Okay. We have gone through this bill and it is now up to draft 1.1 that's grown to nine pages from seven pages. That's what I can tell you. Rebecca Wasserman from legislative council is here to walk us through the latest draft. Mr. Chair, is this 163? Yeah, what did I say? That's okay. Just a note to Peggy. I clicked on it on the website and it takes you to an error page. Oh, yeah. Yeah, so I don't know what's up with that. I just did that and I didn't get that. Let me try again. Share the document if it's not up. But it tells me that the page doesn't exist when I click. That's weird. Can you try again? I just clicked it and it works fine. No, not for me. I'm not sure. If Becky's going to share the screen, it won't matter. I just wanted to let you know. Yeah, I don't know. It's very strange because it's. Why don't we share the screen just because there is some technical difficulties. You hear the systems hang out somewhere with the community? No. Oh, he's on an intelligent presentation. Can everyone see that? Yeah. Thank you. Thank you. Thank you. Zoom is not cooperating. Okay. I'll just go. Go with what I have here. Thank you. Wasserman legislative council. This is a strike all amendment to Senate bill 163. Which was titled as introduced an act relating to state court jurisdiction for special immigrant juvenile status. The bill has changed in this version of the bill of the amendment. So I can. There were some global changes throughout that I think might be helpful to just mention before I start. So in the bill as introduced. The reference to. To the child who was petitioning for special immigrant. Child labor. To juvenile status was a at risk. Non-citizen child. And a change that was made throughout this, this amendment is to refer to those children as vulnerable. Non-citizen children. So you'll see that changed throughout. Primary changes throughout also deal with I guess not expanding but amending the definition of court to make it clear that the courts that can review these these petitions and make special findings for children. Our will have jurisdiction over the child in other circumstances than just probate and family division, and that these findings that are being made our findings that are within the jurisdiction of that court and not necessarily just being done because child has made this type of petition. So, Becky, this is Joe betting, could you just back up the line 19 on page one and tell me what the difference is between citizen and sit on the. Oh, that the version that you have the paper copy has a spelling error and I, I had sent Peggy an updated version which is what is reflected on the on the screen and will be on the website. I can't quite read it from this distance. What is citizen or citizens. Yeah, so that this the definition of child or children. So it's referring to someone who is unmarried individual or individuals who have not yet attained 21 years of age and who are not yet a United States citizen or citizens. Still sounds kind of straight to me but Phillips the English major. I think it looks okay. I think it's because I think we move forward. So, so this is actually one of the changes that were made is in the definition of child in subdivision to one page one. Adding to the definition that, along with being an unmarried individual or individuals who are not yet 21 that the child is also not a United States citizen or citizens. So it's a plural or singular. And I just wanted to point in subdivision one the deaf there's a definition of vulnerable here. And that is replacing that reference to at risk. That was in the previous version. So the change is in the definition of court, which is what I mentioned that the court is now means any court that has jurisdiction over an unmarried individual or individuals who have not yet attained 21 and who are not US citizens. So this is the probate division and the family division of the Superior Court that is meant to also include other courts that might have jurisdiction over a child in this situation for another reason. And so in terms of going through the amendment, do you want me to just go through where there were changes from the previous version. I like the major changes. So in subsection B, the there's there's no, this is just sort of reiterating what I mentioned before that the I'm trying that the court that's reviewing this petition has jurisdiction under Vermont law to make judicial determinations regarding the custody and care of children but is not. It's not specific to the special immigrant juvenile status under federal law, it's just that these courts under Vermont law have this jurisdiction over a child. So section C, the procedure for a petition. So when a vulnerable non citizen child or a person who is interested in the welfare of that child petitions the court, the petition for special findings has to include all of the requirements for what is in the federal legislation for special immigrant juvenile status, but this section is no longer. So it follows what's required in the federal law but it no longer refers to just special immigrant juvenile status. It is, again, a little bit broader that this that any court that has jurisdiction over a non citizen child in this circumstance would be able to make these petitions, or would be able to have make these special findings. That's my last question. I'm just wondering, could this also apply to a child in another country. I think the intent here and I'll let some other folks jump in on that but I think the intent here is that this is a child in the United States, who is making this petition to apply for was making this petition for special findings which will allow them to stay in the United States, if they are granted special immigrant juvenile status. I guess the peaceful doesn't say stay someplace I'm thinking of a family who wants is in the process of maybe adopting a foreign child think fall apart before the child gets to this country. Even though they've done all the paperwork and all of that, could that child come under this provision. I think if they're adopting a child than that child would become a US citizen through that adoption. Yes, I'm talking about before they get to this country and become a citizen talking about something happens in the child's country of origin before the child gets to the United States. One thing is that this would not be available in that circumstance but I can defer to those who are Aaron or Rebecca or anyone else want to