welcome to the final live stream
um i am getting set up as
uh usual obs um betrayed me
and um now my phone is betraying me
i've just been betrayed by technology
left right and center
the airpods don't work obs doesn't work
but now obs works so we're gonna take a
deep breath
i am kind of running on um very very
very little sleep for
a very very very long time um
but we'll make it we'll make it through
this week and we'll make it through next
week
and then we're we can sleep for several
weeks
come on why are my airpods not working
the airpods are alive that's just all
there is to it
the airpods are a lie
um
what if i put them back in here
come on all right anyways airpods aren't
important let's get
why why is it showing me as not live no
i'm live
perfect where's the chat there's a chat
no that's the chat replay
dude this is
maybe i can't handle technology that
that has occurred to me several times
in this course maybe technology is just
just
perfect beyond
all right we have the chat we have the
stream
we still don't have the airpods give me
the airpods so that i can turn on the
zoom
there's too much technology in the court
in this course that's the real problem
oh they are probably amazing we almost
broke the phone
oh man good times
all right we are now on zoom where
we can share
the screen let's uh bring that up
the setup for this course is way too
complicated
in the future we're gonna go back to uh
um like
pythag or not by daggers what's his name
socrates we'll just
walk around greece and talk about cyber
security
that'll be
okay that was uh me being connected
there's by the way two zooms involved in
setting all this up
what a wild wild situation all right um
let's
do that and this
okay if you're finally live you're set
up for pwn college everything is good to
go
all right um
excellent suggestion on twitch to remove
all editors other than emacs then we can
just
quit computing and it's it's that simple
um boom all right cool
um okay so today we're going to cover
a couple of things um we'll start as
always
with the state of the course
um and
uh then we will roll on
from there um
let's roll okay
this is week 14. we've made it i think
it's week 14.
um i don't actually know i kept
incrementing numbers i might have
forgotten sometimes
um but the slide says week 14 so we'll
go with that
um we made it to the end of the semester
this is
um super exciting uh
[Music]
to me and to you hopefully um
let's dive into the meme review but
first don't forget about teaching
evaluations
super important if you don't evaluate
the teachers
then the teachers don't get tenure
they have to leave uh asu and wander
around greece teaching uh
in the old socratic method anyways oh
never mind we have a report that they
close on the 27th
so the teaching valuations are a lie too
late
uh hopefully you you evaluate it but
that's okay
gg indeed um that being said i will send
out after um the course is all done
a google form
evaluation to get some extra um
feedback from you about specific parts
of the course
for example how many hours did you spend
on baby rob how many hours did you spend
on on
baby heap to try to balance things out
and make things better
all right um
[Music]
then the meme highlight
um oh is that my
favorite one second oh thank you
great news everybody we have our frappe
to try to uh survive
uh
on something all right
um that's a good frappe so
uh meme highlight we had some good memes
and then there's there's more that that
flowed in in the last 15 minutes
i think we'll either have to do a live
edition or
um do a mini meme highlight on the last
office hour so i'll hold one more office
hours
uh next week um of course to
to help people uh going through the um
what you know everything
trying to catch up and all of this stuff
all right
oh brilliant check this out
quiet it's using crushed ice instead of
uh full ice that's very interesting
my eyes get stuck in my straw
guys that's interesting all right to the
memes
um we have oh my god these are some of
this text is
unreadable i'm sorry about that the
there's obvious height
about the blue belts and there should be
the blue belts are awesome
and i've been talking a big game about
how we're gonna have blue belts um i was
getting ready to just pay for them out
of my pocket
but we have funding secured um we have
managed to acquire um blue and yellow
belts
or manage to achieve
approval to acquire all the blue and
yellow belts we need
um officially through asu channels this
is insane
only at asu probably can this be
possible but it's happening
when you hundred percent pwn college
you will receive your blue belt
guarantee it
when you 100 all the way through toddler
one
you'll receive your yellow belt so of
course the progression is yellow blue
and
if you do if you 100 if you get your
blue belt you get a yellow belt as well
they'll be engraved
engraved that's not the term that's for
stone
they'll be um not embezzled that's
they will be embroidered with pawn
college
it'll be super awesome yeah thank you in
the in the chat um
[Laughter]
exactly next year uh on the tuition
you'll see
a 45 charge for belts belt fee
um all right uh
[Music]
uh yeah it would be awesome if elon musk
funded our belts
if anyone knows elon musk and he wants
to fund belts um let him know
all right so um
that's that's the the super exciting
thing about the
belts it's going to be awesome ah this
is actually a
combo meme this i i combined these two
memes
i'm like uh the the meme frankenstein
and this is frankenstein's meme uh this
was one meme
incredible i i love the the the you know
belt on the forehead this is another
meme and uh this is very
very careful well done uh photoshop work
there
the whole thing all right um of course
you once again are faced with toddlers
and toddlers
are a lot um
also it was thanksgiving uh weekend i
understand a lot of people
didn't have time to dive in um but
uh these challenges are definitely uh
probably the the hardest challenges that
you will
face you know there are a couple of very
like
uh you know um call out challenges i
think that are
just you know very applicable and also
difficult um the toddlers they're
they're kind of a
good constant level of difficulty um
of course as you noticed we haven't
released more toddlers yet but we will
now or not now now but like during this
this lecture
um we're gonna release toddler two level
9 10 and 11. and
those are gonna be end-to-end exploits
all the way
from user space through a sandbox into
kernel space and out of the sandbox
it's going to be incredible it took some
time to
uh get that infrastructure support
solid we haven't had that before in
prior years this year
we will it'll be incredible all right
um so
these uh little um ices they make it
difficult to uh to drink all right i
i really shouldn't shrink these memes so
much this is a lesson learned for next
year i'll split the
meme review into multiple pages um i'm
proud to report that while we uh
have not ever managed to um
destroy the uh zoom doorbell in the
entire
semester um we managed to uh
accidentally well zoom just isn't the
optimal platform
for teaching um so everyone i think has
migrated to switch
um
and it's good stuff all right um
okay there is um a question on twitch
that i i want to acknowledge and we'll
get to
will releasing more challenges lower our
grades or is it all extra credit
we'll get to that don't panic we're
reasonable people
um everyone fails no i'm just kidding um
all right
uh
yeah what's up we have a quick question
yeah we'll go through a fuzzing apple
don't don't worry we'll get there
all right so um
cool all right uh i think
this meme referred to um
the uh kernel infrastructure at least i
it spoke to me with the kernel
infrastructure every time i hit ctrl c
and kill all of kimu it it it
makes me um very sad oh
i know what this is this is me
constantly killing
my python uh or deleting my python thing
ah
okay that was a
brain moment i i i see all right this is
a meme for conor also
uh meta meme the meme and the response
this hard to swallow pill is emacs isn't
the real editor you can't
edit using an operating system connor um
crazy guy constantly emacs disney makes
that
um do for example i i will
tell you that you know you use um a lot
of templating stuff to
generate your challenges so that they're
you know for the the
different variants we put in and so
forth
and um because of
emacs the templates are like
horrifically white spaced
like they're they're just you know very
weirdly widespread because emacs
doesn't allow connor to do it um in a
more
sensical way so things are a bit crazy
all right
awesome um what else we got oh this
you know meme is this is where i was
talking about uh the the challenges
needed some
more time in the oven this also happened
last week um
you know as we got to the end of the
semester uh
all of the things that we pushed onto
the back burner to focus on this class
started
uh high priority interrupting and and
life has been a little crazy but
we're almost there it'll be incredible
um
for example you know this sort of stuff
happens when you have
no time for anything reasonable
awesome stuff
now connor is trying to convince people
that tabs are wrong
tabs are right anyways
hi crazy stuff okay
ctf report we had one person that played
ctf last weekend that's okay
it happens that's um thanksgiving
weekend um
i understand even if it hurts me oops
um this means that
i haven't actually checked if this one
student has played every ctf
but it is uh
it's possible so we might have one
person to play at every ctf but uh
we have several people that played all
but one for sure
um next weekend uh there are several
ctfs many ctfs uh to choose from
um there are a couple uh two that i
recognize uh one is death camp ctf
it's a long-running competition um
that has intro
very hard but also some uh less hard
challenges
um but uh perfect blue ctf
is a ctf by actually the team that just
won hit
excuse me hitcon ctf last uh weekend
um they're putting on perfect blue ctf
um
you can uh give it a try don't
i i'm sure it'll be very good i don't
know what the difficulty level will be
um so keep that uh
in mind uh two good ctfs um
to choose from um and and we're still
counting
that extra credit up until the very last
moment
all right how is asu doing versus the
world we have a new
um crown champion this week um
trisha uh who has
uh always been
here like tied for for first place
generally
has now boosted up into
uh the very top of the scoreboard uh
followed by neural
one shadow null pointer
actually zardis i lost track of who that
is in in reality
uh torah shulk
their top seven is all asu
and then we have our top um
worldwide students hollow circuit and
shinji
um and then rodeo and freak mod
hacks mk so these are trying to find
no no one knew from last week yet zero
msm root janitor jeff
jenner jeff was yeah was fourth last
week i mean these but these are all
people
super up there near the top narnix aaron
and flynn so the the top 20
has remained shockingly stable in terms
of the
the the names that comprise it um you
can see
if i move my camera that uh
top 12 uh whenever i took the screenshot
which was maybe an hour and a half ago
um
top 12 are um have solved everything
i'm looking forward to them tackling
the amazing uh levels that
that connor's about to release um
let's see let's see let's see yeah um i
i hear you on
on twitch real life responsibilities
thanksgiving was a very
very tricky uh thing to to work around
that was insane
um that was really wild
all right
cool okay so then let's uh roll on this
asu
versus the world i think so far
over the whole course i guess so far is
um
there is no so far we are at the end so
through the course
actually let's go and uh see the
the top top scorers
over the weeks see what we got
all right we had the first asu versus
the world
neural was number one we had two
worldwide students
then next week janitor jeff took
first and now you have one two three
four
five worldwide students and the debut of
hollow circuit
what is that the view of call circuit
oops
yeah cool um then
we have flynn on top
and then uh zero leading the worldwide
students
and basically we have this huge group of
worldwide students show up and then
we have a much more distributed hollow
circuit takes first place
in week five in week six
um hollow circuit maintains first place
actually that's the first uh two week in
a row
hollow circuit if you want to go to
graduate school shoot me an email
um let's talk hey uh
then um week seven actually if any of
you guys in there
you any of you students in this course
want to go to graduate school
um let me know i'll talk about this in a
second too
zero one one week seven
week eight freak mod i think that
makes freak mods debut on the top of the
scoreboard
week nine freak mod remains on the top
of the scoreboard
week 10 freak mod
week 11 freak mod
week 12 root takes the
scoreboard dethroning freak mod
then week 13 freak mod
rethrones and now we're in week 14 with
trishall
taking the top spot awesome stuff
[Music]
um
everyone everyone wants to play some
among us maybe the real imposters are
the friends we made
along the way all right anyways
awesome stuff don't uh panic if you've
dropped this week
it was thanksgiving you have plenty of
time to pawn
and again the top 12 are all tied for
first
the moment those new challenges drop
it's going to be a blood bath
it's going to be awesome oh someone uh
tracked that oh my gosh cool
