Till Oh, what's poppin? We are on twitch. We are live But by the time you see this we won't be man, so just leave a like comment subscribe Turn on your post notification bells, man. Let's continue to grow the family from Chicago to the UK If you do want to catch alive or catch the previous lives and fast forward through them and things of that nature Just go to twitch.com Yeah, you know enter that down there. That's my username And you can do that. Don't forget we got patreon and we got merch as well the link to everything is down in the description below This is chat LaRoss LaRose LaRoss is it rolls around? It's Ross. Okay Aussie drillers Aussie drills a bloody gang war 1 4 1st 21st district Okay, it is sponsored by one district getting their hands on me When I hear the phrase broad day booting in australia I tend to think of this because on the streets of sydney australian drillers much like their british counterparts tend to have a bit of trouble getting their hands on firearms meaning the modern day Aussie drillers have to I think it's easier in australia, right? Rely on their shanks and shields to get the australia built blocks didn't they? Job done now. I've not yet had the privilege of visiting australia myself And I know it's easy to assume that australia land is nothing more than cans of fosters kangaroos in pouches and shrimps on barbies But today i'm here to tell you that in the west of sydney It's more foster homes shanks in pouches and barbeque pokers headed straight for your back in eyeballs Yes, historically australia has been home to a host of gangsters far beyond the amusing antics of chopper reed In fact gangsters from southeast asia china and vietnam have all had a presence in the country since the formation of the lucrative Aussie drug markets in the 1980s gang warfare that actually culminated in the assassination of the anti drug politician in australia john newman And then of course you've got your biker or bikey gangs two-wheeled outlaws like the bandito's help These are the most things I hear about in australia right here these type of gangs Los angels or gypsy jokers the likes of whom were truly wild being responsible for some of the most insane Instances of ozzy street violence including a 1984 shootout that left seven people dead known as the mil pera massacre It was actually that incident itself that even led to stricter gun laws in new south wales But you know your boy tlr is a driller at heart So in today's video we're going to be focusing on the ozzy youth gangs who would eventually move on from doing dirt In the street to pioneer the ozzy drill music movement Specifically, we're going to be looking at the youth gangs in sydney's inner west and greater west Whose smaller sets would battle it out on the streets of sydney for years before eventually spawning two of the most exciting ozzy drill crews in history 1-4 hailing out of the greater west and 21 district hailing from the inner west These specific crews were made up of the rapping young men who had emerged and survived the dangerous skirmishes between the inner west and the greater west gangs with a significant 1-4 of course they rap 21st district Number of the lads from both of these groups being pacific islanders Which if you didn't know refers to an ethnic group of people hailing from around 80 different islands in the western pacific many of whom's Ancestors will eat that the rock Bought to australia in the 19th century to work in sugar fields with the subsequent generation of young pacific islanders Going on to be historically profiled by australia's police as well as ageing immigrants mainly based on assumptions and stereotypes Derived from the criminal gangs that had come overseas to australia So growing up as a young islander in australia much like marginalized groups in the u.s Or the uk that would make you a target for police brutality with members of 1-4 Even recounting being beaten black and blue by the cops as early as age 14 In fact the underrepresentation of pacific islanders in ozzy media plays a big part in making ozzy drill So exciting because until the ozzy drillers made it cool these young men from these unique backgrounds Were extremely underrepresented in ozzy media You know unless you count the brown face wearing character from summer heights high jona from tonga cringe Anywho much like we've seen in the hoods of chicago, london and new york all around the world at a certain point These underrepresented gangsters from the hood managed to come up with a cohesive group identity And once we saw people coming out of these situations getting good at rapping We began to see ozzy gang and street culture flourish getting a voice through music and from observing chicago gave everybody a voice to be heard with the drill The likes of 1-4 and 21 district even us uk drillers have been delighted to learn some of the colorful slang of these scenes It's not just the style it's the the personnel When you heard chicago drilling you heard some people that you heard Before that you would think you'd never hear this person Hey, how he rapping like We're like that alone let you know like oh, yeah, let me go. Let me go try These savages I mean some of the best exports from australia these days are delightful insults for your arps like the word gronk around here A real filthy word to call your enemies like dogs and gronks, you know You've also got the phrase lads which unlike in england where it tends to mean obnoxious university sports team wanker in ozzy street culture lads or Eshays formally refers to a persecuted Australian lad hailing from the hood Most likely to be seen wearing sportswear being working class and potentially up to no good This is more akin to a chav in the uk or perhaps at a stretch what the americans might call trailer trash and of course you've got who Urchers which is essentially a lad who is out to make money illegally or by any means necessary Hell we all know what wait a minute trap wait It feels like just to be a young lad trying to urch a little money doesn't matter where you're from in the world So lads, let's take a look see some of the little urchers who are making a few ozzy I don't feel like a lad is equivalent To a trailer trash. Well, I don't think that's the equivalent In my personal I'm from I'm from I'm here NF14 is a coalition of ozzy street gangs based in sydney's greater west with a particular presence in mount druid Also known as mounty or mounty county with the collection of numerous street crews coming from this area Sometimes being referred to as the mounty county coalition What makes us a dual group is that we actually do what we rap about And through its home, you know, it's a big place It's the trenches and it's worth pointing out as it's often the case with these stories Mounty county is indeed the suburb of sydney with the highest amount of gun crime But it's from this collection of street lads rep in NF14 that spawned the groundbreaking ozzy drill NF14 Ozzy rappers were already kind of doing bits in their native country in the 2000s in the form of lab rap It seems plainly obvious that over the past few years mainly out of sheer high quality music and frequent output That one four have frankly managed to become the most significant and successful rapper But I haven't heard from one four since like in a minute Like it's been like three four years since I heard the song from them Based movement to ever come out of Australia The main members of one four include jms lex yp spenny and selly And because one four are from mount druett or mounty county, which is in a 27 postcode They're known to frequently throw up and shout out the 27 number Well, I drew it spain spany and it's sticking us there Numerous lyrics from one four suggesting they're down to rise for that two double seven Oh from 2017 one four burst onto the scene with their track ready for war Heavily inspired by call me a Spartan by the Harlem Spartans That was followed up by the track what you know, which featured a gang of ozzy lads that were so menacing I nearly did the dash from my computer screen just watching it. Hey when you trap stop trolling drill this hard Ain't no one going to tell you how to use it So since they burst onto the scene and introduced their native country to the booming hard sounds of the uk and new york drill One four have essentially taken over and become the pioneers of the entire ozzy drill movement Again with a lot of their appeal essentially deriving from the fact They were the first crew of pacific islanders to rap proudly about their lives in their native ozzy accents And i've got to say there's just something about here in that ozzy accent over a hard uk drill beat that just sounds so cold But it wasn't just their music that was pioneering because they were also using their music videos to introduce the ozzy public To their slick street fashion style too with a lot of their music videos around this time Essentially looking like adverts for the footlocker prison wrench So with all of these lads out here rocking more menacing sportswear than a sports direct jumble sale One four with their unique sound and s.a fashion style that hadn't been seen by this white people don't be liking you try I think