comment on. I would be happy to comment on that. Good morning everybody special immigrant juvenile status is something is that non citizen children can only apply for once they're in the United States. Thank you. Thank you. Well, that question if I could, Senator Sears, shouldn't it be restricted to children who are residing within the geographical confines of Vermont. So, I don't know if I'm the best person to answer this this could be a question about state court jurisdiction. Vermont State Court jurisdiction in general, what a Vermont State Court have jurisdiction over a Mexican national living in Mexico. I don't believe so and this this bill certainly is not intended to change that. That is Rebecca Turner from the opposite defender general I'm sorry for the record, you at least once just state your name so that the record can pick up who you are. Thank you. Thank you, Senator Sears and I agree with what Aaron Jacobson is saying. Whether or not the Vermont courts having jurisdiction over juveniles could reach to that juvenile outside of Vermont. Again, we have judge's own a here and others here with DCF can win but I don't see that being the case again, the deaf and so and I don't think that it's necessary to add that language, Senator Benning, because of how the definition of dependent on the court page two, lines three and four. That is a required finding for the state courts. And to make a finding that a juvenile is dependent on the court means that the person is subject to the jurisdiction of of the Vermont court so it's built into the definitions themselves this threshold requirement that the state court be able to invoke the jurisdiction over the child. Now, here, what we're trying to do is merely make sure it's clear that that jurisdiction extends to youth who are between, you know, over 18 and not yet 21. And so that again, that overall objective of this bill remains unchanged, and really is the narrow focus here. Any other questions of where we've been so far which is, we're online. Four of page three. We just had an explanation of that section. Keep going then. Yep, please. So the rest of that section has not has not said substance substantively changed it is just laying out what needs to be in the findings that the court will is being asked to issue in the petition. Page four. Line six under additional findings. What was added here is that if the party if requested by party a court may make additional findings that are supported by evidence and and Vermont law was added to that. Can I just ask a word about the use of the word abandonment. So, let's just my understanding is a child is here. Came with the mother, for example, got to Vermont she was a dairy worker is because of immigration is sent back to whatever home country she came from. That's, is that abandonment. I mean, I don't think she abandoned the child the, the ice did. There are other words that can be used there. So I think that this is lining up with the language used in federal law. And I think that the court interprets that maybe something that Rebecca or Aaron or Jill might be able to answer better than me. This is Rebecca Turner from the defender general's office for the record. I think that abandonment is is interpreted broadly and to the extent that that Senator Sears your concern is that that it was not willful abandonment by them by the mother and that the language here is broad and it already includes or similar circumstances. Right. So unable to care for the child because she's been physically prevented in that instance by by us government officials for moving her so I think that your concern that we need to maybe broaden that language is already there and I'm speaking. Rebecca, I think I'm looking at page three line seven on this latest draft 1.1. Again, it goes to underlying abandonment abuse neglect or similar circumstances. Okay. Oh, that helps. Thank you. In page four subdivision three under health safety and welfare considerations. So this section is saying that in making a determination of whether it's in the best interest of the child to be returned to the child's home country or their parents previous country of nationality. The court will consider health safety and welfare considerations, and the language on lines eight through 10 was added that the health safety and welfare of the child must be a paramount concern when the court considers the best interest of the child. In the next few sections, some language was removed here and added to section two with respect to extending the guardianship for children who are over 18, but have not yet attained 21 years of age so I'll get to that. I don't know if it's further along but that that was another sort of major change to this amendment was that all of the language was in title 14 and in this amendment adds some new language in title 33 with respect to the extension of the guardianship for those youth over the age of 18. The notice requirement and subsection D. Removed a reference. Sorry. Oh, I thought I heard a question on subsection D at the bottom of page four removed a reference. For when trying to find the identity or location of the child's parents, the court has to serve notice and the previous version referred to providing this alternative method or service or waving service if the child sort of fit the description of what was in the federal law for special immigrant juvenile. And this removes that that sort of cross reference to the federal law here. But it's a may not a shell. It's in the court's discretion to to decide to provide an alternative methods or service or wave service so it's a may. Okay, with that. We have no issues with that I, I would note that the one section that I did have a concern about was the one that said guardianships because it talks about a guardianship pursuant to this says for purposes of appointment of a guardian of the non citizen child pursuant to this section, but this section does not appoint guardians. As Ms. Wasserman said that's done under title 14 so I think the language if it said for purposes of this section, comma, the term child or minor shall include if you if you remove the language that says appointment of a guardian of the non citizen child pursuant I think that cleans it up and makes it clear that the appointment is done under title 14 and not 33. That was judge zoning by the record. I apologize, thank you. No, I find I'm just, we're trying to be informal but at the same time, somebody checks back