so we have freak mods been top five
times hollow circuit twice neural ones
jenner jeff once
flynn wants 01 once ruth wants and
crucial ones
amazing stuff onwards all right
this might be the wrong week to show the
stats
of how people did on um
toddler two again it is uh it was
thanksgiving
and i'm sure people had other things to
worry about but generally speaking
we had another massive drop so this
first massive drop is
toddler one second massive drop is
toddler two
um and you can see the same
in uh kind of the the grade distribution
basically
based on this graph it looks like
toddler two is
uh so far if he had ended here would be
our second
toughest module basically
cool all right um
so moving on current grades
um we have we started the course
with 209 students
of those 118 are still registered i
think
because you should let me refresh my asu
i realized i didn't refresh it
the last couple of days
loading loading loading fingers crossed
oh it's showing me spring now zero 118
still uh registered awesome 21 has
solved any toddler two
obviously that's down lots from last
week where
uh we didn't lose any students in baby
race that
had uh solved uh baby kernel but
um it's uh so again it's thanksgiving
and i hope to see you all
pushing right back in uh right after
that all right obviously we failed to
release the second half of toddler two
on friday
as originally promised on friday i think
everyone was
in a food coma um so uh
we're releasing the second part of
toddler two today it's been just kind of
constant uh never-ending insanity
um conor can talk a lot about
um how um
uh um how
my mind just went completely blank i
need more frappe um
the the crazy things we have to do to
get infrastructure support
um later but uh right now
we're basically ready to launch what
this means though is
when we launch extra challenges it'll
devalue your current toddler two
challenges which will drop your grade
that's not fair
to compensate we are widening the curve
so uh the a range is widening by three
percent
which is exactly the impact of the new
challenges on your grade
um so your letter grade should remain
the same
after we launch these challenges um with
the new curve
um this means that we have gone
so far uh into this sort of
chart right this is on um this isn't
last week this is uncurved
this is curved let's take a quick look
at last week's
and then a look at this week's and then
um we'll see that things have shifted
so we've seen people fall out of a plus
to
a and out of a to b for the most part
gone and then uh b c and d there's been
some movement before we had 32 b's
30 c's and four d's and we are going on
to 38 b's 36 c's
and six z's um
this is with the new curve but before
the new toddler
uh challenges have been released
uh please tackle the toddler challenges
they're still worth quite a lot and they
will you know
or they're still worth full credit up
until the 13th of december
and you can push right back in there
okay
um
[Music]
yeah and so there's discussion on uh
um um twitch that
uh yeah toddler two a lot of people
haven't started yet
but again because we
are about to devalue toddler two by
basically a third
of by releasing a third more challenges
um
we are adjusting the curve to be fair to
you
um all right let's see
oh no people are saying i'm not middle
school appropriate
what are my janis i'm sir oh i guess
yeah i guess there's some swearing
right see what else uh
no time for the class this week um
jan is cold-hearted with assigning the
work but very warm-hearted with a
grating
that's awesome um
[Music]
let's see all right so there's a
question if we are happy
with our overall grade right now can we
be secure that we will keep this grade
uh after tonight yes uh
if you have done any toddler challenges
your grade will drop slightly uh
the the percentage points when we
release the new ones because the
the old ones will devalue a little bit
all the grading is per module right
and in within the module it's all
normalized to
one um
if you have some buffer or if you check
tonight then and and you're happy with
that
yes that's that's all everything from
here on out
um is just pushing your grade further
this curve
is the final curve so uh
don't don't worry
um the range is for plus and minus uh no
the ranges for less and minus
i think are still like two percent or
something um
let me let me check
uh let's check on the
other thing
yeah two percent on either side
is uh pluses and minuses
um
does anyone like minuses i don't know
i guess it's better than the lower grade
but anyways yeah
cool all right um
getting rid of minuses might be a good
idea anyways let me think on that but
right now these are the cutoffs cool
um so yeah there's questions on on
twitch connor correct me if i'm wrong
but
the overall grade is um
um
is is their overall grade right if once
they have their overall grade if they're
happy with that
then that's good awesome and we have i
think most of the extra credit in
already
but um yeah okay
if you are not happy with your grade
right now what to do
um one the teaching challenges
count toward your grade i'm gonna keep
well i guess i'm not gonna keep saying
this but i've been saying this for a
couple of weeks
because i don't want anyone to uh
think that they don't they're very
important
so do the teaching challenges if you are
in the position that
you didn't realize they count toward
your grade and you've done all the
testing challenges but not the teaching
excuse me challenges email us and we'll
fix it
um then
um uh
two don't panic three toddler two
and four baby auto are full credit until
the day before grades are due this is
literally
as far as we can extend them um
baby auto is full extra credit toddler
two is full credit
what extra credit means is when we
average your module grades together
we will just divide by n minus 1
instead of n so baby auto is the 12th
module we'll divide by 11.
um
okay there's a question is baby otto
going to be easier than toddler two yeah
uh toddler two is going to be the crown
of the course
um 12 13 at 4 p.m yes
we need some time to uh first of all the
the
the whole framework my understanding or
at least this was the case at one point
connor cried me from wrong with the
whole framework takes one deadline
um and uh time wise and that's 4 p.m
um okay so uh
um and then that will give us the time
to actually compute grades
to reach out to people uh you know
i need to reach out to one person that i
think
has uh misregistered in porn college and
so none of their grades are actually
um or we don't have a mapping from their
asu id to their
grade i'll i'll email you make sure to
respond to me asap um all right
uh ctf extra credit there are still two
percent extra credit available
this coming weekend and next weekend
for next weekend you need to send us the
write-up on sunday
on monday it'll be too late all right so
that's
two more percentage points on your final
grade
um then the y grade option
a y grade means a c or better it does
not mean pass fail
uh the grading system is y d
or e those are the grades you would get
so if you fail you still get an e
if you get a c or better you get a y
this
y doesn't impact your gpa so this helps
um let us know by email today
to pon college asu.edu
or pon college or anyways
it's on the web whatever's on the
website as our contact email
um
yeah so email us today we're going to
build a list of our uh if you need to
undo
a why grade choice i saw that on the
twitch email us today
uh to undo it
um we need some
time to make sure that we have once
these grades are submitted
i think it's a giant pain to actually go
back and on
like change they be messed up and put
you on a y grade instead of a non-white
grade and
so we need some time to make sure it's
correct to email out confirmations
give people time to get back to us and
so forth okay
all right and that brings us to our uh
schedule it's the last week we're going
to
uh talk about automatic vulnerability
discovery today and closing remarks
actually closing marks first
then uh automatic vulnerability um
discovery
um it's a sad sad time i've
really enjoyed uh uh
interacting with you in these uh unique
platforms
um i i'd never twitched in my life
before this but
um now i'm twitching several times a
week
um yeah and even more when i get really
stressed
so it's been awesome
i'll miss you all let's talk about
your careers all right actually first
any questions about the state of the
course before we move on
a lot of emotions in the twitch it's an
emotional time
uh one thing i forgot to mention
is i keep saying you're falling further
and further behind
i slept for i think actually then i
suffered three hours which was
incredible but i i slept for one hour
then i had two meetings then i slept for
like another hour and a half um
[Music]
uh the
the end result is uh the baby otter
challenges are
almost ready but they are not ready
ready
so we will have to launch them tomorrow
i i know this is a disappointment in the
meantime
toddler one is is ready uh toddler two
is ready and and and we're gonna
toddler two it away uh you can push on
that
but baby auto will actually be on
tomorrow
uh not tonight so that's
uh 1000 my fault i really thought i had
the time to record
lectures and uh make the challenges but
um
and then i couldn't think anymore so but
we'll get there
tomorrow you'll have your baby auto
it'll be awesome
all right and uh to reiterate it will be
easier than toddler two so don't despair
um if you are so close to an a
uh and and you're struggling with
toddler two
uh
[Music]
i would encourage you to also try baby
auto
rather than giving up uh for the y grade
but of course there's that
risk factor um cool
question on twitch did i get a haircut
uh i did not
get a haircut um i'm kind of waiting for
uh this third wave you're in to
dive down die down a little bit before
hair cutting although
the initial results post thanksgiving
seem
not quite as scary yet as expected but
yeah um
yeah exactly uh figure out when
you're in between wave three and four
and get the haircut then
um my family has been trying to shave my
head
so i've been uh resisting this uh
very enthusiastically because uh at my
age
you can never be sure that it'll
actually grow back so uh
yeah it's it's scary all right
let's talk about your careers
all right originally in the first two
iterations of
csc 466 i had um
uh this in the very beginning and i felt
that it was kind of
not necessarily wasted but um people
didn't quite have the context
to approach the concept of you know
what are you going to do after this
course because uh
they didn't know that there would be
life after this course but now you can
kind of see it
right you can imagine that on
december 13th at 401 pm
you will get up from your chair
and you'll walk outside you'll fall to
your knees
and you'll just look up at the sun and
just feel its beams
warming your mind
anyways that went way too far
into insanity i blame the frappe
um exactly anyways
while praising the sun you can think
about next steps in your lives
so let's say that one of these next
steps as you're praising son you realize
you know what
despite everything i still want to be a
hacker
so what the hell do you do alright
there's two steps one how to keep
learning and two
what to do after school right
how to keep learning you know my stance
ctf don't stop playing
ctf if you're one of the people that has
been playing ctf
every weekend or most weekends that's
incredible stay with it
if you are not and you want to
get good now you have a background
i mean saying a solid background is a
little maybe self-congratulating but you
definitely have a background
in binary exploitation binary versus
engineering
and and and this area of system security
you can start approaching ctf challenges
and war games
you have it in you now you are either
blue belts
or on your way to blue belts and the way
to get to become
brown belts at heart no one's gonna
actually probably give you a brown belt
although we should hand out brown belt
said
you know what would be awesome if you
traveled well when
travel's a thing again to like ctf final
events around the world and like
handed out brown belt that would be
incredible
okay now i'm i'm anyways all right um
uh okay so ctf this is
the best way to pro up
bar none you can read a million books
you can uh
i don't know
eat a computer but anyways but the best
way to pull up is continuously play ctfs
if you play every weekend then
very soon you will be a top hacker
of the world and if you don't believe me
ask ppp on uh
our podcast ctf radio we interviewed
the um one of the top hacking teams oh
the finale's up awesome
interviewed one of the top hacking teams
in the world
about their history the plaid parliament
of poning they have won defcon
i think five times now the olympian
they're five-time uh hacking olympians
and basically we talked to them about
you know
how and their secret is
play c t f play it
done every ctf all right
so
uh yeah to answer a question on twitch
the episode numbers are in hex
absolutely
um all right so we have
um
number one play ctf if
what the hell just happened i think
chromium just sec faulted
no
oh i clicked the link lol okay
[Laughter]
cool
[Music]
um
oh no our hexadecimal episode numbers
messed up uh
sql project damn all right anyways
of course if you keep playing ctf you
can
become a ctf olympian yourself the
olympics of hacking defcon ctf takes