you funny because I understand Social media, but I don't people be thinking you'd be poking fun at them and that'd be taking that lightly but Hey, you know, I'm sure you move everywhere with security The streets before one four quickly became the coolest thing going proving to other disadvantaged young men from the same areas But there is indeed another way to make it out of these streets So from here one four's sound continued to progress And they would go on to drop other big releases like the track shanks and shibs a song and video Which was hailed by many as potentially the first glimpse that the public had truly gotten of real life for lads on the streets of the Greater west the first track they put out the shanks and shibs No one had seen anything like that In australia no one had seen young islanders or young ethnics in general represent Their experience of the straight and shanks and shibs 100% before I even did a Before I found out about one four before I did anything australian I was completely oblivious to any crime in australia. I thought y'all was known for steve erwin the outback huntman spiders kangaroos um That honestly that's it 100% like I didn't know there was no type of activity out there Like I I wasn't the same category as hawaii Like we didn't think there was no activity in hawaii either, but apparently there is I mean like that's ignorant for us to think but like Followed by even more bangers like the message spot the difference and lads in the hood And at a certain point one four's unique style of posse accented drilling would capture the attention of drill and rap Reaction channels all over the world setting them up nicely for viral success. I never knew no I didn't know that existed Did he not beef him? Eventually off the back of all of this energy one four would bang themselves some mainstream success with the song in the beginning Getting one million views on youtube in the first 48 hours and going number 39 on the ozzy charts And from here they were on a roll dropping numerous follow-up songs Which would hit the charts like welcome to prison say it again with big asap asap Burg their emotional love letter to mountie county home and away and the more pop leaning radio hit my city featuring fellow rap in ozzy 2020 was the last time I heard them That's four years ago 2020 was four years ago You twink the kid loroy basically you'd be lying if you said that one four didn't sing been Simmons. Is that been Simmons? That's been Simmons in my tree and idly put drilling at the forefront of ozzy music and rap culture But of course when you're creating a successful scene like this completely from scratch It doesn't take long for other people to see what's going on and try and get in on your trap And while their musical legacy is much less well established than one fours It would be a travesty to overlook the musical development of their most hated ops the inner west 21 district 21 district refers to both a coalition of street gangs. I was just talking to my brother about this man Hey, listen if you make it in the rap game You're almost doing your apps of justice by speaking on them in raps Because if they also rap what is that? What are the what is the general consumer gonna do? Man, who is he talking about? Let me go see it. Let me go listen And if they actually good You just put them on In the inner west of sydney as well as an ozzy drill music group made up of members coming out of these areas Their name actually comes from post codes in sydney that start with 21 including gilford 2161 Which was actually home of the first kfc in australia. Thanks wikipedia marylands 2160 blacktown 2148 smithfield 2164 and cabramatta 2166 sometimes this coalition of street crews is referred to as the inner west brotherhood Furthermore subgroups exist as part of this coalition such as g 40 hailing from gilford 2161 In fact g 40 has actually even been shouted out in 21 districts music And it's also worth mentioning that as part of the inner west coalition other groups like 3t exist Who have apparently even been rapping all the way back to the 2000s and would even be out here making Dis tracks to their greater west ops in 2010 before the ozzy drill movement took off and one four became the big dogs in the game The reality is that the rise of 21 district the rapping crew is intrinsically linked to one four's rise Because 21 districts break out track the reply is itself a direct response to one four's See i'm saying see see see Even put them on Track the message which actually included a dis referring to a murdered 21 district member In fact the feud between these two crews and their related coalition of gangs Permiates the music on both sides with numerous lyrics from 21 districts the reply referring to riding out on the ops And the same can be said for 21 districts second biggest track still here Featuring numerous references to attempting to drill it on the other side to be fair 21 districts rap unit haven't quite reached the level of success that one four have pioneering the sound But they've certainly shown a great deal of promise and deserve a lot of respect the star members of 21 districts Rapping crew in close man 11 rongotty j lex a1 and malik So now you know the crews the music they make and the sides they rap Now we can take a closer look at some of the wild incidents that have gone down on the streets of sydney between these two warring groups of lads Searching for a new home Just like you see with the gangs of chicago in london often the origins of these deadly gang feuds are as simple as Teenage schoolyard scraps which unfortunately as members get older escalate into shootings and stabbings as made clear by jms from 1 4 Clearly tit for tat violence has been going on in sydney's inner and greater west for decades So we can't necessarily trace back every single incident that's gone on between these two groups of lads But what we can do is take a closer look at some specific high profile incidents That have made significant contributions to the beef and the music between 21 district and 1 4 An early one was a 2011 incident at a westfield shopping center where apparently members from inner west's g 40 had planned a 100 man deep fight with their ops b y o w bring your own weapons Now this skirmish was being arranged on facebook of all places and it's no surprise then that eventually the cops caught wind of it And we're able to arrive at the scene just after things had kicked off Arresting 13 people at the scene and recovering numerous homemade weapons and baseball bats police have warned They'll be making dozens more arrests after a mass brawl at a shopping center in sydney's west Now all they got to do is go back to follow the digital fingerprint And catch everybody two gangs armed with homemade weapons stormed westfield's mount druid shopping center last night After pre-arranging the fight on facebook fighting broke out at the mount druid station after one group got off a train And were met by the other all the pacific island origin before long a wild melee involving up to a hundred Not gonna lie It's reminded me of hooliganism when he said hopped off the train and a melee ensued like that's like Spilled through the doors of the westfield shopping center 13 arrested including four juveniles police expect to make more arrests At a certain point these organized brawls escalated to stabbings and shootings in april 2012 Five drive-by shootings were reported in sydney in a 48 hour space With these taking place around north mead in the greater west with the audio from the news report of those drive-by shootings being used Many years later as the intro for 21 district tracks are reply. Now sydney police say That's top-level Negativity by 21 drive-by shootings in the city overnight our reporter jason omp joins us from north mead in the city's west So five shootings within four and a half hours Yet, you know, just the spade of shootings just don't seem to be ending from here Things were not sweet in the years that followed people have been found beaten to death in mount druid as early as 2015 With it having been suggested on social media that the man killed was indeed nf 14 with the killer fleeing and getting the train to black town No camp Yeah, i'll be double oh seven in these comments. I know everything if I look at the comments 48 young man has been murdered in city's west overnight His body was found sprawled on a footpath at mount druid shortly after midnight very large crime scene Detectives say that they believe the killer and maybe others involved boarded a train at mount druid police police station Or mount druid train station rather boarded A train to black town and that is where they arrested an 18 year old man at around 2 30 this morning and the beef between these two sets eventually did make its way to music far before ozzy drill had developed its Sound there's examples in 2016 with rappers from nf 14 dissing the inner west wrapping over the beat to mob deep shook ones And over on the inner west side You've got the likes of 3t dropping this is on the great west too So while these mini music beats were occurring This was the same year that the police were investigating a savage beating in mount druid Where