 01:00:13.844
So what, what I've always advised my clients and people I've worked with is if you can avoid crypto altogether or maybe just PRNG or something, you know, that's way better than designing a system that has crypto and then having to verify it to the nth degree to be sure you haven't created new flaws.
01:00:14.894 --> 01:00:26.414
Or even worse, uh, building a system that is really just doing something like the database lookup except then putting it inside of a JWT anyway, where you're like using cryptography but not actually even getting any value out of it.
01:00:26.505 --> 01:00:34.994
That's something I caught in a code review once where I was like, We have a JWT here, but actually you're just using it as a lookup ID, like delete all the crypto.
01:00:35.655 --> 01:00:40.514
That's why I think all cryptographers, or at least cryptographic engineers should do consulting for a while.
01:00:40.695 --> 01:00:48.045
Because when you learn this stuff just from the, the books or looking at implementation to things that are good, you think, you know, okay, this is kind how to do it right.
01:00:48.045 --> 01:01:02.324
And you kind of get a sense for it, but you don't realize how bad it can be when people do it wrong and And so Cryptopals is great for showing people attacks, but what's worse is like Cryptopals is like showing one type of attack against one design.
01:01:02.324 --> 01:01:04.724
Like each system only has, I think, one flaw in it.
01:01:04.844 --> 01:01:05.835
Each chapter or whatever.
01:01:06.045 --> 01:01:14.775
It's not like you hit a system and it's like, it's got this flaw and this flaw and these two flaws that combine with each other to make it way more exploitable than you'd be if you only had these flaws.
01:01:15.135 --> 01:01:20.324
And every time, uh, I would talk to people, people like Thomas, um, saying what he had found in some.
01:01:21.135 --> 01:01:24.585
I would just be flabbergasted because I'd just be like, Why would someone even do that?
01:01:24.585 --> 01:01:33.315
Like if you asked me to come up with the worst way to use this particular protocol or whatever, I couldn't even imagine my best imagination how to do it that poorly.
01:01:33.315 --> 01:01:35.534
So it's, it's, it's just astounding.
01:01:35.534 --> 01:01:45.474
So, yeah, so any kind of practical experience with actually reviewing fielded systems and the things people are cooking up is much better at understanding the underlying primitives.
01:01:45.679 --> 01:01:46.099
Hmm.
01:01:46.369 --> 01:01:50.099
I would push back in this sort of new world where.
01:01:50.429 --> 01:02:10.860
Trying to design things with security, of course, but privacy by default really starts pushing you into a different world where like control over your data and like consent to what you do with your data, uh, where you are just a human user probably necessitates cryptography in one way or another.
01:02:11.070 --> 01:02:20.010
We have a lot much nicer libraries to use and like kind of years of lot less fragile constructions to use.
01:02:20.014 --> 01:02:29.849
And like a lot of people can, if you're doing messaging, you can slap signal on it or now MLS and like there's a lot of things that have been kind of tried and tested in various systems.
01:02:29.849 --> 01:02:40.199
You can slap a this on it and maybe we'll get to a world where fully homomorphic encryption makes end to end encrypted queries like scalable, private, and performant.
01:02:41.219 --> 01:02:49.260
But how do you feel about that sort of world where you're like, you've seen how a lot of things can go wrong, but like if we're trying to move into a sort of a world.
01:02:50.340 --> 01:03:01.769
It's not just the big Google or the big software as a service provider who just has access to everything that you ever do on their software service, because that's just the way you build things.
01:03:01.769 --> 01:03:03.239
We're trying to move away from that.
01:03:03.539 --> 01:03:07.409
Um, well, I would, would like to see the world move away from that.
01:03:07.789 --> 01:03:16.730
Does that make you scared or does that sort of think, do you think we're kind of in a better place that lets us able to do that in a better way than probably we used to be able to do that?
01:03:17.409 --> 01:03:19.690
I mean, I agree with you that I think that's a good thing.
01:03:19.900 --> 01:03:38.829
For example, just even providing users data export, and then also making sure that the data export conforms to, first of all, all the data that the provider has on you, but also kind of the way they interpret that data gives you a better sense of what they're doing with it and, and you don't necessarily know everything they're doing with it.
01:03:38.829 --> 01:03:40.269
It could be leaking it somewhere else or whatever.