place every year in las vegas
in 2020 as a virtual um hosted by
yours truly currently the organizers
cycle out every
uh five years or so um you're truly with
a lot of help from an incredible team
the order of the overflow
um incredible other than me i can't
really
call myself incredible obviously um
uh it's hard to qualify you have to
win or do really well in qualifying
events last year 16 teams out of
the world's huge amount of teams or
hackers if you played ctf this semester
you know
just how many teams show up on that
scoreboard 60 teams qualified
virtually went to vegas this year uh
for three days of non-stop hacking
insanity
if you're interested in talking to the
winner of defcon
the current uh hacking olympians
um you can also listen to them on our
podcast we interviewed them
about what makes them tick how they
prepare etc etc
um i want to see all of you
whether you're a student asu student a
worldwide student i want to see all of
you
at defcon ctf honing it up
all right on a non-coveted year this is
what defcon ctf looks like
this is an asu student mahalos
the uh he's a co-captain of shellfish
and a amazing hacker
you too can be in this picture maybe you
have been in this picture
it's uh exciting stuff if you're
interested if you're
um an asu student of course shellfish
has a solid presence at arizona state
university
jump on the discord talk to them start
playing
if you're a worldwide student that
discord is public you can still jump on
still talk to them
but uh i'll i'll talk more about that
later actually i
thought slides were slightly differently
ordered all right so
let's um say you have now
uh you you continue playing ctf you have
product
you feel that okay now i know what i'm
doing i can tackle
real software one way to do that
is through bug bounty programs right and
this can be a way to also continue to
learn
while working in the real world it turns
out that companies
will pay you money if you find flaws
in their software services networks etc
some companies that have these programs
so make sure check out this list of bug
bounty programs
there's a lot of companies on here a lot
of
real deal serious business companies you
know google
facebook et cetera et cetera et cetera
you can uh
you know try to get some bitcoins at a
coin base
and if you succeed you can disclose that
to them and they will give you
rewards usually those rewards are money
um these this money can be significant
if you find
a serious like end-to-end jailbreak and
an iphone
you submit that to apple um i think
their top
awards this this number keeps changing
and honestly don't look it up every year
to update it
but at some point that award level was
over one million
right it's quite a good um
haul for um
basically hacking make sure to read the
rules of these programs
[Music]
and make sure that you get permission in
the beginning of the course we talked
about
um ethics never hack something you don't
have permission to hack
all right uh but these bug bounty
programs explicitly give you permissions
to hack them
usually sometimes in limited ways and
make sure to you know follow the rules
but then um it's a good way to practice
up i know
um i have friends that for example
through
the bug bounty of united airlines
uh earned millions and millions of
airline miles
and and are like flying well not now but
where
up until the pandemic flying business
class uh everywhere
with their crazy winnings for finding
web vulnerabilities
in united airlines systems
all right so let's say you uh
found a bug hopefully
you were working in a bug banning
program but
uh either way please please please
please please do not start exploiting
bugs in the wild it's a good way to get
uh you in trouble it's also a good way
to get me in trouble if uh
the story becomes uh asu professor
teaches students
to break into uh um
to break into companies and become cyber
criminals that's that's not a good
headline
um i would in in a way i'd be proud of
your skills but i would be
disappointed in your ethical sense um
there's a couple of things you can do
right without exploiting the wild one
you can tell the world this still
happens to this day every once in a
while someone shows up on twitter and
says hey
here's a bug right this is
uh um
bad form right it's it's it's not uh
not a good thing to do uh it forces
a lot of people to scramble to fix
vulnerabilities it exposes people to
risk
a lot of this risk has physical world
implications a very big target of cyber
attacks for example is hospitals
and obviously there are significant
problems when hospitals
get compromised and become unable to
function
because of vulnerabilities so this full
disclosure is
really out of style it was very hot in
the early 2000s
now it is much much less so so you
should
what you should do is um do uh
the um
responsible thing and responsibly
disclose it to the company that it
affects
usually you send them a report you send
them your proof of concept exploit
you uh explain what you did and they
have
some time 60 days usually to fix it
before you release it publicly this
usually rewards you with
what is called a common vulnerability
enumeration number
a cve entry um that
says hey such and such a person found
this bug they're awesome they reported
it it's great
if there's a bug bounty involved google
apple this sort of thing
also comes with money right so if you
find a bug in google chrome
you report it to google they will give
you uh let's say
thirty uh one thousand
uh three hundred and thirty seven
dollars for some reason that number
seems strange or is it
three thousand i don't remember they
have a bunch of different tiers and they
all spell elite
but they will
[Music]
give you money they'll give you a cv
entry it'll help your career and it'll
help you
buy fancy stuff i guess um you can also
uh demonstrate it in a zero day contest
still above board still you know not an
unethical thing per se such as pawn to
own which then will go around uh
turn around and and share it with google
or whoever is
the affected entity there are prizes up
to a hundred thousand dollars
i mean they're they're they vary year by
year target by target and there's a lot
of fame
they'll uh see this shortly um um
in a uh a youtube video i'll show
all right um you can
also as people are discussing on twitch
right now
throw ethics out the window and sell
bugs to black or gray markets right
i highly highly urge you not to do this
this is a a good way to get into
situations you don't want to be in
um it's analogous to selling weaponry
right again these are cyber weapons in a
sense
right they can be used against hospitals
to bring down
um hospital systems and literally kill
people right so you want to be careful
um if you
do turn around and sell it you can make
incredible amounts of money right if you
um
have a uh chrome zero day that
for example does not even escape the
chrome sandbox
that can be worth over a hundred
thousand dollars if you have an
iphone a remote end-to-end iphone
um zero day where you can gain
persistence on a uh uh on a fully
patched update uh the fully updated
iphone
by sending a text message or something
that is priceless
right i mean two million dollars is just
an estimate but it's it's it's insane
um
but it's not the ethical thing to do
that is the ethical thing to do is
disclose it responsibly
apple will award you with a little less
but without
the guilt and the the ethical problems
awesome all right
we have a quick question on zoom what's
up
ah yeah so the question was what is the
gray market so the black market
is uh more self-explanatory the great
market what
is it it's a lot of things it's um
it's it's yeah it's it's
security firms it is foreign security
firms
it is agents of foreign governments
it can be a lot of different entities
that are interested
in acquiring vulnerabilities we talked
about hacking team
the um company that finaeus fischer
attacked
you know it can be someone like hacking
team right that then uses these
vulnerabilities to build
um software that is used by
uh oppressive regimes to
um target activists for example
right
um yeah so uh on on twitch uh someone is
asking okay
the um so essentially the black market
is lots of money
and the normal uh bug bounty is little
money
and and that's kind of true right it's
uh
there is a price in terms of just raw
dollar amount to be ethical but
it's the right thing to do and you
should do it you don't want to be
responsible
for a cyber attack that brings down a
hospital for example
all right so
now that we are done talking about bug
bounties and stuff of course
uh let's say you are not yet at the
point where you're finding
real bugs in real software but you
want to get to that point right i
mentioned last week
cse 598 it is now up
we can go and we can
pull up
asu class search
search for cse 598
here it is new 598's are popping up
every day make sure you get the right
one it's this one
applied vulnerability research cse
598 applied vulnerability research is
uh not quite the sequel of of of
cse 466 but using the skills that you've
learned in csc 466
we can now start approaching real-world
software
in a controlled way so what we're going
to do
is identify real world targets
analyze them find vulnerabilities
perform the disk
responsible disclosure process and um
do awesome stuff okay uh
[Applause]
this has opened to anyone with an a plus
um originally i had a hard requirement
of blue belts
i've been convinced that it's kind of
weird to have a requirement in the
syllabus that you have a blue belt
um so the requirement is a plus so if
you have an a plus because you use
ctfs and extra credit from ctf hell yeah
we want you there you're an
awesome ctf you probably have a lot of
unique awesome skills
um uh i don't think
um conor will be a ta
no but conor will be connor are you
enrolled in that class
yeah he's he can be your uh
your classmate in that class
regular blue belt from a store won't cut
it you need that a plus in pull college
um or for or the blue belt so
either either way um now
the question is what about students that
aren't enrolled at asu
there i just bit my tongue ow
this first year i don't
think that it's going to be possible uh
i'm sorry i know it's not what you
wanted to hear
um i will talk about ways
that you can then come to asu and
uh uh um you know
get into this class with us and
everything in the future but
this course uh is not going to fly
in terms of um just kind of approval
um globally unfortunately um all right
question what is the time commitment of
598. i've gotten a lot of people that
reach out like
uh jan this course sounds super exciting
but honestly 466
is basically uh attempted murder so um
we're scared uh i don't foresee
that 598 will take anywhere near the
time of the 466
the 598 is an experiment
if you're gonna target real software not
known vulnerable software not challenges
that are small you're going to say hey
can we find a bug in chrome can we find
a bug
in adobe acrobat can we find a bug in
nginx mysql this sort of stuff right
we're going to
build custom tools usually
custom fuzzers to find these bugs and
then look into how exploitable they are
and so forth um
basically uh um
uh i don't think 598
will be the insanity that 466
is this semester i think 598 will be
um much more reasonable 598 is not going
to
destroy anyone's gpa um because
there is a risk with 598 that there are
no vulnerabilities
right so we might um start in on
uh the whatever we want to find a bug in
chrome and it turns out that
every single bug in chrome has already
been found
i'm not gonna fail people for that right
it's it's all about
a solid analysis plan a solid analysis
and
so on right it will be reasonable
um can we do 598 online
it's an asu sync course um so we won't
it has an in-person meeting but we won't
be meeting in person next semester
um so i think the answer for that
is yes um someone mentioned to get
around
the um requirement or not get around but
to
satisfy the requirement of being an asu
student you can enroll as a non-degree
seeking student
asu will charge you tuition
unfortunately um
but that is a way to get into this class
um the class also i'll mention requires
explicit approval by me you won't be
able to
just click add or oops you won't be able
to just click add you have to email me
i respond with the words i approve and
then you forward that to the academic
advisor
um and then they will add you to this
course
all right um do i know if it counts for
any four plus one requirements i think
it does
um but you should double check with
academic advising i think
actually conor might know this better
but uh i think
four plus one students need to take
several or can take several
uh arbitrary 500 level electives this
would be one of them
ah yes uh some people managed to add
themselves without approval
while the course was misconfigured um so
gg i think uh there was an email sent
out i i mean if you have
the a plus slash will have the black uh
the blue belt
don't worry about it then you're fine um
otherwise
uh be careful all right um
yeah so connor says that the 598 is
going to
count as a 500 level class but
getting it to count for a specific topic
area i think there are three topic areas
for master students that's going to be
trickier
yeah okay sweet so
that is going to be awesome um
if you are not a student at asu
um
but want to be you can be all right
we are constantly looking for awesome
graduate students