a 17 year old was beaten unconscious by a gang of armed thugs an incident Which like many of the ones i'm about to discuss was spectacularly caught on camera But it's far too violent to show you without getting demonetized You're gonna have to do your homework if you want to see that grizzly shit Anywho at this point the cops begun to single out the gangs in mount druid has been completely out of control Suggesting frequent shootings in the area as well as fistfights that were being uploaded to youtube Were contributing to a spike of gang activity in the area meanwhile by 2018 One four were beginning to make waves in music for the first time in ozzy drill providing a template of a legal Root through music away from the streets However, these g's taking music seriously did not stop the bloodshed on the streets as this feud would soon turn into a very public tragedy When in 2018 we saw the murder of 20 year old tino henry allegedly from the inner west with ties to 21 district 20 year old tino henry had the world at his feet But in the early hours of this morning his promising young life ended abruptly In this alleyway off Fitzsimmons street in paramatta. He was fatally That's crazy. Like I just listened to y'all. I mean the australian news reporter She bigged him up real nice the world at his feet. Like I like that like in america They would have been 21 year old suspected gang member That's what they would have said no doubt 100 hold on Stabbed in the chest This incident sparked a wave of violence between the groups which was only inflamed further by one four going on to drop lyrics Directly disrespecting their fall and up naturally all of this and the incidents that followed would provoke a strong response from the police of sydney But what couldn't be predicted is just how hard they would come at these groups Ultimately taking several of their key members off the streets with hard sentences as well as attacking their legitimate business of making money through music You can turn any slogan One four just off the cusp of mainstream industry success in music would unfortunately end up losing several members over a 2018 fight in july months before the deadly stabbing of tino henry a huge brawl took place at rooty hill gaming lounge carousel in This involved lex from one four who had allegedly been kicked out of the lounge over a drunken row over a machine Now in what little defense I can offer to lex It had been reported that racial slurs had been thrown during this argument But who knows what really went down whatever was said was clearly no good and retaliation was a must With lex coming back with yp and selly from one four armed with weapons at this point the last so lex yp and selly Proceeded to give a savage beatdown to several people in the lounge all of which was caught Extensively on camera another shocking scene that I sadly cannot show you on youtube But essentially lex beat a man to the ground grabbing him by the hair and taunting him to his face Yp was identified as having smashed a chair leg into the back of an ops head And selly was said to have pounded a man's head repeatedly with a hammer This vicious attack apparently leaving one of the victims unable to feel part of their face One four gave these guys the little waning jewel's treatment for god's sake with all this caught on camera It's no surprise that these lads ended up in court sharpish without a chair leg to stand on or swing at the judge's head 27 for life The end Lex ultimately got slapped with four and a half years for instigating the fight Yp got four years for swinging the chair leg and I assume also leaving a very unsafe Three-legged chair out there for one of his ops to sit down and fall off of But it was selly who got the worst of it for wiling out with that hammer with the judge dishing out a hefty 10 years 10 years This is a 2018 lake frito Bro probably did they both probably did two years. He probably did five. They're free. They all should be free This was a devastating blow to one four as a cohesive group as well as their business Meaning that star members appearances on songs would be limited to jailhouse phone calls like we saw at the start of the track Welcome to prison And just like we saw around the violent summer of 2018 in uk drill All of the goings on in the street would lead to huge scrutiny by the police who would quickly crack down on both the illegal violence And the legitimate music business in 2019 one four begun to have their shows cancelled by the police With it being claimed that the cops were pressuring venues not to host these ozzie drillers One four has suggested that the cops were really just trying to shut down their only route to making illegal money Shoot, they actually did because I ain't hearing nothing from y'all in a minute. We're on the worldwide tip y'all probably still doing some like In australia type movement, but I could be wrong and over on the 21 district side They were seeing similar problems and despite trying to make it clear with public statements saying that they're not criminals And that the racking crew is no longer a crime that hasn't stopped the police from shutting down their shows and video shoots Two as they explained in this statement But while the cops were shutting down their legitimate businesses since the killing of tino skirmishes were continuing in the streets Another incident popped off where there were numerous drive-by shootings in a 48 hour period with speculation that the homes of rival members were targeted Within only a month of these shootings 21 district had released their song the reply Clapping back at one for who had dissed fallen tino on their track the message starting that song off with audio from the news report About the 2012 shooting situation, which was very similar which may suggest that these are all somehow linked So clearly the beef was publicly active well into 2019 But we would see the likes of spenny from one four lurking in the ops turf of gilford on snapchat They're all gone missing now 21 district you pussies Fuck the shawty man here. I was there for 30 minutes. He didn't even come Eventually members would come face to face leading to another mini fight outside the westfield parameter in june 2019 Where knives were pulled out in front of shocked members of the public But thankfully the groups disbanded before things got serious in the middle of a busy intersection outside westfield parameter yesterday Men fight on as a crowd gathered before some of the men retreated to their car Another man smashes the vehicle as it rices around the corner I don't even understand why one for you one for you let 21 district. No offense. Like they're both talented apparently but like like You let 21 district drag you back down into some beef when you are highly elevated above them at the time That's what I be telling people man the streets be calling the streets calling be too hard They'd be too hard. It'd be too hard Like they to have songs with big artists And now they've gone back beefing with these Why would you beef with them? They're not even on it. If you're not on the same money level as me As they this is a big today be they thought process If you're not getting as much money as me, I can't beef with you because you have you don't have as much to lose You got nothing to lose. I got everything to lose It's not even fair. Y'all can't even Apparently members from these groups would run into each other again Later one evening at hookah lounge in another spectacular fight where an insane amount needed to show they were still involved. Listen That's the thing. That's what they don't understand You could be involved But the goal is to be not it's the the goal is to get out, right? Once you've gotten out, I don't want to prove that I'm still involved Make your assumptions Hey, make this album. I'm a musician at this point, you know, I'm saying I'm getting too much money to be playing with these streets You feel me? Y'all have it Some of objects and projectiles were thrown Detectives are investigating if the same men involved in the paramatter incident Were behind another fight at Auburn last night Then the following month another big gang fight spilled into the streets of sydney in july Along with a clip shared by 21 members with the suggestion that one four are quick to pull out knives in fights An apparent reference to the previous incident where a blade was pulled out at the westfield fight at this point There are crews brawling publicly on the streets of sydney nearly every week and gang culture was permeating mainstream culture so much But the new south wales police had to warn the national rugby league to stop players throwing up gang signs on the pitch But if it was bad enough losing rapping members of one four to prison when they could have been making legal money on the streets It looked like the police were going hard at targeting the non-rapping street teams of the greater west gangsters with a very public arrest in 2019 of a supposedly high-ranking street figure with this marking the beginning of a big crackdown on ozzy street crews With the cops calling in raptor 13 the raptor squad or strike force raptor A squad of hardened sydney cops famous for busting