horse for the speed of light, a cloud of dust and a hearty high old silver, the Lone Ranger. The laws roamed the country on either side of the Rio Grande. They made daring raids on both American and Mexican settlements, but the ranches were uncertain whom to blame, and in time ill-feeling rose between the two nations. This might have led to war if the courage and daring of the mast ride of the planes had not been enlisted in the cause of peace. It was he who brought the odd laws to justice. It was he more than any other man who put an end to their raids and made a better understanding between the two countries possible. Return with us now to those thrilling days when the West was young. From out of the past come the thundering hoofbeats of the Great Horse Silver. The Lone Ranger rides again. Startling news swept the border country. The Black Caballeros loose. What's that? The Lone Ranger broke them out of jail. The masked man and the Black Caballero are riding. What's that you say? The Lone Ranger's riding the border country. The Black Caballeros has skied. Did you have a problem?  You, huh? Didn't recognize you. Senor Branson. He's inside, Chavez. Go right in. Where in the world? Well, they watch out for him. He ain't feels so good today. Get the blazes. Harsho. Senor. What I'm telling you during South of the border. I thought we agreed. I have come because I have news, Senor. Well? It is said that the Lone Ranger and the Black Caballero ride the border country. Ah, news. I heard that three hours ago. But what will we do? No. What do you think we'll do? By heaven, Chavez, you're afraid. I do not like it. What if you don't? Do you think I like it? But I think... You think because I don't like it, I'm gonna give up? I'm no chicken-hearted fool, Chavez. The man with the mask. The Black Caballero. If they know what we do. How about leaving this to me and minding your own business, Chavez? With these concernous bulls. Sure. Sure it does. But look, Chavez. You can't do anything. Stay north. I'll handle things on this side. Maybe the Lone Ranger and the Black Caballero have got wind of what we're up to. But if they have, the worst thing that can happen is for them to learn that we're working together. Eh, it is so perhaps. Who knows you crossed the border? No one. I tell no one, Senor. Well, that's something. Think he can get back without being seen? See. What's the feeling on the other side? All goes well. Any fighting talk? Much talk of fighting, Senor. The gringo they call for the troops. If they had their way, it would be war pronto. They've been doing a pretty good job, eh, Chavez? Excelante. Burke and the men just got back from a raid this morning. Where do they strike? Just outside of San Jacinto this time. Five hundred head of cattle, killed two punches, made sure they were seen in those uniforms they stole. Right now, there isn't a man in that district who wouldn't swear soldiers from this side of the border responsible for the attack. Bueno. A few more raids, Chavez. United States troops ordered to investigate. Maybe trouble between the two armies. Then you go back to the capital. Tell your folks the present government can't keep the peace and get yourself elected. And then... And then, amigo, when I am in power, I show you that Pancho Chavez is not ungrateful. Concession Chavez, that's what I'm after. Give me the concessions I need, and you'll get all the cooperation he has for us. See? But at the meantime, stay in the other side of the Rio. You're safe there. My government will have to be pretty sure of its ground before the rest of foreign citizens. You'll return when we're sure the time is right. I trust you, senor. I will do as you say.  Burke! Hey, Burke, what's going on out there? After that, what's with him, boys? They can down that row over there, boys. You get him? Boys are after him now. Wait, which way was he going when you saw him, Burke? Toward the house or away from it? Well, coming this way. Yeah, that was it this way. Good enough. In other words, if he wanted to spy on us, he didn't succeed. If he'd been going away from here, then we'd have something to worry about. Yeah, that's right. Or else we could meet... Why, it is a stone with a paper around it. Oh, and places come... The lone ranger! That's them, boss. That white horse and a black, and I'd know him anywhere. Give me that paper. Here you are. What did he say? The blasted nerve! Burke, that red-skinned trickster. All he did was draw your men away so the masked man and the black cabbier could deliver this message. Why, girly, I thought it was funny that Injun didn't keep himself hid better than he did. But they know. They've overstepped themselves, Chavez. The fools. They're calling on me three nights from tonight. This is Monday. They'll be here Thursday night. They would not be such fools, senor. They would not dare. They'll be here if they said they would. Forgetting they've had things pretty much their own way. They've had things their own way so long they got the notion they can't be caught. Black caballero was caught. But I took the lone ranger to do it. And now they're working together. Then what we do, eh? You'll cross the border tonight, Chavez. And you and I, Burke, Thursday night we'll surround this place with a dozen men. Then let's see those fellas get here. Come on, Selma. On the upload. As I kept.  