uh if you're interested in graduate
school if you're interested in doing
this stuff doing research into
automating this stuff
and being sanctioned to play ctf
this semester i literally lost probably
three nights of sleep because conor was
busy playing wctf
and that's fine that's an important
pursuit
reach out we're always looking for
awesome students
email me if you're interested and
this applies to students that are asu
students so our undergrads
um a lot of you have already reached out
to me
uh anyone that's thinking oh i should i
should try out
this research thing shoot me an email
you don't have to commit to a phd right
away but the phd is
the way to go for sure um all right
non-asu students
if you are rocking phone college
email me and let's talk about grad
school
if you are not sure about grad school
we do have an apprenticeship program um
that is currently on hold you to covet
but that won't be forever the case
um so if you go to
sefcon.asu.edu apprenticeship
we have an apprenticeship program this
is for bringing in
um awesome uh talented people that are
not
currently at asu if you are currently at
su email me if you have other ways to
bring you in
um but if you want to try out research
at asu
shoot me an email the apprenticeship
program will bring you to asu
or virtually bring the su as soon as we
can resume it um with with the covet
insanity
um you will uh
uh work with us on some cool research
projects and
um we'll do awesome stuff
we will pay you uh during your
uh apprenticeship to so that you can
survive
and then um we will um
then talk about you know if graduate
school is right
for you talk to your professor all right
have a quick question on zoom what's up
so the question on zoom was will 466
material be relevant to quantum
computing
um not in the sh
well 466 didn't just teach you about
binary poning taught you a lot about
learning hopefully
taught you about googling by forcing you
to talk to you about
figuring stuff out um that will continue
to apply
heat metadata corruption does not apply
to quantum computing in its current form
uh quantum computing right now is uh
basically specialized circuits
to execute specific mathematical
algorithms
um there's no memory corruption there
but there could be in the future
you know as quantum computing advances
so it's a little early to be able to
speculate
confidently
all right
let's see moving on
all right let's say uh
uh pass this course you uh
do awesome stuff um oh there's a
question on twitch would the
apprenticeship be a good seg
into 598 yeah absolutely um
that would be a great way to uh then you
are kind of
internal and then you can start showing
up and auditing that course
right um um
another comment on twitch that you need
baby quantum that would be interesting i
think a whole
crypto series would be incredible uh
when i
when the young hackers on shellfish um
the younger than me hackers on shellfish
showed up and started
uh outponing me i actually uh
started taking up crypto as my main ctf
category so
um before becoming a defcon organizer i
was mostly a crypto
ctf um
[Music]
so uh teaching crypto would be very cool
um but i don't know i mean imagine
cramming a couple extra modules into
bone college it would really no longer
be attempted murder
um all right so you've learned
you've loved you've pawned you've gotten
bug bounties you have some cvs on your
resume
you are ready to go out into the world
and make a living but how
all right let's talk about career paths
in cyber security we'll start with um
kind of a a standard uh
standard but goody let's say penetration
testing right penetration testing is a
career path
in which you will be hired by
companies to penetrate
their networks right to identify
security
uh issues so you have
you know your penetration testing tester
wells fargo hires you to make sure that
their atms are secure
and you figure out you know that uh
there are actually usb ports that are
exposed on the atm
you can plug in a disk a usb drive and
software will run
bad news right um
penetration testing is cool it has a lot
of pros you're breaking into
actual systems of actual companies and
they are paying you to do it
right there's a wide range of targets so
you might attack atms
for uh you know wells fargo you might
attack uh
point-of-sale machines for target you
might attack i mean
mostly your attacking networks and and
so on
um it is a
uh a um
quite a lot of potential things that you
can do
the con is that uh
realistically on the scale of corporate
security
huge huge huge amounts of um
actual security issues are you really
like we forgot to patch this system
right um or uh we didn't disable
uh booting off of uh usb drives so if
you reboot our point of sale
system with a usb drive plugged in we're
um
and these sort of things right uh i've
never been a penetration tester
uh disclosure but um
anecdotally uh from my friends who have
been
it can get boring seeing the same silly
issues right um you also spend a lot of
time
writing reports for your non-technical
clients
and talking to them about this depending
on your exact
job position the exact makeup of the
penetration team
this could be boring if if that is part
of your job
or frustrating um and there's the time
pressure you're hired
to do this penetration test in one week
or something right um the tooling of a
penetration tester is mostly
scanning and um
kind of network analysis i forgot to add
like wireshark and stuff to here
um and uh the use of existing
exploits for um existing vulnerabilities
right uh not exclusively but but more
predominantly than other careers in
security
an example of a local employer that does
penetration testing is bishop fox
they're headquartered in arizona
i think they are the biggest penetration
testing company
so if this is something that that
interests you this is a definite
[Music]
this is a definite potential
contact
another option is an in-house security
engineer
so large companies actually maintain
teams of hackers
um that that keep them uh secure whether
it's
making sure they're software secure
making sure their services is secure
an example is a google security
team and and like microsoft security
team
but any sufficiently large company will
have a security team i worked
for wells fargo doing internal security
like this
um uh the
pro to this is it's a stable gig
right and and if things get weird with
security if you
realize that i no longer want to be a
hacker it's easy to internally escape
into other parts of the company
that can be a pro that can be a con as
well it's much easier to get a raise
when you move between companies actually
but
you know take that as you will um you're
generally allotted adequate time
unlike a penetration tester which is
working on a very tight
deadline usually a contract mandated
deadline you're allotted time
to analyze and identify security
problems
and that can be good right
the con is that uh there's a lower
variety of targets you're kind of stuck
on you know doing security for the
company that you're doing security for
and their systems when i was doing this
i was uh staring at the same
basically five or six pieces of
technology for
years and it it can be at times a little
not fun
um another con is that you are
in the structure of a large company
usually large companies maintain their
own
uh in-house engineering security
engineering groups
um and these internal politics can get
kind of crazy
so i think i had like in four years i
don't know six
five or six managers or something and it
it kind of
can can be wild um the tooling that
you'd use as an in-house security
engineer
actually is uh pretty cutting-edge
stuff uh fuzzers to you know analyze uh
your internal software um i mentioned
lib fuzzer and afl
in in uh
the uh automated vulnerability discovery
lectures lib fuzzer of course need
source code but the cool thing as an
in-house security engineer you usually
have source code
right so then you can you can really use
stuff like codeql
build other tools uh grep and sad etc
right
um it's a very viable uh
security career uh can be very lucrative
the nice thing by the way i'll say is
it's
it's absolutely possible to jump between
all of these and and
i for example went from an in-house
security engineer to a professor
um obviously through graduate school all
right anyways
you can be a security engineer for the
government sector as well um the
government also maintains teams of
security engineers the
government is in a sense a gigantic
corporation right
um the cool thing is this is extremely
stable
and again it's similar you're allotted
adequate time to explore a lot of
security the the the security properties
or whatever you're exploring
um the con unfortunately and this will
be repeated in
the academic career the con is that the
public sector pays
worse uh way worse um
so you know as a professor for example
i'm you know giving up
quite a lot of salary potential for
quite a lot of freedom um the con
another con is uh of course clearance
requirements so
you know if you work for i don't know
the nsa you will need security clearance
and then um
you you know might not be able to speak
at conferences about the work you're
doing or it might be even harder than if
you were working
at a company and so on so this is all
um a a weighted decision that you have
to take
um the tooling is very similar to the
uh in-house uh or the the corporate
security engineers
um it's uh uh
a lot of of you know what you're used to
plus
you usually have source code access
sometimes you actually don't i should
have added like ida and binary ninja in
them
to this list then um
next up is an interesting uh twist
on an in-house security engineer is a
vulnerability
researcher so there are companies that
work either for clients
um or for themselves to identify
vulnerabilities in third-party software
completely unrelated
so literally you show up to work and you
are working for
google project zero that is one example
of um
these companies not a local example
though um so google has a team
called project zero and their mission is
like hack the planet or really
change security find cool techniques to
find bugs and they'll find bugs in
ios even though apple is not paying
google
actually you know they
might not even want this to happen but
they find bugs in ios
disclose them to apple they'll find bugs
and you know
mcafee antivirus and they disclose it to
mcafee you know they'll
yeah they'll disclose it's actually the
company not the person um
and so on right uh um
and then they'll blog about it after the
responsible disclosure process has
completed
this is done for a number of reasons
it's done for
uh kind of uh it can be a marketing
event like oh look
google security engineers are super
super elite
google is a cool company um another
example is keen team
uh that that is a part of tencent in
china
they do this sort of thing as well and
they'll you know
release uh information and blog post
porn they'll go to own to own
and and compete there and so on um these
are kind of cyber security rock bands
you're working in a team of talented
people it's very cool
um and there's a lot of targets to
explore you're not limited by the
targets inside your company you're not
even limited by the targets of your
clients
it's uh very cool the con there's a lot
of pressure
similar to a rock band you need to
perform you need to
to showcase that you're doing awesome
stuff
there's potential for drama um if you if
google suddenly drops
a uh if google gives apple 60 days to
fix a bug
apple can't quite make it google drops
the bug
on the open internet which has happened
actually it happened like a couple
months ago
uh then suddenly um
there's a lot of drama between apple
google and then apple employees and
google employees and it's it's
it's tricky and then um some
uh obviously google is is above board
and so forth but there are these
vulnerability research groups
that are not quite above board think
about hacking team
again right um a group of of hackers
that
that uh identify security
vulnerabilities and third-party software
but hacking team uh apparently sold that
to oppressive regimes
um tooling there ida pro for reverse
engineering you can of course use binary
ninja
or gydra to people typically use ida pro
there's a reason it costs
thousands of dollars and if your
livelihood depends on
being able to reverse engineer software
you will pay thousands of dollars for
the tooling you need
um and you know uh binary uh
fuzzing uh sort of stuff like afl custom
fuzzers you write
or or specific fuzzers local examples in
phoenix we have a big cisco presence uh
cisco has a group called cisco talos
that is one of these rockstar teams
and this is the model they're trying to
follow with uh cse 598
we're going to build a mini
vulnerability research
group for one semester and see how it it
works maybe we'll blog about it it'll be
cool
all right um then
professor you can become a
academic a hacker in academia
as a professor there are a lot of pros
in order to get there it's a lot of
hardware you have to go to graduate
school you have to do well you have to
publish
novel research you have to be personable
you have to shake hands
kids department chairs
scratch that you have shake hands shake
hands with department chairs shake hands
with
potential future uh colleagues etc
um you become a professor and then
the pros and cons begin the pro is you
have academic freedom
with your students you can work on