biker gangs raptor squad is a bit of an unnecessarily menacing name Isn't it like trying to catch some gangsters not an army of pterodactyls? Anyway, the raptors vowed to shut down sydney's drill crews and make every aspect of their lives uncomfortable They directly claimed responsibility for cancer. All right, that's really what they said Hold on in that in that seat. He said straight hands. No knives like one for Somebody in the comments said well, you just said your ops never lack hey Ain't nothing wrong with never lacking. I do not perpetuate or Um condone any of that I'm just saying that's what the article said y'all just Y'all just patted y'all ops on the back like yeah my ops don't never like that's tough Brillo shows and their sergeant said that they had planned to use more serious crime prevention orders Usually reserved for biker gangs or terry wrists to shut down one force activities Thankfully today one four is still going strong having recently dropped there against all odds e.p Which was fire despite being essentially banned from performing with the cops completely shutting down Meanwhile on the other side 21 district have been less musically active But off the strength of their early tracks I've got absolutely no doubt that with a bit of effort and backing they could be on top musically too if they Wanted to meanwhile things are still going they could though like how's the rap scene in australia currently? I guess it's fairly easy for somebody to jump in there probably and take over With a little bit of backing and a little bit of cred and With a little bit of ability and you know Hang on on the streets in july 2020 the news were reporting on a hammer attack linked to gangs from the inner west Where rival members were forced on camera by members from the inner west to throw up 21 gang signs and kiss their feet Look the thing that made people love osi drill really is the music not the antics or the violence A lot of people have loved one force music without even understanding the true context of what these guys 100% He's right. They've gone through so I really hope that going forward We hear a lot more music from both sides and less activity in the street There's a lot of overlap between the osi and the uk drill movements And if there's anything to learn from what we've got going on here It's that eventually with enough mainstream success you can get the cops off your back stack that legal money And get far away from the tough environment that made you I hope that happens because I love one four and 21 districts music and I want to see them both flourish Hope you enjoyed learning more about the background of osi drill music. I certainly enjoyed listening I enjoyed the trap I enjoyed it. You kept me entertained man. Tell her leave a like comment subscribe to me boss. Don't go


anybody for abusing bleeding edge web standards for app site glory we got Bryant Zadigan and Ryan Lester please give him a big hand. Alright so everyone please take a moment and visit our website. I know it looks scary but trust me it's a part of the hands-on component of our session. So actually hold on for a second Ryan why did you go with this site? The internet was all out of domains I swear this was the last one they had. So um in the something that we noticed in the course of setting this up um if you're using an android phone actually if you're using any phone at all congratulations and on your bravery uh we applaud you um but if you're using an android phone uh with the configuration on this domain for whatever reason um you might get an assert error so all other phones seem not to have a problem with it so there you go. In case you decide not to take the risk this is what you'll see. So moving on. That was much better reception than black hat they didn't get the joke at all. Um anyway so welcome to abusing bleeding edge web standards for app site glory uh my name is Bryant uh and and that's Ryan and we're not used to right we're not used to these mics we're still adjusting from lapel mics. If you didn't hear I'm Ryan. So just some background on me uh I do a lot of app sec related stuff uh I mentor security startups sometimes uh I also mentor others mentor and air quotes others on application security on occasion. Once upon a time I paid a friend a dollar to make Steve Ballmer dance on stage but just once. And I'm uh the CEO of an end to end encrypted communication startup called Scythe uh which is actually the origin of a lot of the research that went into this talk. I'm also more or less the chief architect and primary developer of Scythe uh before Scythe I was a software engineer at a rocket factory called SpaceX and at one point I was sued by Napster for alleged trademark infringement. Are you allowed to talk about that? Uh not in detail no. Okay um okay we'll just leave it at that then. Fair enough. So in talking about bleeding edge web standards I wanna kinda clarify some of like one of the key words here. You'll notice the first word in the title of the talk is abusing. Most people hear the word abusing and they assume hacking in a very like breakery way. But we're speaking not just in terms of hacking and like classical hacking that you and I might be used to but also hacking from like a developer standpoint. So coming up with novel solutions to problems that you know are completely unanticipated and what have you. So very much like developer hacking, dev hacking um as well as classical hacking that many breakers in this room might be used to. So we're going to focus on three web standards that you guys hopefully know about but I'll do like a show of hands as we're going along uh just to see how we are. Um let's see. So first of all we've got sub resource integrity. So a quick show of hands as to who in the room who's familiar with browser side standards might know what SRI is. Not bad. Uh so we're gonna talk about specifically something that we're calling SRI fallback. Uh you can probably anticipate what that means. Uh we'll go through it as we're walking through it. So we're also gonna touch on content security policy. Uh show of hands. Ah nice. Okay that's good. So we're gonna talk about something that we're calling CSP meta hardening here. So we're not really gonna teach anybody what content security policy is. Uh but we will talk about how you can use it in some edge cases that a number of startups might be encountering things like that. And this last one is probably going to be about a half of the talk. Um so we're focusing on HTTP public key pinning. Show of hands. Awesome. Now the thing that we're gonna focus on here is something that we're calling HPKP suicide. So why? Now here's the thing. Uh new standards of being drafted left and right. And if anybody's been keeping track of the creation of of web standards like browser side standards things like that. You'll notice that the pace has kind of seen a bit of an uptick. Uh there are quite a few standards that most people don't actually know about. Uh has anybody heard of CAA? There's like three hands. In the whole room. For a live standard in production that's currently being widely used. Okay. So now that we've established that. Um it's not just the standards that are being created at a rapid pace that are creating unforeseen complications. Uh it's also that the implementations which are you know happening rapidly. Uh these implementations because of the pace at which they're being developed can be a bit screwy. So when you start messing around with standards and especially obscure specs in said standards obscure use cases. Uh you can probably find extremely novel ways of using these standards or extremely novel ways of breaking them. I mean in the course of this talk Ryan and I found we we hit what two bounties on on chrome just completely by accident. We didn't create a fuzzer or anything. We just scored a quick twenty five hundred bucks just in the course of making this talk. So kind of diving into SRI. Now we're actually going to get into the meat of it. Um a lot of this stuff should actually be pretty easy to use. It's once we get to HPKP that things become a bit risky for everybody. So. Sure. Uh yeah so SRI sub resource integrity. It's one of the standards Brian was just discussing. Uh it's just a way for you to assure the integrity of resources hosted outside of your zone of trust. Uh in the example here we've got jQuery gloated from their CDN. Uh we would also be using a fallback source if uh the spec actually provided something like that. So they they mention the possibility and kind of give general guidance on how you might implement it yourself but they don't give you direct way that you can just use it out of the box. So we decided to implement it for you. We have a script called fallback SRC. Uh that's what we call it right. Um anyway fallback uh source script. You just add this X SRI fallback attribute to any of your scripts or style sheets. And in the event that the primary source fails to validate the uh the new one will be injected and validated against the same hashes. So we've got a. Sorry? I think we're actually skipping this demo. Are we? Oh yeah yeah we're skipping this one for the sake of time but it's there if you want to see it. And