01:03:40.269 --> 01:03:49.414
But if someone has a record that they send me back in a data export that says User ID and it's my Social Security Number, then that's, that's a really bad sign, right?
01:03:49.414 --> 01:03:55.054
Like that, that like, uh, they're probably sending this number all over the place and logging it all over the place and that's not good.
01:03:55.085 --> 01:04:05.014
So, but any kind of visibility and transparency you can give users for how the service is thinking about the data or the designer of the service thought about the data is definitely good.
01:04:05.014 --> 01:04:08.315
So it can help reveal these kinds of mistakes in, at least in the format.
01:04:08.554 --> 01:04:21.094
But I think cryptography is important, and I'm not saying don't use it, um, but just be prepared to invest the resources to do it right when you do need to use it and don't just use it because it seems cool or block chainy or whatever.
01:04:22.235 --> 01:04:29.375
It's, uh, you know, JavaScript crypto is kind of one of those things where in the browser where it kind of comes back to like people like, but it wouldn't be cool if?
01:04:29.465 --> 01:04:31.505
It's like, yeah, but you don't have the root of trust there, you know?
01:04:31.505 --> 01:04:32.135
So, and there's many
01:04:32.269 --> 01:04:33.905
really cool, but
01:04:33.920 --> 01:04:34.909
Yeah, yeah.
01:04:35.179 --> 01:04:39.440
But let's live in the real world where this actually, the browser actually operates a particular way.
01:04:39.440 --> 01:04:43.969
And, you know, scripts are composed on the page as a particular way and the same origin and all this.
01:04:43.969 --> 01:05:09.230
And let's think more about the users and, and what they're entrusting you in that system and not how cool it would be if, but yeah, I, I think it's great that with these new things coming on online with being able to have, uh, circles of trust threshold, cryptography being used more for, you know, services, being able to say things like, If two of my friends want to recover my data after 20 days, I'll let'em, or something like that.
01:05:09.235 --> 01:05:12.050
Like those kinds of things that just didn't exist before.
01:05:12.170 --> 01:05:14.780
Are there in, in terms of security in general.
01:05:15.110 --> 01:05:19.130
Uh, for example, on iOS, knowing that when you uninstall an app, it's actually gone.
01:05:19.369 --> 01:05:23.000
Like, this thing can no longer run, it can't leave any hooks in the system, whatever.
01:05:23.005 --> 01:05:28.099
That's that kind of capability for even just end users is, is, is amazing to have.
01:05:28.130 --> 01:05:30.199
And I wish more systems had that kind of thing.
01:05:30.199 --> 01:05:30.650
Like when I.
01:05:31.264 --> 01:05:39.335
When I say delete my account on a particular web service, did it just mark a field in a record in a database somewhere that's gonna be backed up for 10 more years?
01:05:39.335 --> 01:05:41.554
Or is it actually, did it wipe things?
01:05:41.554 --> 01:05:54.425
And if it did it wipe it seven times with a DOD method or you know, did, is it on a flash drive somewhere where it just, again, in, in, uh, the file system just marks something unused and maybe it'll eventually get recycled?
01:05:54.605 --> 01:06:04.625
Or maybe they encrypted it to hell and they threw away the key and they, they, they actually overwrote the key and it is like theoretically impossible to recover that data, so,
01:06:04.655 --> 01:06:11.045
It's very hard to overwrite a key on flash, generic flash storage, uh, in terms of load balancing and stuff like that with, with, uh, right.
01:06:11.045 --> 01:06:12.635
Balancing across the different pages.
01:06:12.994 --> 01:06:22.744
So you actually have to design carefully how the underlying hardware storing things to be sure that it's a, and you can actually, when you wipe something, it truly has been wiped.
01:06:23.195 --> 01:06:28.954
So again, that goes back to the dependencies when, when someone just says, Oh yeah, we'll encrypt it and throw away the key.
01:06:29.614 --> 01:06:32.704
Like, at what level of assurance are we saying we've thrown away the key?
01:06:32.824 --> 01:06:36.545
At what point do we know it actually has is gone, and to what level is it gone?
01:06:37.054 --> 01:06:39.454
And I think a lot of people don't think about that.
01:06:39.500 --> 01:06:47.059
This is what I think of when people say like, we're gonna do a completely open Linux phone instead of an iPhone or a flagship Android phone for security.