whatever you want
it's incredible right you can say i want
and
i have said i want to explore
whether or not you can use an electronic
olfactory sensor an electronic nose to
uniquely identify different people
as they walk by the sensor right so we
did research in this it's an
insane idea we looked into it for a
little bit
um once you get tenure
several years six to nine depending on
the university
um if you do well enough that they give
you tenure you are unfireable so you can
spend the rest of your life
in a low pressure situation pursuing uh
awesome
um
[Music]
cutting edge research and you're always
involved with cutting edge research
because that's literally
part of your job you have to be on the
cutting edge
publisher parish is a scary thing that
if you don't publish you won't get
tenure and you're
you you get fired but on the other hand
it gets you
in this uh mode of always being on the
cutting edge
even as a security engineer in industry
it's very easy to
start falling behind i experienced that
firsthand
as a professor at the very least you're
always involved
in that research even if it's the
students that are actually
leading it um and you're constantly
around absolutely amazing people
like connor even though he likes emacs
um they're brilliant motivated
and uh when they burn out new people
come in and take their place
um but this is super awesome and and you
get to teach them
this is very rewarding right i i i value
the ability to hopefully uh
teach you about cyber security and make
you excited about cyber security
the other awesome pro um
is
[Music]
that there's a very very strong legal
umbrella
in academia right
we have explicit exemptions under the
digital millennial copyright act
to do research that non-researchers
cannot
these exemptions also technically
actually apply to any vulnerability
researcher but academics are very um
you know the the the there's a lot of
lawyers are used to academics having
these exceptions so i'll show
one piece of research that i think would
have been very hard um
to do safely outside of academia um
it is a paper called steal this movie
that uh me and
that me and fish who is a fellow
professor here now
um created so it's a project
that automatically using automated
dynamic analysis broke digital rights
management of netflix
um amazon prime video
spotify and uh
i think that was all in the paper and
then we also went on and applied this
to like um kindle ebooks these sort of
things
um so if you're interested uh we
published this in 2013
steal this movie automatically bypassing
drm protection media services
when we were talking to um
lawyers about this we disclosed this to
like microsoft who
created netflix's drm to adobe and so
forth
they said well you know you guys are
exempt under the dmca so
uh you know go go forward there's not
much we can do
um so that was a
definite bonus to being an actor there's
a legal umbrella there's also an ethical
umbrella you have
teams of people that you can actually
say hey i want to do these experiments
is this ethical right and they can say
oh actually uh
you are trying to replace someone's
brain with a microchip that's probably
not a good idea
um all right of course the con as i
mentioned the public sector pays worse
there's just no getting around that
the public sector pays worse um it's uh
it's a bummer uh and the bureaucracy can
be daunting
right um and there's a lot of pressure
there's a lot of pressure to
acquire funding all these graduate
students they need to survive they need
to eat that means
we need to pay them that means we need
to acquire funding from
um the government or from uh the
industry
to do some research um and
another con you can see in the tooling
there's no afl in here there's no ida
it's uh not so common
that i get to just sit down and spend a
whole weekend
uh you know in ida pro reversing a
binary for
ctf most of my tooling is google slides
to make presentations for um funding
agencies and and
and and you know for classes in ipython
doing demos or or
using the tools that uh my students are
working on
and then latex writing papers
but it is super fun there are times when
i get to
dive into ctf i have the bandwidth to
host
defcon which is insane there's quite a
lot of technical work there
um so it's it's all good stuff
um obviously local examples
this is the the um kind of uh
assistant professors of setcom cefcom uh
the the
uh system security lab actually adam now
has tenure he's an associate professor i
should delete him
uh so you know
if you uh want roughly this kind of life
talk to us but um the next step is
graduate school graduate school doesn't
force you to have this kind of life um
actually i should have also added
industry research lab
it's a very similar thing but in
industry i
cannot believe i i left that out but you
can have a very similar
life in some sense your professor minus
tenure
but with a lot of the same academic
freedom working for microsoft research
ibm research these sorts of
giant research research labs at giant
companies
um that fund uh people to do
academic work and then they uh then you
you you really get that
that compensation industry compensation
there are other
drawbacks there though all right
um another career
it's a freelance hacker i mentioned uh
i'll show a video of pawn to own
um shortly and i am about to so
basically
like the vulnerability researcher
working for a company you can you can do
this yourself you can be your own
company right you can
find bugs get income from bug bounties
that's one dollar
pawn to own style competitions two
dollars
and bug sales three dollars and of
course you have to be careful with the
bug sales
you know selling a bug to a uh
[Music]
let's say there are different shades of
ethics there but it can be very tricky
um the pro is you're a cyber security
rock star not just a rock band
you are the rock star um and this can be
extremely lucrative
so i know people that that make very
good living
doing this um one of them is in this
video um
the con is there is no safety net if you
don't find the bug you don't eat
right um and there's no legal umbrella
so there's no
giant university bureaucracy to defend
you legally if
you land in hot water and of course the
potential ethical concerns and the
tooling is binary reverse engineering
binary fuzzing this
sort of stuff also of course a lot of
non-binary targets
but um this class we mostly focus on the
binary
world um exactly so an example of uh
legal hot water is geohot being sued by
sony
um so george hotz in high school
uh managed to bro jailbreak the
playstation
3 i think it was back then yeah it must
have been the playstation 3 and sony
sued him
then he released a rap video um but uh
that i don't think really helped his
lawsuit much but anyways
uh it can be a giant pain in the ass
um yeah
so yeah um all right
let me show you a video of pawn to own
this was in vancouver
um uh last year so
when when you could still physically go
to vancouver now of course vancouver
is a ghost town no i'm just kidding but
um
and uh one of my uh good friends and
uh teammates on shellfish uh
uh won i think best of show at pawn to
own or
at least one at tesla so here we go let
me uh
forward to the right place
he is on a um group along with
um a member of of another
hack team i think pvp actually the the
the team that um
i was hyping in uh for their podcast
earlier
um uh
and they hacked the freaking tesla
here we go richard you and kama
had quite the crowd as they entered the
tesla model 3.
after a few minutes of setup they
successfully demonstrated their research
on the market lots in the back right
there
use the jit bag in the river to display
the message and earn 35 000
of course since this is cool to own they
also get the car
that's my friend there it should come as
no surprise to anyone
that the fluorocitate duo have been
crowned master of home for 2019.
in a time for third place cool so that's
uh you know a true
cyber security rock star um but again
that's high stakes if that exploit had
failed
they would not have gotten anything or
worse case scenario right before the
show
tesla finds that bug and fixes it
suddenly all that work
goes down the drain this happens a lot
um
so yeah so this is definitely a
freelance hacker is
for sure a very viable career
opportunity it works
for kind of the top people but it's
really like rock stars
it works for the rock stars but it can
be very cool
all right um let's catch up on twitch
all right we caught up on twitch awesome
so
[Music]
how do we oh wait are we done
oh yeah and that's it no go away
okay very good cool so um
any questions about uh cyber security
careers your future in cyber security
and so on
all right so we had a question on zoom
how does security and embedded systems
work
the answer is poorly um
you recall fine as fischer right when
when finaes needed to get
into um hacking teams
networks he picked or he they
picked a device at random
presumably from among the embedded
device that were
connected to an internet by hacking team
looked at it and shortly afterwards
found a
zero day it is
very sad how vulnerable a lot of these
embedded systems are
they are written in a hurry to get first
to market
and they don't have a lot of the
mitigations
that we have come to expect in software
now
you are used to bypassing aslr to
uh leaking stack canaries to dealing
with a non-executable stack
many of these things actually don't
exist in the embedded world right
depending on
what the hardware is depending on uh how
constrained the hardware is
there might be no mitigations and a
single simple
single buffer overflow can compromise
the whole thing and and
probably this is what finesse ran into i
mean it's even easier than that you
you've uh played around with the program
misuse module if you're called baby sued
how you exploited find right you did
find and then dash exec
to execute a command to cat the flag
well
tons of um for example router front-end
interfaces where you
use ping there's like a
you know you can you can bring up
whatever tools and then it said ping
this this host you can
ping the host they literally run the
ping command and you can
write arbitrary arguments to it in the
text box to
execute commands on the router i mean
it's
uh embedded device security is uh in a
word
poor and this is a problem
any uh any other questions about
anything
all right if there are no questions on
this stuff
let's do this let's take a nine minute
break
until 6 15 then we have an hour and a
half
uh or an hour left in the class we'll go
through
and um talk about uh
[Music]
um um
uh automatic vulnerability discovery
i'll show you how to fuzz um and we will
go
from there um
question is will we get i'm on twitch we
would get a point college gaming stream
over the break
uh several weeks ago i would have said
yes
i think right now my answer is i'm going
to spend the entire break sleeping but
afterwards um i i think
598 shouldn't be as insane
um overload so hopefully we will have
some time for gaming
i have quite a lot of uh games uh piled
up
i actually part way through the semester
bought um the
super mario 3d all-stars uh re-release
and uh haven't even
had time to take it out of the plastic
wrap it's insane
um all right cool um
let's actually do this let's take a
12-minute break until
uh 6 20 p.m arizona time and then i'll
see you
in 12 minutes ciao
all right we are back hold on i lost
my headphones
hopefully the headphones are back all
right the headphones are back
uh dang i have cheaters and type racer
that's crazy
damn all right what is what is type
racer is this some
something that i'm not hip enough
type racer
oops does this work and either
huh cool
dang that's not very good all right
anyways i'll have to uh
i have to race later okay
oh wait that didn't oh nevermind that
worked okay
cool
uh let's uh race a little later right
now let's
fuzz actually uh one more thing i i
realized
um that i forgot to mention about cyber
security careers
um cyber security careers are
in an absurd amount of demand
um just recently there was an
interesting
article that there is a um
a supply shortage of something like
three million
cyber security i mean this seems like
insane numbers so
it's it's it's not probably that's some
weird miscalculation but um
here's a cyber security talent shortage
new research shows us cyber security
talent shortage
here cyber security demand is
twice as high as
supply this means that
it's a very good time to dive into
cyber security as a career it's a it's a
very lucrative
um exciting career etc etc
um
so now's the time to do it if you look
at uh the academic market for professors
for example
let's see obviously this is not
job demand oh asu
why did that pop up interesting
i can apply all right um
in demand thing there's an awesome
maybe here no
i don't know where it is but there's an
awesome chart of uh the different
um major
uh uh
cyber security major computer science um
uh disciplines in academia all right i'm
not i'm i give up
um and uh basically if you want to be an
academic in computer science
cyber security is actually position
number one for most jobs
ai position number two um so yeah cyber
security is critical
all right um there's a question on um
twitch um
if uh someone wants
to be a software
developer maybe you don't want to be a
hacker
so when i said do you so you still want
to be a hacker you said no
it was this class useful um