that's the source code. So we'll also have at the very end on the very last slide we're going to have one link that aggregates all the links that we're going to put on screen today. So if you don't want to have to worry about catching the pictures in time don't worry about it wait until the last slide take a picture of that and you'll get everything. So but while we're here we will just very quickly show about the quick two grand that we knocked off of chrome uh when we were in the midst of creating the talk. And uh so yeah I mean I mentioned very early on that you can actually in the course of testing novel web standards that were just introduced uh or like very recently introduced or what have you maybe there wasn't enough time for testing whichever. Uh you can in the course of testing them out uh very quickly score some quick and easy cash and the one we're going to talk about here is a case where if somebody um manages to hack around with SRI in a same origin use case um in an older version of chrome you actually could have gotten a script to run the second time around and I'll let Brian kind of take on the prescripted demo. Sure uh so like Brian said we found this by accident this was supposed to be the demo that we were going to use uh for an early version of this talk uh just demoing SRI. By by the way um for people that think we can't read it we're actually going to zoom in on the key parts as we go through. Right. Uh so we've got uh just two buttons here one that injects a script with a valid hash one that does invalid. Clicking the invalid hash uh you can see there's an SRI error there as expected so loading the script failed. Then you click the button a second time and it works when it shouldn't. So let's see that one if you wanted a quick use case for how you could have exploited that flaw well if you happen to actually compromise a site especially one that has like infinite page loads and it would be constantly reloading the same script or maybe like the same XSS payload that would be one potential area where you could exploit that. So Google ended up marking that one as a high and giving a quick two thousand dollar payout. So now that one having been discussed we've talked about SRI we've kind of showed off the script and how you can implement a fallback in the event that you want to have some way of loading backup content in the event that your main tr- your main resource that you're loading off site can't load. Now that we've talked about that let's move on to CSP and how you can combine some interesting properties in CSP to do novel things. So we've got something that we're calling CSP meta hardening. Um what this is is you're combining a semi-strict header. What this means is that it's a header that's it doesn't have all the rules you want defined but it has like it has a lot of leeway for you to do things that might otherwise be considered dangerous.  Uh that being said this trick that we're gonna show because it relies on meta headers there are some verbs that don't work uh frame ancestors report URI or sandbox they they won't work in meta headers. There are others as well um but we'll get into them in a bit. We do I believe uh have yeah we do have a demo for this also prescripted but again if you visit the URLs you can see these demos in practice and see how they actually work just right click dev tools um and actually watch uh watch how it works in the console watch what elements are introduced things like that. So and I'll let Ryan take this one on. Uh so it's the same general format as the UI of the previous demo we've got three buttons here and it shows the current content security policy. So running inline code should work because we have unsafe inline and you can see it did. Non inline code or code from the current origin that also works. And then we have a third button to harden CSP via meta element. So when you click that it actually injects into the DOM uh an HTTP equivalent meta header with uh more restricted CSP. So you can see now unsafe inline is no longer in the CSP. And now running uh inline code will generate a CSP error. And we'll get into some considerations as well but we're gonna talk about the we'll get into some considerations as you're setting this up for your own sites um and we'll also talk about potential use cases. But first of all if you want to use this um if you want to actually use this for your own sites let's say you've got let's say you've put in a lot of development effort into like an MVP you're like typical Silicon Valley shop you've put in a lot of development effort and security maybe wasn't at the front of your mind um and you want to implement this well let's say you're doing your typical like single page app um these are some considerations to make this work perfectly otherwise there are some attacks that could work against this that would defeat your entire use of CSP in the first place. Uh so when we say static content only that means that if the initial response if everybody in this room I hope is familiar with reflected XSS if your initial response from the web server actually contains reflected content from the user in the initial request then you're going to have that content execute during your relaxed content security policies which defeats the point um there is another potential attack we can go through after the talk just for the sake of time um we'll say blindly trust us when we say include this header uh in your in your headers that you're sending to the browser uh the XSS protection uh blocking mode you definitely want this because there are some novel attacks that would work if you don't include this but implement meta hardening in the first place. So in terms of use cases so I mentioned that if you have a semi like let's say a semi recent application you put a lot of time into implementing this and you haven't really taken security into account. Well if you think about your typical really complex single page applications I mean anything I think what the like Google apps I'm just winging at this point based on the UIs but any application that does a lot of pre loading of content like angular based apps things of this sort um this is where this can work really well for you but that being said it should be used as a stop gap towards getting full CSP on your site uh reason being so long as you have relaxed CSP headers you run the risk of anybody being able to get content that you haven't authorized to execute before you harden your headers with the meta tags. So this is the idea your application static content loads first and in loading first while you have the relaxed headers it's all the content that you trust your application does it does all of its pre loading into the DOM and it gets set. Um once it's done being set up at that point you then inject the meta headers into the DOM and then the browser takes up those rules hardens your content security policy and then you can start taking dynamic content from be it other web servers or what have you. Uh you can only do this one way you can't relax headers you cannot relax policies this way you can only strengthen them so you cannot introduce meta headers that then relax content security policy down the road. So now we get to like the meat of the talk this is actually where all the cool stuff happens so anybody that's looking for really breakery stuff we've got a good chunk of stuff at the end that might excite some of you. So let's talk about HPKP. So for those of you that might not be familiar with HPKP uh we have it color coded in red because if you do it wrong you will break your site and you will break your site for up to 60 days uh for for users that are using your site assuming you actually set it up incorrectly uh so we have a sample header set here like a sample uh pin set here for you uh where if you were to implement HPKP uh it would be in report only it wouldn't it wouldn't break anything if if you end up doing it wrong and and it'll have the max age configured perfectly you just need to replace the the keys for your hashes uh well the the hashes for your keys uh with the actual hashes for the keys that you're serving up. My recommendation is if you implement this you want to serve up all the hashes for all the keys you're using across all domains and subdomains that's what the include subdomains uh keyword is there for as well. This is probably the safest way to get started and then once you've had it in place for a while then you can drop off the report only uh and and it's essentially like hard mode so if something goes wrong at that point then that's when people get locked out. So when we talk about HPKP suicide well what do we mean? So here's the thing in a nutshell you're deliberately self-bricking your users. That's what we're talking about here. In the spec itself nobody's ever actually considered the possibility of deliberately breaking your users to enable new functionality and that's what we're going to talk about over the next what 20ish minutes. So we've got some ideas uh there's the possibility of enabling in browser code signing but we'll explain why we scratch this out in a moment. We'll also follow that up with a solution that works almost as well uh by controlling