to the record wants to know who just spoke. Well, moving right along. Subsection e expeditious adjudication. And a question came up about this in last time I testified about it says that the court shall hear adjudicate an issue findings of fact on any petition for special findings under the section as soon as it as administratively feasible and prior to that child turning 21. So a change here was made that says that the court shall do this when it is in the best interest of the vulnerable non citizen child. So it does give the court some discretion of determining that it's in the best interest of the child to hear the petition. So I'm going to measure the findings as soon as it is as administratively feasible. And then page six. The construction section of the, of the bill on line for subsection each. It's, this was changed from this section shall be liberally construed to be in the best interests of the child and it was amended to be liberally construed to its legislative purpose. Then section two is all new language as I mentioned. So this is adding in title 33 the guardianship language, which says a new section retention of jurisdiction over certain vulnerable non citizen children. So subsection a uses the same definitions that were entitled 14 with respect to vulnerable child and non citizen. And then subsection be is saying that the family division may retain jurisdiction over the non citizen child who is not yet turned 21. For the sole purpose of adjudicating a petition for special findings and making judicial determinations regarding the custody and care of the child consistent with this section. Nothing in the section expands the scope of the court's jurisdiction to order a youth into the custody of the commissioner for children and families pursuant to this chapter. The procedure for petition and subsection C is similar to what is laid out in title 14 so the child or a person interested in the welfare of the child, petition the court for the special findings to obtain relief from the underlying underlying abandonment abuse neglect or similar circumstance. There's a cross reference here that says in accordance with the procedure and title 14 section 3098 the court reviews that petition including affidavits and other evidence issues the finding of facts, and makes relevant conclusions of law consistent with section 51, a one of this chapter, and that is the purposes section that has the best interest, best interest of the child laid out set forth in that section. Subsection D is the expeditious adjudication with respect to this title 33. So it says when it is consistent with the purposes as set forth in section 51 and one of this chapter which is the purposes section of this title, the court also can determine that it shall hear the case and adjudicate and issue the findings for special for on any petition for special findings for a child prior to them turning 21 years of age. Subsection E is duplicating the language and title 14 about the additional remedies under Vermont law and similar findings of fact. So a child is not limited under this section from petitioning for special findings. Any other petition under another provision of law for any other rights and remedies that's available to that child. And then in subdivision to it says that the section shall not limit the court from issuing similar findings of fact or conclusions of law in any other proceedings concerning child. In any subsection F says that in any judicial proceedings in response to request that the court makes special findings to support a petition, the information regarding the child's personal information such as immigration status nationality place of birth is protected by state that remains confidential and this confidentiality and exemption from the public records act is also in the language and title 14. And then the effective date is July 1 of this year. And finally on lines nine to 10 the new title of the bill is an act relating to state court petitions for vulnerable non citizen youth. Thank you. That's helpful. My understanding is you work closely with several folks and particularly from the Office of Attorney General and the Office of Public Defender. And I appreciate their input and their help with this. Are there any comments from anybody's in the audience and the only change I've heard so far as opposed by judge zone. So anybody who would like to speak if you could take that down now. Becky, thank you. Yeah, question. Good. If I'm reading this correctly, I'm just going to throw out a scenario here. St. Johnsbury has a resident mom without the child but over in little to New Hampshire is the father with the child. She is now 20 years old. The father leaves. There is certainly the possibility that ice could come along and say, we're going to bring the child back to country of origin. If I understand this correctly the mom could petition a Vermont court and make a claim that whatever the past living conditions were the previous were threatening to this individual's life in some fashion. Am I reading that correctly. So, I think that there isn't a needs to be the child's health. The child needs to be considered vulnerable so the child's health safety or welfare. The child has to be in jeopardy due to abuse neglect abandonment or similar circumstance. And that the child's return to the country of origin would not be in the best interests of the child so I don't know in this scenario, what the child's circumstance would be, but they would have to meet the requirements. They are their health safety or welfare is in jeopardy. So I guess I'm saying I don't know if the mother in this scenario. Just because a father might not be, might have been deported in this scenario I don't know what the situation is with the child's mother. And I can let somebody else speak to that you might who actually would be a practicing in this area but that's my my reading of the situation I think it would be specific to the circumstances of that child. I just like to lay out the scenario properly so I can get a good answer. If the father was providing food and shelter for the 20 year old because 20 year old cannot speak English was unemployed, etc. And the father leads. If I read this correctly, the mother could petition the Vermont court to demonstrate that this 20 year old now considered child is in danger of their health or safety or their welfare being affected. Her mom could go into a Vermont court and make an argument that number