my feeling of course probably i'm biased
is yes
right in this class like i said you
didn't just learn how to exploit heat
metadata corruption
you learned how to figure things out
given
partial information you learned how
hopefully you learned very thoroughly
how to google technical problems
you learned um how software works on an
extremely deep
level connor and i have been tossing
around the idea that cyber security is
actually the way that ai should er
that computer science should be taught
because in order to hack something you
first need to understand it
to a level that is one level deeper
than where it operates to hack a program
written in c
you need to understand assembly right to
write a program in c
you don't need to understand assembly
all right so um
the depth of understanding that this for
this course has forced you to develop i
have confidence will pay dividends
throughout your entire career hopefully
um or we just tortured you for no reason
um
yeah if you uh took this class on
not expecting the the load honestly the
load
uh i think we all agreed the load got
out of hand
this this semester i think you can very
clearly see that
uh from the curve right um i think our
our current curve is what it's it's it's
it's insane
uh or our final curve is
to get an 82 percent is an a that's
that's a pretty significant curve
um you can get a c with a 52 in the
class um
i i some of the most useful courses i
took in my undergrad were kind of crazy
like that with an insane curve at the
end
rpi's programming language course back
then was absurdly
uh difficult um
i think i got a 50 something and ended
up with a with an a minus
it was insane but um
yeah we're not quite there but uh yeah
it's uh
hopefully i look back on that
programming language course even though
i am
not a uh program analysis
read or i am a program analysis
researcher but i'm not a programming
languages researcher
i look back on that with quite a lot of
fondness
awesome you have a report um that
uh
i report that someone learned uh the
most from 466 out of any class
um that's that's uh great to hear um
and then someone else uh on to which
solas learned
to hate toddlers um
uh i i think i learned to uh
i will soon have a toddler right now i i
still have
uh baby jan is still baby i'm not
toddler young
i think toddler jan is going to be a bit
of a menace but we're quickly careening
there
she uh disassembled her um
uh playpen yesterday like uh i walk out
there like
the foam blocks are all over the place
it's it was a interesting
um
yeah so let's see the the minus
oh yeah the minus range will be two
percent
um or we might eliminate it honestly
i i haven't considered the elimination
of minuses
but let's let's not count on that let's
say for now
minus range is two percent all right
what is your question on zoom
two questions
yes absolutely so how is ai
going to impact cyber security um
there are a lot of really interesting ai
techniques that are making
their way into cyber security um one
such technique
is the use of deep learning
to identify similarities between binary
code so if you remember there was one
live q a
that was the uh session that where i
tried to
show you how to find the differences
between binaries using object dump and
it was just disastrous right
um because it's a hard problem uh
there's a
technique um this is just there are
several there's the first one that
popped into my head
published what
oh no no okay it was published on ndss
in 20 2020 that was the last in-person
conference i went to
um and uh it is a technique for
applying deep learning to uh basically
um recognize code and then of course
recognize it in in other so you train on
some data set and then you can recognize
oh
that is a malloc in a statically linked
libsy with with uh no symbols for
example
all right um the
way that this paper works is a very
clever application of
graph embedding in neural networks so
they take
control flow graphs the things you're
used to staring at in
binary ninja they embed that
into a basically a
vector that is then uh processed through
a neural network
um like this to come up with
um results from the neural network um
and they they talk about
you know the whole thing how it all
works and at the end of the day it says
oh this looks
like some code that um shows up
uh in the
send file function in the linux kernel
right so this might be send file
in in the kernel um and and and so on so
this is
one um cool application of ai
um it is open
source here
um so you can pull it down um i'm
very i mean this is a cool work from
interesting people but if you go into
deep bin div dot pi
and okay maybe not the bind of that pie
feature gen dot pie
all right well now we're just going to
click until i find it graph match that
pie
all right i'm going to clone this and
grab it
oh that's surprisingly large repo
let's catch up on twitch while this is
happening oh a lot of
discussion on uh different classes at
asu
yes yes we'll have we will go over
fuzzing
don't worry we'll do it right after this
okay
cool let's uh
boom awesome stuff
oh they also have it in the readme so i
could have just searched oh yeah
requirements anger so
um i talked about our binary analysis
oops engine uh anger
um in the
[Music]
in my lectures and for symbolic
execution it doesn't just do some
modification it does an enormous amount
of various static analyses
um like control flow graph recovery etc
it's very scriptable so it is used
increasingly
more and more in um scientific research
powering stuff like deep bender so
that's pretty cool to see
um dupe had the easiest final in asu
oh that's why there were all of those
good guys you pay memes
um end of last semester
it's awesome okay
um just as a peek behind the curtain i i
doubt this was the case
there but you know some classes are
required to have a final
and so then you know they're malicious
compliance situations where like fine
you want a final i'll give you a final
what is your name
what is your favorite color all right
cool um
so uh let's talk
about fuzzing
oops all right
you saw in the videos um compare
that c just compares a number
uh input against 42. i created a couple
of other
things that we're going to use to test
fuzzing
i created fuzz easy.c which compares
the first byte against 7f obviously we
can solve this
by as we saw in class cad
w random through fuzz easy
in a loop
and let's grab that for success oh
it uh will crash
uh so that the fuzzer sees it so it'll
crash
when um it uh because this is a
point a null pointer and then this will
try to dereference the null pointer so
no pointer in the twitch
that's uh that one's a shout out to you
there all right let's redirect standard
out and boom so you can see
of course i all of a sec vault gets
printed to standard
error and here we see we can crash it
right but then we have fuzz medium
fuzz medium is an elf parser which is
the very beginning of an elf parser
it parses seven f e l f and then crashes
so if we
cat slash been true
through fuzz medium it crashes
if we just echo elf through fuzz medium
it tells us to go
away and if we try to do the dumb
fuzzing
too fast median oops that's not trust me
i'm sorry what
we're going to be here a very very long
time
because the chance of triggering fuzz
easy
the crash and fuzz easy is one out of
256.
the chances of triggering the crash in
fos medium
is one out of four billion right
so that's going to take a while what we
have here is called
a magic number check we check
a magic number magic numbers if you want
to read all about them look at the file
man page and search for magic
these are magic tests um
there is a file on your computer if
you're running linux which you should be
called etsy never mind i thought
it was all
um anyways ah yes yes yes
yes
okay there's a database unfortunately
what what
what what is this excuse me
it's a magic binary file okay well it's
a custom database format that's fine
um
that basically lists a bunch of these
numbers called magic numbers that you
find at the beginning of files that can
identify the file
uh at the beginning of um
been true if you look at the first line
is
seven f e l f
okay now we know we're dealing with an
l5 incredible at the beginning of
a uh
just trying to think i mean let's just
look at what i have in etsy
at the beginning of a shell script
is you know obviously the hashtag
the pound bang blah blah blah
at the beginning of
there's got to be some interesting files
in here
like a come on i want an image
okay at the beginning of a jpeg
we can recognize this as a jpeg and at
the beginning of a jpeg
is this header
that has um some
jpeg metadata inside it and so then by
looking at those first bytes we can
identify
this is the right file this means that
what file parsers can do
is check hey does the file begin with 7f
elf
if it doesn't our elf parser can say no
thank you goodbye
right and obviously with dynamic
analysis where we need to trigger
the bug in the program in order to
reason about the bug in the program
that's no good suddenly we have the
dynamic coverage problem
all right so this for fuzz medium
is now beyond the capabilities of our
uh what i would term dumbass buzzer
right
all right um
so let's bring in code coverage
guided fuzzing let's dump
disassemble
um
the main function of fuzz medium all
right
in this main function you can see an
interesting
um thing happening right we compare 7f
and then we jump and then if seven f
matched
we compare against four five e
and then we jump if that match we
compare against four
c and then we jump if that matched
four c is l if that jumps we compare it
against four six which is f
and then we jump so the different
comparisons
passing or not are
uh represented by different code being
executed this is the ideal scenario for
code coverage guided fuzzing
by using the guidance of code coverage
we can actually solve this so now we're
going to learn how to use
afl afl is uh
usable in two modes uh you can compile
the code coverage tracking
into your binary or you can just
do binary you can execute the binary
using a dynamic analyzer such as qemu
the the emulator that you're now
familiar with from running your kernels
um qemu can also run user space
programs and do stuff like track um
the code coverage of
that was triggered in the binary when
it's processing your input
all right you can of course clone afl or
apt-get install afl and deal with
figuring out how installed the specific
patches to qe mood that afl requires etc
etc i
highly recommend you do not do this
because there's now this project
afl plus plus
this is afl with community uh patches
uh various cool stuff and one of the
very very cool
cool stuffs that it includes
um is
the docker container you don't have to
install afl anymore you can
just uh run afl
so we do docker pull afl plus plus
that was a weird paste okay all right i
already did it
um it's a very large image so you know
i'd recommend uh
it's several gigabytes probably because
of all the qemu dependencies
um so uh
do that as soon as you got time
you'll also have afl installed for you
inside
your inside dupont college
infrastructure but i would
actually recommend for the fuzzing
exercises
to have your own um
afl um okay anyways
uh because then you you can use all of
the raw amazing power
of your computer rather than the little
teeny weeny um
pawn college container
someone just dropped on twitch
a link to the
fuzzer with a ph
this is another distribution of afl in
some
sense this is a
repository that we maintain that
provides a python interface to afl
so you can um there's also command line
interface in some ways this is easier
i'm just going to
go with the vanilla standard way of
using afl
raw so you don't also have to worry
about um
fuzzer with a ph failing fuzzer is
actually that it has a lot of cool
functionality
that we use in our research but for you
you probably don't need it this is
probably good all right
um past this you can just run
afl plus plus
all right it just drops you into a shell
where you have afl installed
um everything is good to run
afl you run afl
fuzz
and it's actually pretty simple do afl
fuzz you give it some options give it an
input directory where you have the
initial test cases to use
on output directory where it will store
its
state including the crashing inputs and
so forth
and a bunch of other options
you will want dash q binary only
instrumentation that means we did not
compile
afl instrumentations into the source
code we just have a binary challenge
like what you have um in baby auto or
what you will have
and then we start fuzzing it and and
these are basically all of the options
um if you're only interested in one
crash and and you are only interested in
one crash
you can um actually set um
this so it just says run until we
crashed
and then um stop running
all right so let's um fuzz
this thing okay easier way than to drop
into the shell and then work in that
shell
um is to map
uh a directory um
or sorry to drop in the shell and work
in that shell we'll need to map a
directory
we're gonna map my current directories
to slash phone
and again you will end up inside this
container so you don't have to worry
about all of this stuff
all right we have a quick question on
zoom what's up
no um if you're using the afl that will
provide you on the server you don't have
to run
docker run dash it
yeah don't don't worry um
you'll just be able to do afl fuzz with
these options it'll just be installed
but again it's not going to be