content changes and also hardening SRI. We'll also talk about nuanced web content blocking so if you're familiar with your typical web content gateways like your nanny filters things like that that'd be in like high schools or or corporations that like you know making sure that you don't have malware end up on your clients there are ways that HPKP can be used to further that work and the black hat audience was very very receptive of this it was really interesting I'm pretty sure half of this room will probably hate that. You can also use this to track users this can probably scare you and we'll also talk about how you can use this to be total jerks in ways that we shouldn't really put in print. And before we continue I wanted to give a shout out to Jan Horne at cure 53 uh he was actually the one who put us onto this idea during the course of an audit of Scythe uh last year and did she start as well actually before let's encrypt existed to make this idea easier to implement uh worked with us on making it possible in in Scythe. Uh so here we've got an HPKP suicide based local content pinning scheme uh which intentionally self-bricks your own website to pin an app cache or service worker uh persistently in the browser with the same level of security guarantee that HPKP provides. Uh so first the user is just visiting your website like normal and it's setting an app cache or a service worker then on the back end the server is actually deleting its own TLS private key generating an entirely new key pair and uh requesting a new certificate from the from its CA and then of course changing the HPKP headers to compensate for that. And then the next time the user hits that site uh the TLS handshake will fail and it will be to the browser as though the site the server is literally offline push uh forcing it to fall back on the the cache service worker. So let me put that in human terms. If because this is perfectly understandable for anybody that's familiar with sequence with actual sequence diagrams right? But the basic idea here is this. You're using HPKP suicide to deny your end users access back to the web server after they've already cached some sort of document from that server. And in denying access back to the web server on future visits it's the document that you cached that's then loaded because every subsequent connection back to the web server has to kind of go through that service worker first because that's it's it's been stored in the browser right? So it goes through that service worker first which can then handle the error in the event that the connection fails. But in this case the service worker is deliberately anticipating the connection to fail because the keys will mismatch and therefore that's where you can embed the extra logic for how to for how your application actually wants to run such as loading resources from other sub domains that haven't been pinned within the actual service worker itself. That's the key here and that's how this that's essentially how this entire scheme works and it's enabled by the fact that you're rotating the keys on a very rapid cadence that way you're actually deliberately locking people out as time goes on. So we've actually got a really novel use case here and Ryan's going to talk about it. Yeah so we in the slide earlier you saw we had code signing as a possible application of this crossed out. So I mean why not? In theory you could use this local content pinning scheme to pin your code signing logic. Did it just skip the whole slide?  Go for it. Alright sorry. So yeah in theory that should work more or less getting you trust on first use and so why in theory it sounds like it should work. In fact SIFE employs a mature audited implementation of exactly this that we call WebSign. However it was considered novel enough that we were advised to apply for a patent on it. Purely defensively but no one else can do it now. But you can come pretty close to the benefits of code signing by following the scheme Brian is about to describe. Right so you'll probably get to about 85 ish percent effectiveness of what like the code signing scheme that Ryan just talked about. If you combine HPKP with sub resource integrity and the basic thinking here is this. In that service worker that you've got that you pin in the browser every reference to every other resource on other domains is going to have your integrity checks through SRI right. Now in order to make this work since you're locking users away from accessing the content what you need to do is you need to have the max age the actual counter that says how long this header is valid for dynamically count down to whenever you routinely deploy a new application into production. So let's say you deploy a new app like a new version into prod let's say Sunday at four twenty p.m. right. In that case what you're going to have is you have the actual max age counting down to that date. And every time a person visits the max age is going to be different for all of them but that being said it doesn't make a difference when they're mad when their HPKP headers expire they pull down any new content any new hashes for scripts that are off site things of that sort. And as a result because the other scripts are being checked against the hashes that you've stored you're still I mean it's not really the same as code signing but it gets you pretty close and the reasoning here is that they no attacker can replace the initial content the initial service worker that you've pinned in the browser. They can't replace that because when the browser then tries to connect again to the site it's the connection is going to bomb out. Now of course the only way this will work is if you're rotating the keys let's say once every what is the cadence on let's encrypt like twenty times a week that's like once every eight ish hours maybe. 8.4 hours something like that. So you're re keying once every 8.4 ish hours and that means if a user visits within the first eight like visits and then visits again like nine hours later that connection bombs out that content that they that was pinned the service worker can then never be updated until those headers expire. Now what are you looking at in terms of benefits you're retaining control of front end content between releases right so that means that in the event that let's say your your main web server gets your content servers get compromised be it the ones that have the SRI protected content or the ones serving that initial page the service worker it doesn't matter because the people that are visiting your site will have already pinned the content locally and this also means that you're mitigating the risk of somebody like you know tampering hashes as a part of a much broader attack against your content that that might rely on resources that might have also been compromised in domains that you don't control. So you get some pretty decent security and performance gains but there's a catch. HPKP suicide and SRI it's a bit of a design time decision this isn't as far as we can tell going to work with anything other than a single page app single page app of course like I mentioned earlier being the kind of app that loads everything up front and then dynamically loads everything through web service calls. Here's the thing you also need to include mitigations like halting the distribution of HPKP headers if your site's compromised. Well why because if your site gets popped then now you're serving and pinning malicious content into your into your users browsers so you need to be careful about making sure that your content if you see evidence of tampering isn't actually going to serve back the HPKP headers that pin that content in your browser in your users browsers. So time permitting will actually go ahead and check out a demo on a site what Redskins.io we're both from DC that's kind of the kind of the gag there. Yeah it's not completely random there is actually some some sort of an inside joke there. Now we'll take this one a bit further. Let's say that you've got a web content gateway like blue coat right I love picking on blue coat because I've only ever had to deal with them. So here's what they can do they can actually look any web content gateway that implements HPKP because they're already intercepting connections like they've okay they've got SSL man in the middle like TLS man in the middle they're already seeing all your traffic your your your banking transactions your mail whatever right as part of the design. They can actually lock users out of malicious sites or flagged sites or porn sites or whatever even when they're not even when your users are not on the network like let's say they're using a corporate laptop they try visiting I don't know what's a good x hamster.com short and the and blue coat says oh wait a second this is obviously a porn site we're going to keep you from visiting this well here's the thing for that flag domain it sets the HPKP header for the blue coat cert right think about this for a second it's the blue coat cert it's not going to be available on the public internet but that cert was just pinned for that site so now you take your corporate laptop off of the corporate network and you still can't visit the