one that child is in fact in some kind of welfare concern. And she may provide evidence that the country of origin was for instance gang related activity that's why they left and this child would be threatened with being brought into the game if I read this correctly. That scenario could actually be accomplished with this piece of legislation. Am I incorrect. So I think where I where I might need a little help with this is that I don't know that Vermont would have jurisdiction over that child in this situation because that child is living in New Hampshire. So I think that there would need to be a situation showing that once the father has left for some reason. If that child needs to be under a guardianship for some reason if that guardianship was transferred to the mother in Vermont then a Vermont court would then have jurisdiction over that child, but I think there would be a few steps that would need to happen I don't, it wouldn't be an automatic situation for my reading of this. I'm assuming the mother would be acting to either go through a probate court or petition of family court pursuant to this legislation to get that child into a Vermont court and that was why I raised the issue before about Vermont court as opposed to any court. I just want to be clear that if we're going to enact this we have a full understanding that the scenario I've just laid out could actually happen here. I think if the mother in Vermont, if there was a reason for that child to be in a guardianship situation and the mother, and there was a petition for that in Vermont. As part of that the court would have jurisdiction over that child so these special findings could be made in the court at that time. But the child would also have to meet the required these requirements to receive those special findings it wouldn't be automatic just because the child was being the guardianship was being moved over to Vermont the child would have to meet the other requirements of being you know a non citizen child who was you know, subject to some kind of abuse abandonment or neglect or other circumstance and it would not be safe for that child to return to their home country or their parents home country. I couldn't be wrong with judge zoning I'd like a little help here. It seems to me this bill is providing Vermont with jurisdiction over that child. If the appropriate circumstances could be alleged by the petitioner mother who is in St. John'sburg. Tom zoning. Yep. Go ahead. Judge. Right so Tom zoning chief superior judge. I, Senator bending I think you're correct. And I, I would just highlight that. The, I use the word the rub here is that, I think, Senator bending you and myself and others may be thinking about well uniform child jurisdiction acts. And do we have jurisdiction over a child who lives in New Hampshire. The UCC j a that's set forth under title 15 specifically defines child as an individual who has not reached age 18. Correct. This actually this presents a unique circumstance that it doesn't really it doesn't fall under what we would traditionally look at as jurisdiction for a child. And so I think that it would permit a Vermont court. If that mother comes in and says I have this 19 year old, and they can meet both factors that the abandonment let's say in the, in the abuse perspective, and the second perspective. I think yes, it would appear to provide the Vermont court with jurisdiction to go forward. And again, the traditional UCC j a would not kick it out because the child's over 18. Thank you. I'm just trying to make clear exactly what the potential is on what we're doing. Any other comments, questions, concerns. If I could just comment briefly. And because I didn't say this before Aaron Jacobson Attorney General's office. So, Senator bending under your scenario right that that 19 or 20 year old child. And maybe because as you mentioned, does not speak much English and previously his father was helping provide his food and shelter and taking care of him might feel the need to move to Vermont to be with mom. At that point in time, if that 20 year old consented mom could file for a guardianship in Vermont State Court. And then if that guardianship is granted, then as well. If the mom or the child could petition for the special findings that are laid out in this bill, and if the child could obtain those special findings that would allow him to then apply for special immigrant juvenile status with the federal immigration agency. So that's, that's how that would look procedurally Aaron, Aaron, if I could follow up in your statement you said if the child conceded what if the child does not concede. Now we have a parent coming in under this statute that seems to me to override any decision about this 18 or 19 or 20 year old conceding to have it happen. I don't want to walk away from the discussion of thinking everything's going to be hungry Dory I'm just trying to cover all basis. Sure, I think it's a great question. The way I read this bill I'm looking at page. And we're talking about children who are over 18 here. So it says for purposes of appointment of a guardian of the nonsense and child pursuant to this section. The term child or minor shall include a person who is less than 21 years of age, and who consents to the appointment or continuation of a guardian after 18 years of age. So, after age 18, then that you over 18 years, who's also under 21 would have to consent to that kind of guardianship. Thank you. Any other questions. If I may, this is Rebecca Turner from the Office of the Defender General. I just needed Rebecca just a typo on on page one, a line 15. It's written here in the version I have child's parents county of origin and I and I think that was supposed to be country country of origin. I'll address that. Thank you. And I also for the record wanted to say that that judge zone is suggests suggested correction. Certainly, is, is amenable from the defender general's perspective, and would support making that change. Okay. Thank you. Any other comments questions about this draft with the one change. Everybody's okay with this. I mean, in the room. Senator Sears. This is Jill Rudge clinical professor of immigration law from Vermont law school. I'm just offering a comment that Vermont law schools immigration clinic supports this latest iteration of the bill including the amendments proposed today. Thank you. Thank you. Anybody else. Jennifer from DCF any concerns or you'd like to. No, we thank you I've