And Tonto is waiting. Tonto! Of course it'll be. Call it the upload. Hold on, hold on. Good job, Tonto. Ha, ha, ha. Them tastes, Tonto. Not cancer, no. Ha, ha, ha, ha. We shall have great sport, yeah? Our plan's going to work, black caballero. Tonto. Huh? Captain Lopez and Major Winthrop are in Santa Rosa. They'll be there for several days. Ride to Santa Rosa. Find them. And give them the word they're waiting for. Right now? At once. Here, Scout. Oh, while you're gone, you'll wish us luck, no? Ha, ha, ha. You, you take care. Do not fear for us, my friend. Ha, ha, ha. Fear only for Senior Branson and Senior Chavez. On your way, Tonto. Get him up, Scout. Hasta la vista. Get three days before we keep our promise, black caballero. We'd be wise to scout out the land. Ha, ha, ha, ha. And it is world to be wise, huh? But as you'll be as you say, Amigo, we have given our word to Senior Branson. As men of honor, we must keep it. Three days later, on the night the Lone Ranger and the black caballero had set for their appointment, Branson called to his lieutenant. All the men are stationed, Burke? Of course, not even a gopher could get by him. Good. Ha, ha, ha.  Well, I hope they do. Anything more? And if the men are stationed, we'll go inside. Call out if you hear anything, Pete. Right. Come along. This is a dog-gondous thing, boss. Yes? I just can't say why them fellows was local enough to give warning they was coming. Well, I told you the reason. Just over confidence. You're right. Can't figure it any other way. But just the same. What's the matter, Burke? There. Ha, ha, ha, ha. Greetings, Sanyal. What the devil? Don't call out if you want to live, Branson. Cappos waiting. In my country, it's not the custom for the host to be so impolite. You were here all the time. It was easy enough, Branson. We simply waited until you and Burke left to call your men together. We were inside before your guards were stationed. Well, I'll be blessed. You're on an earth, Sanyal. If you please, do not reach for your gun. What do you two want?  You and every man who works for you. I tell you. Quiet. We know your game. We know you've hired outlaws from the north to stir up trouble. You're crazy. You've stolen uniforms. Your men strike across the rail, masquerading as soldiers from the south. They're trying to arouse the people of Texas to action. Start a war if possible. Pave the way for the election of your crooked friend, Poncho Chavez. Ah. Talk. Just talk. The people of these two countries are friendly, Branson. They wish to remain friendly. All right. Random. I think their relations will improve if you clear out. What's that? I said clear out. Go north. Cross the rail and stay there. Who's gonna force me to? This is a warning. You can take our advice and save your hide. Refuse it and land in jail. Aren't you forgetting something? Am I? This is an interesting story you've been telling me. Real interesting. It just so happens that it doesn't concern me. You're wasting your time. Then you're staying on? You're smart. You catch on quick. Then for you, my friend, it will be the jail. Do they jail people in your country without proof, Mr. Black Cavillero? No, but... Then I won't worry. We'll guess what proof is needed. How? That's our business. You're forgetting something again. Yes? You got in here cleverly. But how will you get out? The minute you step outside, you'll find a dozen men waiting to grab you. Well, you thought of that. He's good of you, Samuel, to think of our safety. What you shall see, it is not easy to trap the lone ranger and the black Cavillero. Amigo, you always say the word, yeah? Right. What's he doing? I'll show you. Just an invitation, Bronson. What's the matter? The masked man!  Where's your friends? Your fools! Your blasted fools!  Couldn't you have looked behind you? We've seen the masked man, boys. And couldn't see anything else.  It will be my great pleasure to shoot, my friends. Quickly. Now I do not think your so brave guards will prevent our leaving.  Right. You aren't. We'll fix you for this, as sure as you meddle in something you can't handle. Gentleman, you'll remain where you are. You've had your warning, Bronson. Clear out within a week. I will meet again. I hope we do. My friend, we shall look forward to it. You stay here for five minutes.  I said get after them! The masked man said... The lasted cowards? How do we know they ain't waiting to drill the first fella that comes out? Uh-huh. He's going out there. I'm blameshore they're gone. You likely couldn't catch him anyhow, boss. They probably left their horses just over there in the drawer. Telling me to clear out. You ain't gonna, are you? You think I'm yeller? What do you figure they'll try next? I don't know. How can you figure them, hombres? You can't do it no more and you can figure where Leighton is going to strike. They're pysons. Now, hold on. Are you fellas afraid? Not exactly, but they ain't the same as the law. It ain't as though you could tell them what they were up to. There's two of them. Three with the engine, boss. All right, three then. Just three men. There's five of us for each one of them.   