extremely fast on that server the likely
scenario is that server is going to be
fairly overloaded
[Music]
um we'll we'll
scale it up but i think we're almost at
the uh
very
biggest machine that we can actually
spin up on on google compute engine
we'll have to check okay um
so we're here we go
here is our fuzz medium
all right um inside our container
we're going to create a directory for
our input
and our output let's say in medium
and out medium in medium
is empty out medium is empty in medium
is where we will put
our seeds our initial test cases that
afl will start mutating
while using coverage guidance as its um
while using code coverage as its guide
all right
do afl fuzz dash q binary
instrumentation dash
i the input where we put our seeds dash
o
the output where we will produce our
results and then
dash dash to avoid any confusion after
dash dash is where the command goes
the command will be fuzz medium you can
also
if the command if the command takes
input over standard input you'd
do it this way if the command takes a
file name input
you can do this and then afl will create
the file name and pass it as an argument
um so if you're fuzzing let's say obj
dump like in the example
uh in in the lecture
you would do uh obj dump
dash d at right this will
pass that uh file to opt dump okay
anyways
um but fuzz medium takes standard input
so we just do this we hit enter
and afl tells you oh not happening
you will experience this a lot afl is
infuriating
in uh the conditions under which it
refuses to run
when this happens you need to look at
why we aborted
look at the error and fix that error and
then restart it
oftentimes the error is if you're
running this on your own machine
hey your machine is not configured
properly it'll actually give you
commands to run
to configure your machine properly um
in this case the error is because we
have no test cases in
in medium fuzzing relies
on test cases without input seeds
you are not going to get very far in
fuzz medium we will but as we'll see
in fuzz hard we won't so
in fuzz medium i think we can just use
an empty seed so this will start with
literally an empty file
let's try this again oh it
never mind it doesn't like the empty
file so
um what i really like is the word fuzz
to start our fuzzer this is i call it
the king
seed to start things out
so here we go that's our beginning seed
let's start and it starts up and we're
rolling
and we found two paths through the
binary it has completed one cycle of
execution we still only have two paths
three cycles of execution now i'm
starting to worry
why is it only doing havoc
uh so we have a question assumed that
the most important thing in this
these challenges seem to be the
generation of those um
initial test cases uh
and it's unclear how to approach that so
we'll we'll talk about that in a second
um but i honestly didn't expect
this not to have found the crash almost
immediately all right let's take a look
at the
output directory um
all right so here we have the output
directory
uh we're running as
root inside the container so it created
this is root anyways
all right here we have the output of afl
afl stores several things it stores
um a bunch of statistics that you can
grab
for and so on so here are statistics
uh we are getting 100 executions per
second is actually fairly slow
um and uh
various other you know statistics cool
all right
um the uh afl has an optimization i
mentioned the videos that it um stores
the
um basically uses as code
coverage guidance the uh source and
destination of
of jumps um this stores this here
in a bitmap um but you don't we won't
dig that far in um
what it also stores is a queue of inputs
that it has found
so it found this fuzz input
which was a seed that says this is it
founded because it was an original seed
and then it found and this input was
given index zero there's an in uh
input 1 which afl took input 0
and did an operation of havoc let's take
a really quick
reminder of what havoc is
havoc is one of the afl operations
it uh does random tweaks to the input
tries bit flips overrides with random
and interesting integers
that's block detection block duplication
and assorted dictionary related
operations
so why is that the only thing that's
running
yeah so havoc why is it just havoc
the hell's going on all right we'll
we'll get to the bottom of this
unexpected uh hurdle um
all right if when we find crashes
they'll be stored here in the crashes
directory that'll be the same it'll
say what id of an input it was uh what
it came from
um and what uh operation
caused the um the
uh change from
um the non-crashing to the crashing
all right let's take a look at what
these inputs look like
so we have
zero is our oops hd
is our original input that says fuzz
and then our input one
is 7f right so it very quickly
identified
7f
but it is only havocking
why all right so let's kill it
did we do something weird by accident
mutator settings
ah
so full disclosure i i have been using
the same ancient version of afl for
a very long time um
well wait no but i
all right let's try this dash d uh but
will this only do deterministic fuzzing
let's try it here we go
oh yeah okay there we go that's the
fuzzing we
know and love so we are
now doing all sorts of mutations bit
flips
aha we found a third path
so let's take a look at what this is
all right so we have a third way through
the binary
again our zeroth is the
original fuzzy that started mutating
that until it managed to turn it into
7f uz makes sense
and then it quickly found
7f e zz
and we're still waiting
pass 7f easy
interesting
all right so there's a couple of things
we can do we can
um create a dictionary to
tell afl that hey actually there is
um let's uh
remove the output so it starts all right
so
we can tell it um
[Music]
to use a dictionary file with a bunch of
[Music]
entries that it will insert into
seeds when it does havoc and
extras for its mutations um
let's do that
uh just to show you that crashes can be
found
so we create this dictionary
and i actually let's take a look
at the readme for the dictionary because
i don't know if this changed
ah so here are some example dictionaries
for different file formats
they don't have one for elf that's fine
let's look at
okay so it's just quotes one per line so
let's look at
our dictionary we're going to put the l
right and then we'll show that if we
give that as a dictionary
it will insert better insert it
okay starting up boom
okay paths two
pass three
pass four so now we have i
and a crash so let's check it out
um
i had to do this because i actually had
deleted this this directory so that
actually i was in
no longer existed all right so here's
the queue
we started out um
with id 0 that's our fuzz
we ended up with id 1 that is
7f buzz then
from id1 we created id2
so it took 1 at this time
point it applied this operation
um at this position and you can read all
about
um you know what this operation does in
the afl documentation
i'm guessing it flips to um
two bits probably at this position and
it created
the e went from seven five to
four five from u to um
e and then we
took um two and created three
so it took two at this time point
created an extension
position two and it put in the
l and it took that from the dictionary
yeah excuse me then we have our crash
and yeah and the crash took
um uh input three
it at this time point it flipped
four bits at position three
and um
created the f for seven f
elf and of course when you provide a
valid elf
to fuzz uh
oops
medium segmentation fault
all right um the takeaway
there are random processes that uh don't
always
uh work um and you often have to help
automate analysis along
so when i ran into trouble i went and i
put in
a dictionary file
with some values that i knew from
looking at the binary
would help oftentimes you can do static
analysis to create these binaries
all right now let's take a look at
pawn or fuzz hard right
fast hard
is much trickier it doesn't have any
code coverage guidance
to tell the fuzzer that it's getting
closer you need to one shot
this exact um
header right this is where the seeds are
absolutely critical
ideally if you're fuzzing an elf um
processing library you need to provide
it proper
seeds if we try to fuzz fuzz hard
even with al in our dictionary
how's this possible
did i write a bug and fuzz hard
so here's fuzz
okay uh fuzz heart is buggy i apologize
that's binary oops
there we go so fuzz hard instead
dereferences the buffer as an uh as an
int
and just compares it all at once all
four bytes this is actually
typically how magic number comparisons
are done so this is the standard
scenario
um
[Music]
okay now let's so as you saw
afl will ignore um test cases
that already result in a crash because
uh
i guess i mean you can you can actually
tell it to
take those crashes and explore the
crashes and etc but
um by default it says actually uh
you know they're um
there are it's not as interesting as a
test case that actually
exercises the binary properly um
and then when everything crashed or ever
we have an empty test case that i fell
ignores
and a crashing test case that ignores
and then it says there are no valid test
cases
uh you know go away so anyways
fuzz hard now we're rolling and we have
our
one path that is our seed
and this is all that we will ever have
because again the without
uh coverage guidance we are back
in the dumb fuzzer situation where we
were carrying out debbie random
running afl in this binary is equivalent
actually to cutting out w random because
there's no
different code to guide us let's take a
look
[Music]
um
if you disassemble main of fuzz
hard there's that single comparison
there's nothing no breadcrumb to tell us
we're getting closer all right
so now the seed is critical
right if you look at the output
all we had was that original seed damn
all right so let's um create a seed
that is almost elf we'll say
uh e fuzz or e
elf and we are
okay so we have a seed now that is e
elf now afl will ignore
seeds that have duplicating coverage so
this
eelf will have the same coverage as our
um
fuzz seeds so let's remove the other
seeds
of course the the programs you'll be
fuzzing will mostly be more
sophisticated than this
um so let's run this
with now our new seed that says elf
instead of 7felf
and hope for the best we start
and boom we that seed is close enough
that we can start mutating it and with
simple mutations
we can trigger interesting functionality
in the program in this case that
interesting functionality leads directly
to a crash
but if it didn't afl could keep fuzzing
based on that
um so again the crash here
is it took uh it it crashed with a
signal 11 a segmentation fault
it came from the zeroth input the
original the first seed
at this time period we did an arithmetic
operation at position
zero and we added 26 and i guess that
translated
e lowercase e to seven f
um and we can actually take a look
7f elf and obviously if we cap that
through fuzz hard it crashes
that is fuzzing um
and uh it's not magic
it's fudging around until things work it
is
figuring out that afl is uh
for some strange reason currently unable
to mutate
this into that um but from looking at
the
program manually this it would help to
do it it is
figuring out a good set of seeds in this
case our set of seed
was just that single uh um
file but if if you know we were talking
about fuzzing a
real um
elf processor like object or something
um we would want more complicated seeds
so for example let's uh
fuzz optional why not um let's kill this
and do we have op dump on here yep
so let's fuzz object dump
dash d and then the file name
ready rock here we go we are fuzzing
objedamp
abdump is much slower than this
and we are not having much luck there's
not a lot of paths being explored
um whoa there's some
leak of a solution there anyways um
because we don't have
a lot of good seeds right
um so let's uh
create some good seeds for example let's
copy bin true
which is an elf file into our
input so now we have
our fake alph but and an actual alph in
the input
let's run opt dump and suddenly
uh
yeah dash d is too slow
let's do something simpler
objdump dash
a just getting the headers
what no come on dump
dash
how do we get the headers
x that's right okay boom
all the headers let's oh no no terminal
ah yeah yeah okay um
sorry guys how long was i
uh oh okay so we we we switched over to
object dump
this is how we will run that whichever
uh which object dump
is here so let's
run
user bin opt dump
dash x and the file so this will read
the headers
print them out and we are going to
disable the dictionary and
roll
okay and we're starting to mutate
oh no these are our our seeds
we're not finding anything yet
up we found okay so we have the original
broken elf and been true
been true is probably a bad example for
this
because been true is actually very large
there's a lot
as you can see it's currently flipping
one bit at a time and been true
and that progress bar for just this bit
flip
mutation is taking forever
but it is yielding results right it's
walking through been true which is a
large binary flipping bits
and actually generating new inputs
right um as a result
so these new inputs are um
[Music]
i think my airpods just died uh oh no
we're back um made by
taking been true which is our better
seed because it's an actual
l file and flipping a bit at
position 16.
flipping a bit at position 40. i don't
know why both of these are position 16.