worked with Aaron and with Rebecca and we got the language in around not expanding the scope of custody for DCF so DCF has come to with this and we're comfortable proceeding with us when we do have custody of a child already we just didn't want it expanded. Okay. I wanted to take a brief opportunity to thank Rebecca for working Rebecca Wasserman for working with all of those folks that are here on the line right now to get this into some shape that is that can work for. Hopefully a small number of kids but that may need the special immigrant status. With that is there. This would be draft. I'm assuming 2.1 or 1.2. You have to make a minor change. Yes, it would be draft 1.2 and I would be correcting the spelling mistake on page one from county to country and I would be striking out on the guardianship subdivision on page for the appointment of a guardian of the non citizen pursuant to. So it would say for purposes of this section the term child or minor shall include. Any further discussion on this and is there a motion to report favorably or to amend s 163 as presented in draft 2.1. Senator White has moved that we report this favorably is there any further discussion or the amendment. We amend the bill. Right. Thank you. Please call the roll. Yes. Yes. Yes. Yes. Yes. Thank you. Is there a motion to report favorably as amended. Senator White. Yes. I just wanted to say that bills like this never get. They're not glitzy and they don't get a lot of attention and stuff a bit from the press or from anybody else as a matter of fact, but they make a huge difference in the lives of those that they touch. They don't get the press that all those high profile bills get so I will. Well said, Senator White. I totally agree. I think. Any further discussion. If not, Senator White has moved report s 163 as amended favorably to the Senate. Thank you. Please call the roll. Yes. Yes. Yes. Yes. Yes. It's great. We're unanimous and I thank all of you very much. Who would like to report this bill. Recognizing you may not get headlines. But if somebody will help me on assuming that I'll be out of my stupor. I'm sure that ledge council and folks that are here on stage will be more than happy to help you with the report center or whites. It's kind of an abstract area that will and I think you said it well so I will leave it at that. And thank you very much. So, Peggy you'll get the copy to Senator White at some point today. As soon as I get it. I'll get it from. I'm not just going to. So while we have. That's if I want to send me any. We'll do when you in statements. Please, please feel free. Peggy while we have judge zone here. And before we go to the break. I believe you do have just justice. I'm sorry, I don't have any more of this. Any other. Wurple's nomination now. So, why don't we set for next Friday, we're going to have a very limited hour. Why don't we set her confirmation for next Friday. If that works for the justice. And I'll let judge zone a work that out with her. from this Friday, a week from this Friday, not this Friday. I will let Judge Waples know that it would be the 18th at 9 a.m. Is that in-person or is Zoom permissible? Zoom is gonna be permissible on the 18th. After that, we don't know. We're waiting further instructions from the leadership of the Senate, but I can definitely say that we will be zooming on the 18th. I will let her know. Thank you. All right. Or a hybrid of that, I should say. Okay, well, why don't we take a break until 11 when we take up S-140, which is Senator Baruth's bill, and we held off on voting on it until he got back. Much appreciated.


how many people here like cleaning their house? No? Oh wow, this is a weird crowd, holy cow. So, um, I don't like cleaning my house. I don't like running a vacuum. I recently had a small child, um, which I thought would be effective. Um, he's now started to crawl. I'm like, yes, human Roomba. But I quickly discovered that the problem is, you can't just put like a, like a, like a cloth or a towel on the bottom of them and have it be like a dust cloth running around because he starts to eat the things and that's, and then it's gonna break the human robot vacuum. So, maybe I will have one of these vacuums in my future or based on what we're about to hear, hmm, probably not. Let's give Fabian and Yisga a big round of applause that came all the way from Germany to talk to you about silly little robot vacuums. Let's give him a round of applause. Welcome to our talk about vacuum cleaners. And it will be about a lot of IoT components including the cloud and the actual hardware. This is Fabian working at ERNW and I'm from the secure mobile networking lab. So, why does it matter? Um, and a vacuum cleaning robot actually has access to your home Wi-Fi and it knows a lot of your personal habits like, um, when are you at home? When are you at work? How many people live in your apartment? How big it is? Do you have cats, children, partners? Um, and my question to you is who of you owns a vacuum cleaning robot? Quite a few. And now maybe some hands going down, who of you have like their own, not owning someone's on the internet, but like really owning your own vacuum robot? Ah, less hands, yeah. Okay, um, so we, um, chose actually the NIDO ecosystem to analyze and, uh, we are from Germany and in Germany, um, these are just, uh, relabeled by Forward and, um, they are selling vacuum cleaners since 1929 or something. Um, and their top model is actually a reprinted NIDO and it always wins the test competitions because it has like rainbow colored LEDs, the NIDO hasn't, and, and a green brush and also a few more sensors, yeah. Um, so we did responsible disclosure and the most, um, urgent, uh, stuff was really fixed in time and also more fixes coming out. Um, no customer data was leaked, but robots were harmed during our experiment story for this. So this is how the lab looked in between doing those experiments. So the infrastructure, um, each, uh, robot has actually a user interface and also some USB console for some basic debugging. Um, then you have a smartphone app which can run some manual robot commands, but these are not for cleaning your house. So this is just a very basic thing going on there.  