I'll show you how scared I am. I'm gonna show those fellas so much action they'll wish to heaven they stay clear of me. And there isn't one a year that's going to back out. Unless you'd like to find yourselves in the Calaboose back in the States. Shucks, boss. After what happened tonight, why wouldn't they feel scary? But they won't quit. You just wait and see. The curtain falls on the first act of our Lone Ranger drama. Before the next exciting scenes, please permit us to pause for just a few moments. Captain Lopez and Major Winter had each been appointed by his government to investigate the raids along the border. We see them now just after they have dismounted from their horses in front of the garrison at Santa Rosa. Major... Major Winter. Yes? I am afraid. Afraid, Captain? What of? Sunstroke. Oh, Lord Senor. For the Black Cavalier, a Lone Ranger. There's been no word from them. Perhaps because they haven't been ready to send it, I'd say. See, perhaps. For even instead, they have been captured. If they have been killed, maybe. The Ablo. And again, we must change our plans, no? It isn't impossible, of course. They are up against powerful forces. Yes. But just the same, I'll lay my bets on them. For one week, all has been in the readiness. Don't worry about it, Lopez. If you were in my boot, you'd really have something to bother you. I'm just hoping I'm not called back until it's blown over. Blow over? What you mean? That jailbreak. When the Lone Ranger convicted Hogan, the fellow in charge of that district prison. And by the way, when the Black Cavaliero escaped... What? What is wrong? There's an unfounded rumor circulating that accuses me of closing my eyes when the Black Cavaliero got away. Oh. Oh, see? See, I'm sorry. What major weaned route did you close the eye?  It always not well with you, my friend. It's a gamble. If the Black Cavaliero helps the Lone Ranger clear up that border mess, there's not going to be much criticism. But if they fail... Ah, then... Look. Isn't that... Tonto! Oh, Scott! Oh! Oh! Dear Mount Man, we were just speaking of your friend. What has happened? White friend. Him save. You wait where? Then he's ready. Huh? Captain, that means that so far everything is right. See? Inside with you, Tonto. You'll have time for a meal. And while you're resting, Captain Lopez will fix up the package you're to take back to the Lone Ranger. Several days passed. And then, one afternoon, Bronson stood before a group of his men who were freshly mounted on spirited horses. Well, Burke, has everything understood? It's Los Altos this time, eh? Right. They need a little stirring up over that way. By the time me and the boys get through with them, they'll be stirred to a boil. Just leave it to us, boss. We'll have them hollering so they can be heard clear over here. Not so worried about those fellows who were here last week as you were, eh? Shucks told you they'd get over there scared, didn't they? And I told you I'd show them some action. Well, they were just a week ago today. They gave me a week to clear out. This is my answer. Another raid. We'll cross the Rio with the four near the Twin Forks. Be dark when you get there. Yeah. And put on your uniform before you cross. But don't take a chance while they're daylight. You can bet we won't. You'll be seen in those uniforms only north of the border. The soldiers down this side catch you with them. You'll find yourself lined up against a wall. That's something we ain't forgettin'. Then get started. I'll look for you back about sunrise. It'll be just about it. Ready, fellas? Ready to go! All right, let's go! Bronson's men had made this trip many times. The trail where they planned to cross the Rio led through a cut in the hills just before it reached the river. As they drew near this point, one of the groups spurring his line drew alongside Burke. Hi, Burke! Huh? What is it? I'm in a certain shore, but I'd almost swear I've seen a horseman cutting this way from the east. I never seen nobody. You fellas was on the trail. I rode the ridge for a minute to have a look around. Whereabouts would he be? I said I was in a certain shore. Tell me what I'm asking you. You did see somebody. Where would you say he'd be now? Well, like I said, he seemed to be coming from the east. Likely following the regular trail. That is what I'm asking you. The regular trail. That had put him somewhere beyond that rise just over there. We wouldn't want to be seen. Hear that? The Black Caballero. He caused his horse to held the envelope. Oh, it's right up below. Anybody? He was alone. We want that, Andre. Mix, cut. Yeah. Jeff, follow me. Pete, you cut over towards that mesa. The rest of you hide tail for that arroyo. Don't let him get through you no matter what he does.   Get down off that saddle. No, I have but for a moment. Just ain't got no time to spare, huh? I said, Jeff... I'm sorry, amigo. That is my effort. You headed. By a few, so sad.  In that case... You talk, huh? You're mistaken, amigo. I was about to say that I'm more sorry, but still I cannot talk. We ought to make him tell where his mass parts hanging out, Burke. Where is he? Can't answer that either. You ain't... Wait! Well...  I'm betting he's hiding something there. He don't want us to see. Come on!  Hiding something, huh? Hand it over. Well, please! Grab his arms! I got him! No, you!  