01:06:47.539 --> 01:06:50.000
Um, cuz it'll be Linux and completely transparent.
01:06:50.000 --> 01:06:53.449
And I'm like, did you do the work to make sure that you could actually erase keys?
01:06:53.449 --> 01:06:54.469
Cuz probably not.
01:06:54.679 --> 01:06:58.670
It's like you're, you're just creating BlackHat talks for two years in the future if you're successful.
01:06:58.789 --> 01:06:59.139
So,
01:06:59.695 --> 01:07:02.675
And, and, and this comes in with like Spectre for example.
01:07:02.704 --> 01:07:08.585
Um, with Spectre attacks, people are like, Oh yeah, is zeroise the key in RAM and, and then it was like, okay, oops.
01:07:08.585 --> 01:07:12.934
My memset was getting optimized out by the compiler because it was dead code at the end of the function.
01:07:13.295 --> 01:07:13.625
Okay.
01:07:13.625 --> 01:07:14.914
So I've kept memset in memory.
01:07:14.945 --> 01:07:15.304
Oh, great.
01:07:15.304 --> 01:07:16.534
Now I am zeroing from RAM.
01:07:16.565 --> 01:07:18.014
Oh, did I zero it from the cache?
01:07:18.034 --> 01:07:19.715
Well, I can't talk to the cache directly.
01:07:20.059 --> 01:07:20.389
Okay.
01:07:20.389 --> 01:07:24.980
Did I get rid of all the data dependent branches based on this, that when I zeroized it.
01:07:25.309 --> 01:07:35.269
Uh, did I clear registers even like, you know, I, I loaded a key, It did my memcmp that was comparing the secret to something, this timing, safe memcmp, let's say.
01:07:35.659 --> 01:07:49.340
So I wiped it from RAM but did the memcmp leave the, the value, value is comparing against in registers, general purpose registers and the next function returns value to the user or makes'em accessible if the user can save force or register, save before their code runs.
01:07:49.730 --> 01:08:00.800
I mean, it's just like so many things like that that are, when you think of all the way down to the gate level of hardware and the things that are happening there that as a designer, you have to control again, if you're gonna offer high assurance
01:08:00.934 --> 01:08:04.235
This is why, by the way, this is why I'm such a weirdo about crypto vulnerabilities.
01:08:04.235 --> 01:08:13.594
Like, again, I'm not a, I'm not a cryptographer, I'm like a vulnerability researcher that's just kind of has a weird interest in cryptography, but it's like I'm obsessed with bug classes, right?
01:08:13.599 --> 01:08:21.875
Like, I've always been like, it's like, you know, it's much more interesting to have like the blueprint for a, a bazillion bugs than it is to have just a one bug, right?
01:08:21.875 --> 01:08:28.354
I just, I just remember being a teenager and then working out an exploit, then finding it somewhere else and feeling like completely all powerful because I was a terrible nerd.
01:08:28.564 --> 01:08:31.414
But, um, but like cryptography is like that.
01:08:31.909 --> 01:08:33.739
To several orders of magnitude, right?
01:08:33.739 --> 01:08:36.859
It's like it's not enough to make sure you've counted the bites properly.
01:08:36.859 --> 01:08:49.939
Like you have to, like, you have to understand the micro architecture and you have to understand all the different ways that attackers can influence the state of the system to bring up a pathological condition where it's like in normal, like we're still working on memory safety in normal system security, right?
01:08:49.944 --> 01:08:56.539
Like that's still kind of cutting edge, getting things built in a memory safe language, which just comes down to counting things properly, right?
01:08:56.539 --> 01:08:58.609
Like in the actual instructions at architecture.
01:08:58.699 --> 01:09:04.819
And cryptography, it's like the, the, the complexity of the constraints that you have to enforce are so much more interesting.
01:09:05.359 --> 01:09:07.819
I wanna believe that we haven't even scratched the surface yet.
01:09:07.824 --> 01:09:15.779
Although if you look at the last, you know, two years or so of vulnerability research, like, we're not like kicking down the doors or anything like that with crypto vulnerabilities.
01:09:15.800 --> 01:09:17.479
So I'm like, we, we need to pick it up a bit.
01:09:17.510 --> 01:09:19.939
But, um, I'm hoping to see a lot more of them.