Um, and during setup you set up this account and link it to the robot. And then there is a second cloud, the nuclear cloud, because everything is better with two clouds, obviously. And so the second cloud is somehow connected to the beehive cloud, we don't know how exactly, um, because we cannot sniff there. Um, but, um, it is, the nuclear cloud is then used for, um, for example, starting the cleaning process, getting back a map report, uh, about the cleaning. And there is a lot of security going on there. So the robot itself has like secure boot, encrypted logs, sign firmware updates, so we try flipping big bits and it doesn't work. And then everything else actually has like HTTPS and, uh, special RSA keys between the robot and the cloud and then a secret key between the robot and the user. So really everything is being done there. So you would say like, why did, why do we even give a talk about this? What could go wrong? Um, and I have to say a lot can go wrong, so we managed to bypass the secure boot and extract the image of the robot and our key findings are key findings. And we also did, um, uh, QNAC side quest, uh, and we were able to gain unauthenticated remote code executions on the robots over the cloud. So the secure bypass, uh, actually works that you can put the robot in a test mode, reboot it, and then you would get a special boot loader. And that special boot loader only takes QNX, IFS, so very proprietary thing. But if you manage to compile this, then you can dump all the RAM to the serial port. And, um, if you load it to a special region, then you can read out the original image. And in this image of Nitto, of the robot, um, there's two processes that are very important. The first one is a watch dog called Pinky. And, uh, also Clean and Logic, which is called Brain. So that's why we have this funny subtitle with Pinky and Brain. All right, so I will now talk about the key findings. So first of all, I have to explain what the keys do in particular. So we have the secret key. The secret key is, uh, unique for one robot user account connection. And it's, uh, computed by the robot on first linkage to a user account. And it's used to authenticate commands to the robot. So if you want to start cleaning or anything like that, you have to authenticate this request using the secret key. And the secret key is known by the robots, um, the smart application and also the cloud. And, um, the authentication works with an HTTP header, which is just a basic authorization header in HTTP, um, led by the Nitto app string and then a signature. The signature just takes in the serial number of the robot and the current date of the request and, um, the message body, so the command. And this is then, uh, hashed with, uh, HMEX SHA-256, um, with the secret key as the key component. The second, uh, key that is used in the infrastructure is the RSA key. Um, so we need a second key because the robots have to, at some point, um, exchange the secret key with the cloud for authentication of the commands. So the robots themselves need to have another set of keys to authenticate against the cloud. And also the secret key is not that secret because several parties know it. We know that the smart application has it, therefore the user can extract it and everything. Um, so this RSA key is for authenticating robots against the cloud. And this works similar to the, to the secret key. Um, we have, um, authorization header and HTTP again, um, led by the Nitto bot string and the serial number of the robot, um, followed by a signature. The signature this time is over a little bit more of data. It's the robot serial again, um, the current HTTP method, the URI of the request, um, the current date in the body. And this is then signed with, uh, RSA SHA-256. Okay. So, no. What's, what's going wrong? Um, we have this, um, excerpt of the secret key computation. It's a little bit simplified but I walk, we'll walk you through. Um, so first of all we have this random value that is just a random value. And then we have this, uh, 16 byte timeshift variable. And this is later than used with the SHA-1 hashing. So the secret keys themselves are basically SHA-1 hashes. A little shorter than that but it's the SHA-1 hash. So they look pretty nice and the entropy is really good because we all know SHA-1 is pretty sane. Um, so now it's, um, important to see, um, what the bits in this, uh, and the bytes in this timeshift variable actually are. So the first four bytes are the current time. Well, we know that the time is often used in cryptography. It's not that good but we also have seen worse. So, okay. But then we have some constant values. I don't know why but, okay. So zero is a great number as well as 16. And then we actually use the random numbers. So the, um, byte number eight of the timeshift variable is, um, some computation with a random value. And then we have the next byte which is also some computation with a random value. But this time we, we do some math where we actually lose some entropy because six bit is enough for a byte. So why not? And the last, uh, six bytes then are the robot's MAC address. And, well the robot's MAC address is not exactly secret because the robot's serial number consists of the data production followed by the robot's MAC address. And this one is printed on the packaging of the robot. And, well, on ebay you can see people, uh, doing photographs of the packaging. And then you have the serial number. Uh, also, I mean it's a MAC address so it's a network. It's not that secret. And when the robot is first plugged in it also opens a Wi-Fi access point to, uh, provision it. And this Wi-Fi access point's name also is the robot's MAC address. So, okay. The MAC address doesn't provide any security. The constants obviously don't as well. Um, now the random values. Um, this is not much randomness but it's at least some. But there's another problem because the random generator actually looks like this. Um, this is because they forgot to seed the random number generator. Um, this means if you have a robot that's freshly booted or freshly unpacked, um, it always returns the same random number which there are bias not only a number. And the number we printed here is actually the number that the robot, um, the, the Niatu, um, botweck connected D7s take as the first random number. Um, yeah. So, okay. We don't have any entropy left except for the time now. So the current timestamp. Now the question is how much entropy does the Unix timestamp provide? And therefore we have some numbers for you. So if an attacker knows about one year exact when the robot was first linked to the cloud, that's actually 25 bit of entropy. And if an attacker knows this about one hour exact it's