if there's some information that is not
in here um
and we're slowly slowly agonizingly
slowly because
true is very big if you flip one bit at
a time and we can only execute
25 uh
iterations per second we're very slowly
building up obviously in fuzzing the
faster you can execute
the better that's why people compile and
the the coverage guidance
in instead of using queue mode it's
faster um
uh so what can we do well instead of
been true let's create a uh like a an
elf of our own
let's uh remove true and we
um look at
um
exit that s this is a tiny
what oh oh good it's good
medium what the
running that container is rude messes up
permissions i'm gonna just run it as a
my user
there we go there's no name but at least
it's user id 1000
so that when it creates uh directories
it'll be owned by me okay so
let's copy and exit that s let's
assemble exit that s
so now we have exit dot elf
all right exit that elf is much smaller
than been true
so hopefully um things will go faster
so let's run afl
as before
okay actually this should just be the
full path why do i do that
user been object dump
x no dictionary
unless we have a good reason for it it
can have um
it enforce afl with a dictionary of just
an l in it
that'll be the most uh common single
mutation
all right let's hit it unable to create
out
oh and pwn now slash medium there we go
starting right up and we're ready
to roll
and it froze what's going on
okay there we go all right so we have
four total paths that's all of those
seeds that i uh
put in there um because there's the
assembly file i left in it's using that
as a seed
there's the elf and so forth um actually
let's see what it's using as a seed
oh no it just took the original exit.elf
oh
no and it's these two as well actually
okay and then we can sit here
as you can see this is moving a lot
faster and it's doing its
uh deterministic mutations we can
disable that but they are very effective
it's already found seven um
seeds by mutating seed one uh
unsurprisingly it's our actual um elf
file
um and it mutated it with
different bit flips at different
positions
change 41 position 16. and then
obviously this will take some time to
complete and then we can go from there
uh the more unique uh l files we have
the more useful these mutations are
going to be and the more
paths that they will find
all right um
what else to say about this um that is
basically fuzzing in a nutshell a couple
of things one
fuzzing takes time don't leave these uh
the fuzzing challenge at least off
to the last second
fuzzing takes time um
two um or like for example on complex
targets people fuzz for
months right to find cool stuff
um two uh you can actually
uh parallelize fuzzing i'll show you
this is really yoloing it here i have no
idea if it'll work
afl has a parallelization um that is
kind of this master slave uh
mode dash m and dash s with an id
the master mode will set um
deterministic mode and it'll go
do these deterministic mutations and and
the workers
uh the other workers they will just um
do
random mutations and then every once in
a while they will synchronize with each
other
here's how what's going to happen here
so we can do dash
m
and it needs an argument
this is our default guy so it'll start
up
start fuzzing all right oh it
actually picked up what
what my cycle is done 37
something's weird one sec let's just
remove out medium
okay
starts up no idea why this is
not zero to begin with we'll just ignore
that so
the the the master process is running
with um
[Music]
deterministic seeds and now we can spin
up several
children processes with docker
oh you didn't see that that's not go
away
wow okay uh
i have a bunch of afl's running in the
background um
nope i don't want to see
you to see my solutions all right this
guy is
the one i just started so i can do
docker exact
uh my user this
container it
bin bash okay go into pawn
and grab
that same command but give it
a
slave id
one and it'll start up
synchronize the paths from the parent
and then do the
non-deterministic fuzzing only and then
every once in a while
between um
between cycles they will synchronize so
now we
have 13 paths suddenly that it
synchronized from the child and will
synchronize more and more of them
and they will build off of each other um
to
work together so for example
the parent currently is is stuck in some
slow
runs while the child is going super fast
i actually this this
this seems magically fast compared to
the parent i don't know why
um but we can spin up multiples of these
workers
it's very easy you just go
like this get into that container
or you know ssh in from another
connection
or create another screen session if
you're already in the container
and then run it with
id2 of course this takes more and more
compute resources
but it allows us to um
fuzz more and more effectively let's
take a look at what is going on
um in out medium we have an out
directory
of each one the master and the two
workers
here's the default we have a queue and
you see there's a lot of these
um sync um uh
targets this there are um id
uh q inputs that were synchronized
from worker one and then worker one they
were
id three and then we can see
in worker one
id three
from exit.s that makes no sense
like these make more sense oh ah these
added coverage yes so these are um
so these are uh number five
so we synchronize this guy and number
five came from number one
with a random mutation number one is our
actual normal l
file um a randomized have a commutation
with these parameters and that added
coverage
cool and then we can just kind of see as
they um
synchronize with each other the master
will only synchronize every once in a
while um
between uh deterministic uh runs
so this um this
number might stay low for a while but
then the children handle the
randomization
and and you can see this number
increasing
the the number of paths that they have
found and you run this for days and who
knows
maybe you'll find crashes in the latest
version of object dump but of course
this is with one l file
what you really want is a lot of
different l files
different architectures different types
of headers
etc but remember if you put giant l
files in there
half the bit flips will flip bits in the
code
which is irrelevant for opt dump for
example
all right that is um
what's your question
so there's a question uh in these
challenges how's symbolic execution
going to play out
because oftentimes you see symbolic
execution used
together with buzzing um so for example
to generate some input seeds we could
symbolically execute
until we experience a path explosion
then we can save off those uh seeds for
for the inputs for all of the states
that we have managed to find and then
pass that to a fuzzer
there's a technique that we created for
the cyber grand challenge called
driller uh driller
uh obviously uh
program analysis
driller um is something we published
during the cyber grand challenge here is
yours truly
here's fish um
we have uh people that are now students
uh here at asu um people that are
uh freelance hackers security
enthusiasts
extraordinaires security engineers all
sorts of awesome people
um at the time we were all students
except for chris and giovanni our
advisors working on the cyber grant
challenge
in oops i opened that in the wrong
window um
at the time we were all graduate
students working on
the uh cyber grand challenge and
uh for the cybergun challenge we created
this technique
that combined fuzzing and symbolic
execution basically we would fuzz
until the fuzzer stopped making progress
and this happens the fuzzer
is unable as we saw unable to make some
critical mutation
then we would jump into symbolic
execution and we would load up
just that um the fuzzer's current
state in the sense of all of the code
that it has found
and we just try to use the somali
conclusion to get a little further
then symbolic execution of course has
limited utility because it's a country's
path explosion
the moment that happens we take all of
those the new code we found we take the
inputs that will trigger it
and we ship them back to the fuzzer with
this loop
we were able to do a very neat thing
which is this graph this graph is a
simplified control flow graph of one of
the challenges in the cybergun challenge
and the first fuzzing run managed to um
trigger all of the code in white right
it was missing i don't remember
the the the text describes using
we ran symbolic execution and identified
the new
paths um shown with dashes right so
symbolic execution critically found
this control flow transition this
control flow transition
then we switched back to the fuzzer and
the father then got
uh found this guy i think and then got
stuck
in uh you know making progress again and
you can see this
transition here um then symbolic
execution got us from here
onwards and then the fuzzer explored all
of this awesome code before it got stuck
again
symbolic execution again got the fuzzer
unstuck and found
these uh piece of code
after which everything after which we
found the crash in this binary
right and so this was a very uh neat
um example of driller
working what is crazy is in the cyber
grand challenge
every single team used either pure afl
or most of them used a technique like
driller i think it was an uh a case of
um
concurrent evolution
yeah what's your other question
mhm
no no no you would you you don't want to
copy paste but
you can get those inputs from uh stdn
dot conquer ties um actually see that
cognitive give you a list
of what every read should return in case
you know it's a it's an interactive
program
squish all of that together um
and in python open the file in python
and write that byte string in python
don't copy paste
because there will be binary data most
likely
uh so in anger let's let's just take a
look let's generate some elves
oh look we have 63 else regenerated so
in
symbolic execution i honestly
don't know if this will fly um
we'll we'll try
i have literally never loaded object on
in
okay so
ah there's all sorts of complex stuff
you have to set up
um
let's do this um
that's oops that should have been run
anyways let's run until
the state splits
we might be there for a while though
anyways the point is you would run
i'm trying to think of a better utility
to demonstrate the song than uh
obj dump some command line program that
takes
different command line arguments
or that that takes sddn and does
different things based on it
yeah see this just terminated and it
terminated with
it displayed the usage and exited okay
so this is a good example of what i mean
when you do
conquer ties it returns a list right
this this list is uh
the different write sys calls that
occurred
and the data that that the solver came
up with
each right so this is what happened
there
of course we want to write that all at
once to a file so we can do
in python the blank string dot join
it'll join all of these
with a blank string now this is once
excuse me one string
now we can say with open
um output
right in as bytes as oh
do all that right this
and this is our output now of course you
want to save the inputs because you'll
be sending them
to the command but the inputs to this is
nothing because we didn't create
the right symbolic uh
command line arguments um and
we can uh now cat uh
output and
here is that output from op stump
cool stuff huh so it's the same but for
input
uh question on twitch is mr yan standing
yes
i try to teach standing i find it more
normal because i'm used to teaching
standing so i have this standing desk
for teaching i have a i can of course
lower the standing desk to a
stool kind of uh you know
active sitting desk and then i have a
sitting desk for
for uh kind of long long term working
cool all right everybody uh
i am out of time i must run it has again
been a pleasure having you in this class
we will have office hours on monday good
luck on the rest of
uh toddler 2
connor are we set to launch or are
relaunching a little later today
okay yeah let's launch now so connor
launch up um the rest of toddler 2
baby auto will be out tomorrow
and we will see you later uh is there q
a on wednesday
no there's probably not a q a on
wednesday
they'll have office hours and then um
then you go on your own but we're around
on um
uh help uh in discord
um feel free to tag us in
oh thank you for saying that yeah um
that was a
expression of appreciation on zoom thank
you um cool
all right here we go the um
new challenges are live let me just pull
them
up
i don't know why i started going through
here challenges
i want to do one thing actually before
we sign off on the live q a
i'm gonna go through and i'll showcase
challenges that i honestly think you
could show off in job interviews
and they would uh
you know people would understand that
you know
stuff these are still of course
challenges specific
uh for a class but um their their
real deal toddler 2 level 11 for example
an end-to-end compromise
where you escape a sandbox that you
exploit
by also exploiting the kernel and
escaping that
right um it it it
i think took conor's like a day and a
half to pwn
uh awesome stuff um
uh toddler two level eight
is a real deal complex
compromise um in user space
uh
with race conditions it's kind of the
true mastery of baby race as well
um for colonel
this guy toddler two level eleven is
gonna be insane
um rob baby rob level 15
is a blind rope
uh attack that that
if you can explain to an interviewer how
you're doing it how it works this is
a very impressive uh attack
um toddler one level eight is a jit
spray a real world
browser style exploit let's say
style right um
a a you know something that
you would be you would run into
analogous things pawning a javascript
uh interpreter and then of course uh
our javascript runtime like you know
chrome's javascript vm and then after
that
you have to escape the vm using a kernel
exploit
for example like uh toddler two level
11. um baby jail
sorry uh baby
baby rav level 18 a blind vm reversing
using side channels
right that is kind of a reversing
mastery that
that i think is very neat to see from
students that might not have had any
experience in security before starting
this class
these uh um
challenges honestly i are like a
showcase challenge that i think you
could show
to um actual serious technical
interviewers
and they'd be impressed
yeah baby sewage level 78 on twitch very
very critical
actually if you had an awesome idea to
completely revamp baby sued
it's going to be um for the next edition
of phone college it is going to be
awesome instead uh we honestly we
use baby sued as a readout
um to make sure that people understand
how you use linux and so forth
um i think baby sued can have actual
serious
educational value outside of a weed out
and and we have ideas it's going to be
awesome
cool all right with that being said
thank you all um the blue belts should
arrive sometime in the or the belts the
yellow belts and blue belts should
arrive sometime in the next
several weeks over uh the um
winter break um the moment you have
one hundred percent either through
toddler one for your yellow belt
or through toddler two or sorry or
through everything including baby auto
for your blue belt
shoot me an email um
and uh we will
shoot me an email from the email with
which you're registered at pwne college
and we will uh figure out how to get you
your belts
awesome stuff um thank you
for everything uh uh right
back at you someone on twitch was
thanking me thank you for being awesome
students i know this class is hard
uh it's um
it's hard for us uh but it is very
hard and also uh for you and also your
great depends on it
um hopefully um we accommodated
crazy situations uh and
hopefully you learned a lot and with
that
goodbye hackers