01:09:20.630 --> 01:09:23.765
I'm with you that buffer overflows are, are counting things.
01:09:23.765 --> 01:09:43.475
But I think use after free's is a much, uh, bigger problem in practice and high value software and a much more complicated problem than just counting things and possibly given the NP hardish nature of the SAT solver that gets shoved into every compiler for a type safe language or, or memory, safe language.
01:09:43.895 --> 01:09:51.904
Um, probably, uh, uh, in terms of computational complexity, at least, kind of similar to some of the stuff we're looking at in, in crypto.
01:09:52.529 --> 01:10:01.399
I mean, what's coming next is how can you prove that your new processor is safe against Spectre and Meltdown kinds of vulnerabilities.
01:10:01.640 --> 01:10:04.640
You know, we saw SGX fall, for example, and Intel abandoned.
01:10:05.119 --> 01:10:05.420
Yeah.
01:10:05.489 --> 01:10:06.140
CHERI's great.
01:10:06.350 --> 01:10:07.079
Uh, I like CHERI.
01:10:07.729 --> 01:10:09.020
Uh, C H E R I.
01:10:09.020 --> 01:10:09.260
Yeah.
01:10:09.710 --> 01:10:20.930
But yeah, it's, it's, it's one of those things though where you, you start looking at the whole system again is, you know, system on chips as well as really complex processors that are almost system on chips nowadays for even desktops.
01:10:21.380 --> 01:10:25.789
And it's, it's like, which cryptographic primitives.
01:10:26.060 --> 01:10:34.520
Um, you know, Dan Bernstein had a big focus on designing his cryptographic primitives to not involve data dependent branches because he was concerned about timing attacks and site general in general.
01:10:34.970 --> 01:10:44.239
But it's like, um, when you're designing new cryptographic protocols and you're designing new processors that are gonna run those protocols.
01:10:44.510 --> 01:11:01.069
How can you do both in a way where there's a, a nice composability, where the protocol fits well with high performance caching and branch target things, but maybe there's hints from the compiler that tell you things about what you should or shouldn't store in your buffer, your LRU or whatever.
01:11:01.520 --> 01:11:03.529
So interesting to see where that goes.
01:11:04.069 --> 01:11:07.939
it'll be interesting, although I know some computer architects.
01:11:09.260 --> 01:11:18.470
They don't talk about making theory, their architectures, micro architectures or designs any nicer for building good cryptography into them.
01:11:18.560 --> 01:11:21.020
So I'm, I'm not very hopeful.
01:11:21.439 --> 01:11:28.250
And they're, they are very, um, blase about the latest and greatest micro architectural attack.
01:11:28.340 --> 01:11:31.640
They're basically like, Oh, you looked under the hood for the first time.
01:11:31.640 --> 01:11:31.789
Did.
01:11:32.975 --> 01:11:35.854
Look at where all your data is leaking all the time.
01:11:36.215 --> 01:11:41.074
Did you think that you got those very fast comp, uh, computers for free?
01:11:41.074 --> 01:11:41.465
Did you
01:11:43.789 --> 01:11:44.300
It's scary.
01:11:44.305 --> 01:11:44.630
Yeah.
01:11:44.944 --> 01:11:45.335
Yeah.
01:11:45.335 --> 01:12:01.114
It, it's scary, but at the, Yeah, like, this is very interesting because like, I totally believe you that like, if you really want high assurance security of your software, let alone your cryptography, you basically have to nail down the piece of sand that's actually executing your operations.
01:12:01.114 --> 01:12:02.585
And I believe that thoroughly.
01:12:03.335 --> 01:12:16.774
And yeah, we write software that we're just like compile to wherever, like maybe you have a, a JIT and we're expected that to operate over keys like in JavaScript for example, or WASM or whatever it is.
01:12:17.135 --> 01:12:21.215
Um, and then we might have ARM an ARM just runs everywhere.
01:12:21.244 --> 01:12:24.454
It runs on a whole bunch of devices that will execute ARM assembly.
01:12:25.789 --> 01:12:26.840
like, are we fucked?
01:12:26.930 --> 01:12:29.119
Basically like is software fucked?
01:12:29.180 --> 01:12:33.229
Uh, if we're just trying to, to handle this as best we can in software?