only 12 bit of entropy. And you already see 12 bit of entropy is nothing. You can root for this against the cloud. And, um, there also are some offline attacks against the secret keys because you can sniff some, um, authorization headers and thereby do an offline attack. And with an offline attack 25 bit also is nothing. It's like minutes or even seconds. And, um, yeah. So this is not that secure. You also can think of a, of a, um, social engineering scenario where I just call my victim and say, hey, I'm from the need to customer support, uh, please reconnect your robot to the cloud. And now I know the timestamp exactly. And now I know everything for the secret key computation. And I'm able to actually compute the secret key and send arbitrary commands to the robot. Okay, so much for the secret keys. Now the RSA keys. So, uh, we found, um, them on the robot's file system in slash var slash keys. There's this nice file called vendor private key production. So this sounds pretty promising. Um, it is encrypted at least. But, um, in the binary it's just some string obfuscation. And then we, after some deal obfuscation we had the password. And, um, yeah. So we then figured out that actually the SRK is the same for all robots. Because obviously for a public key infrastructure you want to have the same key on every robot. Why not? Um, this leads to the scenario where an attacker is just able to talk to the cloud and say, hey, by the way, I'm a robot. And the cloud says okay, it's fine. And, um, if you recall the authorization, uh, authentication that, uh, the robots do with the cloud, this was the need to bot string followed by the serial number and the signature. And the only way single robots get identified is this first string which is the serial number. So if I know the private key I can just send arbitrary requests with arbitrary serial numbers in the request. And I can impersonate arbitrary robots. So I can be any robot I want to be. And this is bad. Um, there are a lot of attacks that we can execute on this but I will present maybe yeah, a nice one I think because it's actually we are able to leak the victim's smartphone IP address. Um, because like Iskall mentioned before we have this manual driving mode where we can directly control the robot by pressing some buttons on the smartphone and the robot directly drives like that. Um, and what happens here is that the smartphone asks the nuclear, nuclear cloud what's the robot's network location is. And nuclear cloud then asks us because we are now the robot. Um, what the robot's network location is. Also the robot itself doesn't get any requests anymore because only the last recent robot that locked into the cloud is getting requests. So we can just kick the other robot and we get the requests. And well we then answer with an arbitrary port and IP address combination to the cloud and the cloud then happily forwards this to the smartphone. And well who would have guessed the smartphone just connects to this IP and port. Um, so thereby we obtain the public IP address of the smartphone. We can now do some things like geolocation lookups and know pretty exactly where this person is. Also this opens a channel from the smartphone so if there's any firewall or something like that it's an outgoing connection it's fine. Um, and yeah we, we have a port open and maybe we can do some more stuff with the smartphone even. So this could be a nice attack vector against the smartphone. And yeah I don't think that this should be possible and yeah. All right. So the little Q and X side crest. Uh, as Jiska mentioned the robot is running on Q and X 6.5. And this has some, it's an older system of Q and X. Um so just for those of you who don't know Q and X it's a real time operating system by Blackberry. And um it's actually running in cars, it's running in power plants and some critical applications. Um, but like I mentioned this version is pretty old. There's meanwhile it's some 7.X version and pretty updated and more secure now. Um, but this old version has some nice default settings. So for example R-SLR and DEP are just turned off by default because whoever needs that I don't know. And um, but that's not all. We just stumbled upon something nice when we looked into the robots because um, there's this Prok of S5 system on Q and X. It's just like a normal Prok of S5 system you have on almost every unique system. It's like um, the process memory of arbitrary processes is mapped in the file system so that Root or anyone can read this memory of the processes and also write to it maybe. And um, the problem with these older Q and X versions is that actually the UMask that is set for this um Prok of S5 system per default allows arbitrary users to read arbitrary process memory. So um, it doesn't matter if you are just a normal user or if you are Root you can read any process memory. And this is a real problem if we look into privileged processes like for example the SU binary. The SU binary is used as you might know um, to change the currently um, authorized user with the system. And well therefore it has to check my authentication and this is a password authentication normally. And to get the password authentication right it has to read in the ETC shadow file which is a privileged file and normally isn't readable. Um, and what an attacker can do is he can invoke the SU binary to gain Root privileges and he doesn't know the password but that's not important because he just reads the process memory of the SU process all the time until that very moment where the um, ETC shadow file is read in and he then just has all the information that is written in the ETC shadow file. And well then he can try to correct this and obtain the Root password. This of course isn't limited to the ETC shadow file you can or the SU process. You can do this with any privileged process. You can extract SSL keys of um, processes or just read any data that any privileged process you can execute on the system is able to read. Alright. So um, we looked a bit more into uh, the connection to the cloud and uh, did some fuzzing in the very beginning and um, I discovered a crash lock and decrypted it with one of the locker keys of the image. Um, so actually there is an astro binary and this is uh, connected to the nuclear cloud and then passes commands to the robot binary. And within this astro connection there is a buffer overflow that can be triggered with this URL. And the interesting part here is that