site now if you're a technical user you can of course blow those pins away but you know I don't think your average accountant really knows how to do that so now optionally if for whatever reason you can't afford blue coat like multiple instances for your own network okay you can rotate the keys weekly at the gateway as well but I figure if you are considering using blue coat you can afford the licensing fees for them so hopefully by us disclosing it this makes it prior art which means that nobody can actually patent this and make filthy money off of it so wait a second so apparently blue coat is now an intermediate certificate authority so we don't actually know how relevant this is to any part of our talk it might not be because a cert path is actually zero but you know do with that knowledge what you will we're kind of hoping somebody can go break around and see what they can do so oh this one's fun this one's fun okay user tracking so we shouldn't really talk about this but you know since this is def con let's track users so here's what we need this is by the way a very buildery talk but because it's kind of sort of tiptoeing on like the edges of ethics we'll call it breakery as well so you need to pin a lot of subdomains we're talking like 32 subdomains that number probably sounds it makes sense if you think about it you also need browsers that pin well that hand that respect HPKP incognito and finally you need that ability to do rapid key rotation to rekey on a routine cadence because you need to be able to lock users out right so actually I gotta go back for a second so we actually need to thank let's encrypt for this and again we love I there might actually be some let's encrypt guys in the room so come on clap let's encrypt is in true has introduced a lot of not like just by automating everything they've allowed us to do a lot of novel things we might have some amount of issue with some of the things we've been able to achieve but at the same time we understand and love the vision for spreading TLS all over the open web so in this case let's encrypt really helped out just by virtue of the fact that you can rekey on a very rapid basis and because it's free and because it's automated and very very easy so I'll let Ryan kind of talk about some of the configuration stuff it's not really going to make all that much sense until you see Ryan's demo right so this will be this explanation will be a little hand wavy and that's by design it'll make a lot of sense when you see the demo so on your server you've got an HPKP server with all of your sub domains start up whatever domain pointing at the same server you've got a set method that returns an HPKP header and the check method that does nothing it's a nil op and you're just routinely rotating your keys on that server then on your job script to set a new ID you're just hitting those sub domains in a random pattern hitting set on them and to check the ID you're iterating through all of them and hitting the check method on all of them so in principle it's pretty similar to the HSTS super cookie that I think Sammy Kamkar came up with okay hopefully don't quote me on that so we've got a demo a super cookie server set up at scythe.wing and went through a quick demo sorry quick demo here in our JS console in Google so Google did not implement this we pasted in our JavaScript into their console so you just run the super cookie JS right there and it'll here you can see it generated a new ID it's just a just a random 32 bit integer four five six five five six six and now we're trying again in an incognito window on a totally different site and in this case you can see a bunch of failed TLS handshakes from those 8 from those HPKP suicides and it reconstructed the exact same ID there four five six five five six six if you look at the sub domains you can see it's just a bunch of numbers that we're using zero through thirty one dot scythe.wing I just as like bits in a 32 bit integer so we're literally iterating through all of them in a for loop so what you just saw was a way to track whether or not a user has hit your site in incognito mode in blatant violation of the fact that incognito or private modes are supposed to give you certain privacy guarantees we've actually I think raised that up as a concern but it's been just deemed as the security benefits of both HSTS and HPKP have been deemed to be a much more significant than the potential privacy loss of doing so I don't actually think either of us have a problem with HSTS in that capacity but HPKP we personally think shouldn't actually be necessarily respected in private modes or incognito modes and in fact there was a time I think in Tor browser so this is our big PSA right there was a time in Tor browser a few versions ago we don't know the exact version but we did confirm it I want to say like two hours before the talk that if you haven't updated Tor browser yet HPKP headers we believe can actually be set in incognito mode and respected in between sessions which means theoretically you could in older versions be tracked across sites assuming sites set this up we don't believe that's the case now we double checked and we believe that if it was actually an issue so again we're not 100 percent certain if it was an issue it's no longer an issue now so if you are using Tor browser please upgrade to the latest version so thank you now you have some risks let's say if you want to implement this you have the risk of somebody else saying well hey this is actually kind of unethical so we're going to try and dust your tracking domains as a public service right we agree this is actually pretty shady like the the actual implementation of a super cookie like this is actually pretty shady so if you really want to implement this you can always whitelist domains that you want to track you know for your own tracking service but if you're going to offer this is like a sold service you can always just you know issue a nonce bat you know a nonce through a back channel to the app that's then serving up the super cookie itself to your users that nonce is then sent back in from your actual clients back into the tracking domains itself and then your domains can say hey wait a second I do expect this nonce let me go ahead and serve up the HPKB headers themselves so there you go some quick mitigations for issues that some people might say hey well wait a second you know I can kind of stop this service from working right now so this pattern is also similar to others that are actually actively discussed in the RFC the only catch here is that in the RFC a lot of the super cookie ideas rely on the report URI construct which as which again isn't supported in Firefox so it's not as effective whereas this one yeah it won't work if you use no script hopefully a lot of people do but it will work against a lot of your average users who don't even know what no script is so we do have the source for it you can of course go and check it out up there or you can grab it again off of the aggregate link alright this is the fun part we got what like 12 13 minutes left so what if you want to be like a total jerk that's like what half the room one person clapped one person I heard it so it really shouldn't talk about this but you know who are we kidding this is Defconn so here's what you need to make what we're about to talk about work and we're not going to give you a novel way to break into a site we're not giving an exploit there's again no exploit here no no unpublished full disclosure thing the last talk we had this whole lecture on responsible disclosure please follow it please but that being said this is a nice attack pattern and that's kind of the fun we're about to have so here's what you need you need a high traffic target I can think of many media organizations that might be covering the elections is a good example you need a way to shell the box and you need a free CA right so and again okay we love let's encrypt again I know there's some people in here we love them give them another round of applause please again just repeat it awesome the absolute worst possible thing you can do with this as Ryan and I have determined is what we're calling it like is taking a site for ransom and we'll explain why in a bit so we decided to call this pattern ransom PKP you know in the culture of arbitrarily naming your attack patterns and vulnerabilities right so what you got to do is you have to determine your target first you have to generate what we're calling a ransom key pair so this is you know just this is the key this is the key pair that you're holding within your control you're not giving away even the public key you're just maintaining this oh people still use PON in hacker lingo today right okay so you have to PON the target web server oh god I just said that all out you have to once you've actually taking control of the web server on the server using cert bot or whatever you want to use your own automated script doesn't really matter generate your generate an actual what we're calling lockout key pair this is a disposable key pair it's by design for it to be disposed and send off the CSR and you get your actual cert back and you mount the cert then there's