01:12:33.710 --> 01:12:43.189
Or are we really, do we really need to just like control our hardware and everything that it runs all the way down for any sort of assurances?
01:12:43.925 --> 01:13:02.465
Uh, I'm probably not the best person to ask to answer the first part, uh, because I gave up on that a long time ago in terms of trying to make the high level stuff behave, you know, like, you know, writing Java code that translates into a particular native code, which translate, you know, using, avoiding certain instructions like, you know, you just can't prevent that kind of thing.
01:13:02.645 --> 01:13:05.074
Even the compilers kind of the enemy when he comes to C Code.
01:13:05.404 --> 01:13:06.875
So it's like, yeah.
01:13:06.875 --> 01:13:12.545
You know, you know, DJB does like hand coded assembly implementations of a lot of his algorithms to try to avoid stuff like that.
01:13:13.234 --> 01:13:13.534
Yeah.
01:13:13.534 --> 01:13:27.395
So it's, it's, yeah, it's, it's funny, I mean, in the embedded world you have, you're, you're much closer to the, the sand and yet even there, there's enough complexity that you have to be very, very careful and.
01:13:28.204 --> 01:13:30.425
Do lots of testing and validation and stuff like that.
01:13:30.635 --> 01:13:40.204
So, yeah, I, I, I don't, I don't know if there's really an answer to that that, of things that can be solved at the high level, at, at, you know, at, at the complexity that, that desktops and servers are.
01:13:40.625 --> 01:14:06.055
It's more like you escape to a smaller environment where you do control the sand, handle your key management, your whatever stuff there, and then the rest of it sort of, you, you implement compartments that are keyed off of that, that, that, that, uh, secret state per compartment, you know, like where you have like, kind of like an SGX type design where you've got compartments, but the key managements handle outside the processor and the processor never has direct access to the memory encryption keys or things like that.
01:14:06.970 --> 01:14:07.329
Interesting.
01:14:07.710 --> 01:14:09.409
Can you tell me more about that
01:14:10.760 --> 01:14:24.949
Well, I mean just, just as, just as a species, we, we, we don't work well with complexity and you know, when you have things like provable security or code verifiers and things like that to, to, to check that the implementation matches the design and the design's correct as well.
01:14:25.520 --> 01:14:29.750
Um, automated generation of code from that, from the design been verified.
01:14:29.960 --> 01:14:30.890
Those don't work at scale.
01:14:30.890 --> 01:14:40.819
I work at small programs and our ability to reason about the state space of an entire system is, I'm gonna say, you know, to be confident.
01:14:40.909 --> 01:14:46.399
Maybe it's kilobytes and megahertz and not gigahertz and terabytes.
01:14:46.399 --> 01:15:04.010
And again, that's kind of hand wavy, but you know, it, the design and verification effort needed to, to get a processor working correctly and to be in a, in a environment with active attackers that are trying to influence things with physical control of the environment, like temperature and, and voltage and optical glitching and all these other things.
01:15:04.010 --> 01:15:06.350
It's, it's, it's a, it's a high threat environment.
01:15:06.350 --> 01:15:10.489
And only in the smallest scale have we been able to create something that will last for a little.
01:15:11.015 --> 01:15:11.345
Wow.
01:15:12.335 --> 01:15:38.074
I, I will kind of go the other direction and be like, instead of, we're all fucked unless you invest in like all this intense verification all the way down to your, you know, to smart sand and be like most people writing software and trying to do it securely, including a lot of people writing, deploying cryptography, which is, you know, software probably don't have to worry about this sort of threat environment.
01:15:38.704 --> 01:15:51.034
But there are plenty of people who do, and they usually have more money to invest in this high assurance verification and they might be deploying their own hardware, which they can invest trust in.
01:15:51.185 --> 01:15:51.635
Right.
01:15:52.354 --> 01:16:07.345
Well, there's, there's a, a problem of equity here, um, which, You've got big firms like Google that have the money to invest in both the security engineering and also the their own silicon in some cases, uh, for like TPUs, et cetera, or Titan for, for example.
01:16:07.675 --> 01:16:13.015
Um, but then you also, then you have the low end people who aren't really experiencing huge threats.
01:16:13.015 --> 01:16:16.765
Their problem is more like ransomware, something that's kind of a mass scale kind of attack.