um, we found that the buffer overflow is happening when the authentication header is parsed. Which means um, there is no authentication because we are exploiting the authentication itself. So we have an unauthenticated remote code execution on the bin astro. And well luckily we don't even need this QNX side quest because all services run as root. That's very nice. Um, and the fix for this is that by now Nido is um, validating the authentication headers in the cloud so that this is no longer happening. Uh, yeah. So, but it was very nice to just like control any robot if you have the serial ID. Security implications. So if you have an IoT product at home try to keep it offline. This is often not possible so you might use your personal like a second Wi-Fi or something and not the one for the other devices. Um, as a customer you should really update your robot so it's not just um, because security they also have some nice new features um, but also for the security of course. And you saw that the most critical party is the serial number so you need to hide this one so if you have friends visiting hide your robot so that they cannot read it. It's printed on the bottom um, or just put on a tinfoil head or something to help yourself. Um, the second part for the security implement uh, implications here is that for developers it's really important that security is not just done by hitting all the bus routes like oh yeah we have uh, RSA, RNG, hashing, secure boot, encrypted blocks, blah blah blah. Um, but the important part here is that you have a good decision for the root of trust so that you think about what is the trusted components in your IoT network and a very important part here is that dissecting one of your robots should not uh, hide the security of any other component so you should always consider a student having a lot of time dissecting one vacuum cleaner for half a year and then exploiting whatever uh, and you should put a lot of time into uh, testing the, this root of trust so for example this random function if you would have tested it in practice before the hashing then you could have probably seen this uh, in practice that it does not work and just returns the same time always. So um, we still have some time left for Q and A. And thank you for listening. So I don't, it's hard to see people there. Yeah, really no question, no questions, great. Yeah. Down, down here yes, yes what is your question? Ah yeah, so uh the question is if hiding your MAC address versus hiding your serial is a difference. Um, yes it is because uh, the other part um, of the serial is also the production date. I mean it can be guessed but uh, overall it's harder and for the MAC address to know the MAC address you need to be either in the same network for example or you need to be uh, so you have to be physically close for example when you start a robot and it's like making this pairing access point and so on very serious in there. So um, for getting remote control the attack vector gets even larger if someone knows your serial address. Yeah, so for addressing the commands you need to have the full serial number not only the MAC address so you have to get the production date. And well you can try to prove what it, prove what it is but it's pretty hard, it's a lot of entropy. So the serial number itself is more important than the MAC address. Okay, any more questions? Okay, not, not really. Okay, done. Thank you. Oh wait, wait, wait. So one question, yes. Ah, so the question is if they made a more security, key generation method. So the thing is um, we think so but it's hard to confirm because they also fix the secure boot issue. So we can no longer extract the firmware image and confirm if they do proper security. So I mean at least they promised us to do this so I think it is done. But yeah, it's always good to like double check. Yeah, in general they were pretty nice and once we managed to reach them actually because this was a quite long process because uh, we tried to reach them by the customer support but it seems like the customer support just dropped our requests and they never reached the developers. And just like one, like half a year later something we get a message like at 3 a.m. the morning US time. Um, and it was like hey we just saw that you had some requests and we found your plain text proof concept code uh in our tracker system so maybe we should talk. And from then on they were super nice and everything went well. Yeah and I thought like yeah maybe they are in the US and it's 3 a.m. but maybe just call them the same time the next day. Um, and it really was 3 a.m. so the person was like not in another time zone or something. Any more questions? Okay, cool. Thank you. There's another one. Yeah, I didn't see that. Where is the other question? Yeah. So the question was um if there is a specific reason for why in QNX you're able to read as a standard user processes of uh the memory of other processes. So um QNX back till 6.6 I guess was strictly politics compliant and I think this might have to do with it because cause politics compliance means that you really have to um yeah when you have file permissions then you have to really give this permission to any user that tries to read it. Now for QNX 7 and so on the UMask is the same but they also have some other authentication methods in place like more fine granular not only the read bit is set and you can read it. So this might be a problem and also these progress file system is used for some inter process communication and stuff like that. So I think they might have needed this for some features but I'm not entirely sure at this point. Okay. Yeah. So thank you very much.


Wish I would be worried about the sh**ty things in life But it's also f**king easy Sitting on my porch alone, waiting for your call There's no one else as surprising as ever Seems to help at all, help at all My name is Peter and I perform and record under the name Laudiceau I was lying awake last night trying to think of something that I was going to play I couldn't come up with anything because I've played here so much That's kind of like... kind of... Scrape the bottom of the barrel So I thought I'd share something that's not quite finished I haven't written words Written words is kind of like writing words but harder I haven't put words to this But I just keep playing it and I keep playing it And I just wish I could finish it So I figure I'll just play it for you And it goes like this