something else at a question mark are we allowed to use that graphic I think we are and some profit we hope so what's in the box so while owned users is less than n in other words while you have yet to reach a certain number of users that you've predetermined based on the size of the site that you're trying to hit what you're going to try and do is you know what I'm not all that good at explaining I'm just gonna let Ryan do it let's see so yeah I mean in the box while owned users is less than n or just on some static interval like 8.4 hours we mentioned with let's encrypt okay there we go your laptop probably already gotten owned please don't own my laptop so on that interval or after each of those end users you just rekey that you generate a new lockout key you delete the current one generate a new one and throw it in the HPKP header while the ransom key public key hash is still in there is it yeah all right and then each time like I said you blow out the old key port man blow out the old key pair generate a new one this locks out end users however many users hit that site during that interval and that's pretty much it so the idea is that you would go beyond simple defacement of a website and you would actually potentially monetize it did you want to rekey the site now it's already no I already set up a timer so oh so this might actually work hold on so let's actually let's actually see if we're going to be dinged by the demo gods here all right so anyone who went to isis.io at the beginning of our our talk this is what you probably saw or should have seen unless you were on android as Bryant mentioned and now that a rekey has occurred this is what you should see just a TOS key pinning error so let's actually call this out if you actually look we can't zoom into this one but if you actually look the specific error should say pinned key not insert chain assuming that the key is actually rotated on time so essentially what we did here let me clarify how this attack really works you're holding the access of the users of the site hostage that's the idea you're denying access to the many users of the site and you're basically saying look we'll give you the ransom key pair well well yeah actually we will give you literally the ransom key pair if you for instance do whatever we want you to do that's that's essentially the premise here now somebody could that's the worst possible thing we thought of that somebody could do if you gain access to a box then you can do quite a lot of things but let's say all you get access to is just the web server right like okay typical site defacement is probably on your roadmap you're probably going to put I don't know owned by some hackery name uh but why do that when you can also monetize what you just did right so that's essentially what we're concerned about here is now you've got HPKP and not just let's encrypt but other CAs that are going to follow that model down the road that could enable this attack pattern so we have some considerations to think about though like meaning why this isn't a high severity issue so here's the thing let's encrypts rate limit is 20 certs a week we mentioned this earlier uh it's it's kind of an artifact of how they've architected the service originally it was like a five rekey limit but if you reconfigure that cert package that you send for like the actual key uh to get the actual cert you can get it to be 20 for every single given domain uh so given that you can't actually rotate the key like every minute uh you you're still bound to some constraint uh Chrome and Firefox also have HPKP lockout mitigations uh notably both parties have or are in the midst of reducing the max age as I mentioned earlier down from one year to 60 days Chrome originally reduced it because people were bricking themselves left and right implementing HPKP and were bricking access to their users to the site for like a year at a time and of course these guys have no idea how to clear their heaping so they figured you know what two months is probably a lot more palatable and finally you still need to actually compromise the box so ultimately the the conclusion by the teams was pretty much like this uh Chromium they've indicated they won't fix it they'll still keep an eye out but they won't make any other programmatic changes because they've already reduced the max age to 60 days which is fine uh Firefox they've gone ahead and reduced the max age and I think that that's on its way to production right now and let's encrypts as indicated that they won't fix because they believe it's out of scope uh we actually understand this reasoning here the idea here being that spreading TLS is much more important than worrying about what could potentially be an experimental risk so we we totally get it now that being said that puts the onus on all the rest of us for ways to address this just as a reminder to myself how many people have heard of CAA right that hasn't changed okay so what is it uh DNS certification authority authorization uh it's kind of a mouthful it's basically a blacklist whitelist it sounds messed up uh if you have the DN if you have in your DNS record uh the the CAA record then every single CAA that hits your domain in order to you know be able to confirm and make sure that it's authorized to give that domain a cert we'll say oh wait a second it has a it has the CAA record right and it says I will now by default assume I cannot give you a certificate for this domain unless that CAA has been whitelisted within the record so in other words you're basically saying if you have this record for your domain you are permitting certain sites sorry sorry certain CAAs to give you the certificate for your site so if you don't list let's encrypt or you don't list any other free CAA then nobody can use a free CAA or or some other unknown CAA to issue the certificate for your domain now alternatively you could also use HPKP uh we actually had somebody who attended the black hat version of the SOC who said this isn't a complete mitigation but it does buy you time in monitoring uh so if you monitor your headers for changes uh you the only way somebody can attack you if you're already using HPKP is if they inject their own key into your headers and wait until the max age is expired before then dropping your key and beginning the attack so lastly you can also just try not to get popped but that's like the hardest of them all so now what if you're an end user like an accountant that might get might be like a what bystander that gets hit by this uh you can always try visiting uh Chrome net internals uh HSTS um but alternatively you can also clear I believe they fixed this uh this used to be a this was also another vulnerability that we found this is a quick 500 bucks uh you can also clear I believe your cash um and that should also clear your HPKP headers as well uh originally you could clear any aspect of your browsing history including save passwords and because they misplace a curly brace that would also clear your HPKP headers so yeah that's what we mean when we say that a lot of these standards are implemented very quickly and some of the testing isn't always complete and in Firefox if you dip into about config cert pinning enforcement level and you set that to zero you hit the site take the new header and then re-enable you should be fine so I think Ryan you've got the source on yeah yeah and also we just wanted to be clear for any law enforcement agencies in the room uh we did not uh implement or open source actual ransomware this is just the the basic POC that implements the re-keying and the whole lockout process it's like a DOS right so yeah you definitely need to put in a lot of extra effort to make this work the all that's here is just the technical details for how to re-key on a rapid cadence uh we have a lot of hat tips um I'll go ahead and just read all the names out um crap I should probably have remembered how to pronounce some of these names uh Geller Badoia Digicert um twitter handle EL underscore D33 uh John Callahan, Jan Horn and all of cure 53 uh Sammy Kamkar, Jim Manico, Mike McBride, Jim Reni and his superb legal skill uh Garrett Robinson, John Willander, Doug Wilson as well as the Chrome, Firefox and Let's Encrypt security teams for all their contributions to this talk this talk was something like five six months in the making and for those of you that didn't take pictures there you go that's the slide uh take pictures uh go and check out the demos uh you can also check out a lot of the stuff um I have my technical background here as I advise Ryan and his company Scythe on implementing a lot of the app sex stuff that they have there so if you want to see some of the stuff in action you can always just check out Scythe.com or Scythe.i am and see some of the stuff in production so um we actually have for those of you not fleeing the room if anybody has questions since we're the last talk of the day I will gladly come and throw bags of popcorn at your face. And questions can be asked here at the floor Mike. I'm not kidding it's really good popcorn it's like homemade not by me but by some other guy that Microsoft purchased popcorn from they just got way too much. Thank you Microsoft.