01:16:17.154 --> 01:16:34.375
And then in the middle you have companies that have, you know, there's some kind of, um, you know, government contractor or something like that for air conditioning parts or whatever it is, where they actually have a high threat because they have some kind of criticality, but they don't have the expertise or resources to be able to defend against that high threat.
01:16:34.614 --> 01:16:51.595
And those, I think, are the ones that are the most, it's collectively to society are the most risk, um, groups because again, they have that threat against them with highly funded, highly motivated attackers, but they don't have the inherent culture and, and support for defending themselves.
01:16:51.789 --> 01:16:52.180
Right.
01:16:52.630 --> 01:16:52.989
Huh.
01:16:53.050 --> 01:16:53.319
Okay.
01:16:53.755 --> 01:17:13.704
I think the, the running theme on some of this advice, you know, you opened with saying avoid fragility, make things robust, and we've touched on limiting complexity a lot, but sometimes it's not clear what the less fragile decision is or what the less complex design is.
01:17:13.704 --> 01:17:21.024
Do you have anything you can say about what does it mean for something to actually be robust or for something to be simple versus be complex?
01:17:21.225 --> 01:17:26.755
A lot of it comes from enumerating attacks and deciding which ones you don't have to care about.
01:17:27.444 --> 01:17:33.864
And usually with the robust design, you can throw out classes of attacks or vantage points for attacks.
01:17:34.345 --> 01:17:45.895
So, for example, if you're hashing, if you've got like, you know, one master secret and you hash it with a serial number to get the derived keys in the factory for injecting into particular personal personalized devices.
01:17:46.314 --> 01:17:54.354
You don't have to worry too much about someone decapping, extracting keys from a single device because it's like, okay, you've compromised that one device that you bought and you own.
01:17:54.654 --> 01:18:02.034
Hopefully we don't have so much trust in the client side device in our, in our overall system that that's a critical failure for the entire system.
01:18:02.395 --> 01:18:03.895
You know, we shouldn't be fielding things like that.
01:18:04.135 --> 01:18:05.784
It should be revoked that device and move on.
01:18:06.145 --> 01:18:10.795
And if you have appropriate monitoring and stuff like that to be able to do that, then you can respond and move on easily.
01:18:11.244 --> 01:18:24.864
But if someone's able to from reverse engineering and, and, and dumping a key or something from a single device gain leverage against your entire fleet of devices or even smaller substance of that fleet, then you need to be more careful.
01:18:25.045 --> 01:18:30.864
Carefully consider that kind of attack is, is in scope and also your system might be more fragile than you thought it was when you first designed it.
01:18:31.314 --> 01:18:43.345
So there's, there's, there's kind of these properties based on the, the, the high level choices you make when you design it, that if, as you think through the attack tree and, and the various, uh, bits of leverage and, and approaches, an attacker would take.
01:18:43.869 --> 01:18:50.199
If you keep getting confirmation that, Yep, that fits within my design parameters, et cetera, that's probably a more robust design.
01:18:50.199 --> 01:18:55.720
The one where, Oh, wait a second, no, that as soon as they can do that, we now have to replace all this stuff.
01:18:56.079 --> 01:19:02.619
It's like, Eh, maybe we should move some of that server side or not even collect that secret data or something like that if we can avoid it.
01:19:03.024 --> 01:19:16.284
so this is interesting because it's both threat modeling, thinking like an attacker, but also thinking in sort of like a complex systems like sustainability, reliability sort of person or sort of architect, I guess.
01:19:16.840 --> 01:19:17.050
Yeah.
01:19:17.050 --> 01:19:18.520
You have to think through the whole life cycle.
01:19:18.579 --> 01:19:28.029
It's not what attacks can I prevent from this thing, but is the entire system survivable over the long run, You know, whether survivable is profitable or.
01:19:28.869 --> 01:19:43.420
Um, you know, some kind of acceptable loss of materials or whatever it is, you know, cost of materials thrown away in the trash or whatever it is, you know, is this survivable on whatever time scale is appropriate for, for my venture, whether it's a nonprofit or for profit kind of thing.
01:19:43.840 --> 01:19:53.680
And that survivability is including dealing things like spam and fraud and waste and abuse, and how many people are gonna have to answer support phone calls when this thing goes wrong.
01:19:53.770 --> 01:19:57.039
Like, and does the user even know what to do when something goes wrong?
01:19:57.045 --> 01:19:59.859
You know, do I, do I call someone, do I email them?
01:19:59.859 --> 01:20:01.989
Like, and how do we replace it in the field?
01:20:01.989 --> 01:20:05.979
Like, all, all that life cycle stuff is, is critical.
01:20:06.039 --> 01:20:15.369
And again, it gets to whether systems robust or brittle in terms of, you know, as soon as I've got a support incident of more than a thousand devices affected, uh, our company goes out of business.
01:20:15.369 --> 01:20:16.510
That's, that's not survival.
01:20:16.614 --> 01:20:16.854
Yeah.
01:20:17.335 --> 01:20:17.694
All right.
01:20:17.694 --> 01:20:18.175
So cut.
01:20:18.204 --> 01:20:38.604
Uh, branching off that, do you have any like, like fits on a post-IT design principles, like pity words of wisdom for cryptographic systems, either at the scheme level or the like software system that you actually deploy level, uh, to impart based on that sort of.
01:20:39.279 --> 01:20:42.189
Sort of holistic view of life cycle management.
01:20:43.119 --> 01:20:56.020
Every system has to solve the fraud problem if it's sufficiently large, you know, and that could be, you know, everything from spam, like I said, to impersonation to just annoyances.
01:20:56.199 --> 01:21:03.399
You know, at some point you'll have to have some staff dealing with the support and responding to attacks or, or issues with it.
01:21:04.149 --> 01:21:07.779
Uh, another one would be count the number of bits of state.
01:21:08.109 --> 01:21:12.430
Uh, Paul would at Cryptography Research would say count every flip flop in your system.
01:21:12.939 --> 01:21:18.819
And, you know, if you can't even enumerate all the flip flops or to be able to say something.
01:21:19.194 --> 01:21:29.244
Reasonable about the use of those flip flops or, or what would happen if an attacker control can control one or more, or a subset of these flip flops, then probably the system is too complex to have high assurance.
01:21:29.845 --> 01:21:33.295
So things like that watch out for debug access.
01:21:33.414 --> 01:21:42.204
And I guess in the, in the case of, um, support software, this would be the console that your customer support representatives use to reset passwords or whatever kinds of things.
01:21:42.354 --> 01:21:57.204
And at a high level, but at the low level it's like, you know, J tag ports or whatever, other kinds of, even just board level or even on chip level wires you routed just to assist in troubleshooting a particular problem, refusing off something which is actually dangerous if it gets re-enabled.
01:21:57.654 --> 01:21:58.654
Watch out for debug.
01:21:59.868 --> 01:22:00.167
right.
01:22:00.167 --> 01:22:02.198
Well I think that's part two.
01:22:02.618 --> 01:22:03.877
We've gone on for a while.
01:22:04.778 --> 01:22:07.807
Um, so thank you for coming back out.
01:22:07.948 --> 01:22:09.592
you're, uh, you're consulting again, right?
01:22:10.448 --> 01:22:10.747
Yeah.
01:22:10.868 --> 01:22:12.217
Root Labs is, is active.
01:22:12.217 --> 01:22:13.898
We're, we're, uh, actively doing projects.
01:22:14.092 --> 01:22:19.252
uh, the small audience for this, uh, for this podcast I think intersects pretty nicely with Nate's customer base.
01:22:19.252 --> 01:22:20.332
And, uh, yeah.
01:22:20.332 --> 01:22:23.082
I highly recommend people check Nate out at uh, rootlabs.com.
01:22:23.573 --> 01:22:27.382
This has been a Root Labs promotional episode, and, uh, I'm happy to have done it.
01:22:28.207 --> 01:22:34.268
And don't forget to go to merch, dot security, cryptography, whatever, and buy uh, a merch that is not entirely black.
01:22:34.658 --> 01:22:36.757
Yeah, it comes in pink now.
01:22:38.301 --> 01:22:39.141
Nate Lawson.
01:22:39.231 --> 01:22:40.731
Thank you very much.
01:22:40.731 --> 01:22:41.181
This is good.
01:22:41.452 --> 01:22:41.662
This is
01:22:41.742 --> 01:22:42.516
It's been a blast.
01:22:43.311 --> 01:22:43.822
Nate.