I'll see what you got there. Well, an envelope, huh? Kind of a big one, too. I beg of you, amigo. Do not read that, but it's not for you. Don't see no address on it. Reckon it's for almost anybody. Well, we'll have a look. Stuff full of holes in mine. This is something worth finding. Oh, we'll be sorry for this, my friend. Next to me like you're the one that's sorry right now. Hey, ain't that some writing with it? Yeah, hadn't noticed. Maybe it'll tell just who was hoping to get this cash, but ain't. Read it out loud, Burke. Yeah. What is it? What does it say? Jeff! What's the matter? Listen to me and don't ask questions. Get on your horse. Get on your horse! Sure, Burke, sure. You're riding the way we were going to cross the river. But make blame, sure nobody don't see. Uh-huh. Find out if there's soldiers hiding out there. There is, you make tracks back here. Soldiers? You mean they laid a trap for us? A trap! That ain't the half of it. All right, Jeff, get going. Get up there! Get on there!  Mr. Blake Cavallero, your slick scheme didn't work. Sell us out, huh? Well, this is one time we ain't getting caught. In less than half an hour, Jeff returned. He drew his mount to a hall where his companions waited, and... There's soldiers there. I've seen them. They're hiding the trappers. Only they won't. We're crossing the Rio boys, but we're taking the hilltop trail.  Get up there! It was several hours later, but the lone ranger in Tonto suddenly climbed the steps of the ranch house where Bronson made his headquarters. Then, suddenly... Don't reach for that gun. I wish I'd have got you. I saw you coming here. You're at the end of your trail, Bronson. You're crazy. In just a minute or two, we'll have all the evidence against you we need. That's a blasted lie. And your own men will furnish that evidence. Squealing me? No, I know your locos. Yes? They no blame well out, particularly no matter what happens. Why should they talk? You'll see. And who's going to make them talk? Captain Lopez. Lopez? They caught your men as they tried to cross the Rio. I don't believe it. Look out the window. Soldiers! For the men you sent to raid in the states. But if they caught them at the border, that's no proof. They didn't catch them raiding. Here they come.  Mind them action always.   No! Fuck! No! What do you mean? That's not it, friend. I'll not hit him again. I ought to kill him. There would be no fighting with the priest. Have any trouble with them, Captain? But no, Senora, with the mask. They fall into the trap most easy. They see the few soldiers I leave between the forks and take the trail to where I await them with the rest of my troops. Now they're my prisoners. But look here. You look here. Sell us out, will you? Well, you don't sell us out, mister. Without we take you right along. What are you talking about? This is what I'm talking about. Look here. The case of government was paying you. Nobody was paying me anything. Don't try to lie out of it. Show them the rest of it, Burke. Maybe he doesn't figure we know the whole dirty scheme. Yeah. And here's the letter that was along with the case. Read that. This is addressed to me. Sure it is. That's the whole point. But it's not true. There ain't a thing in here that shows. We figured you'd say that. You wasn't only selling us out. You were selling out Chauvetes. He trusted you too. Wait, listen. We've heard enough from you. You have let yourself be tricked. Yeah? I suppose it doesn't say right here what I think it says. I suppose this part that says it was glad to hear you was willing to come to terms ain't so. I suppose it doesn't say there ain't close on the case you ask for. If it doesn't say you'll get concessions from the fellows running the present government in exchange for ditching Chauvetes and turning us in. Well, you won't let go. The rest of you gentlemen, you're all agreed on the charges against Senor Bronson and Senor Burke have stated them. Bronson was behind the whole thing. Bronson, you blasted sneak and sidewinder.  Sell out the fellows that worked for you. Sell out your own partner. They've done a lot of things in my time. It wasn't to be boasted about, but never nothing as low as that. That'll be enough. Captain Lopez, are you satisfied with the evidence you have here? Wait, these men will testify. There's no question, but what Senor Bronson will be convicted. Good. Come on, toddler.  Yeah, may go. Well, Senor... Our work is not yet finished, Captain Lopez. We'll see you again. You tricked me. I don't know how you did it, but I know the whole thing was a trick. Senor Bronson, he's most unhappy. He'd be even less happy if he knew that Captain Lopez put all that information on the official stationery, just for the purpose of making it look as though Bronson had sold out his men. See, in no other word do we ride. Yep. There's still another to capture. Punks, oh, solvers. Ready, toddler? Get it up, scoundrel! They copyrighted feature of the Lone Ranger Incorporated.


Welcome, everybody, to this next talk inside Android Safety Net Attestation, Attack and Defense. First of all, I would like to see a show of hands who among you has already developed an Android app. That's almost everybody, I would say, something between 90% and 98% of you and who of you has already used the Safety Net Attestation API. Please, another show of hands. That feels more like five or six and who of you has already heard about this API before coming here today? That's more perfect. That's why you are all here, I guess. So gear up for a very informative talk by Colin Maliner, an expert in the field of security research. And he's also the co-author of the Android Hackers Handbook. I'm very excited for his talk. Please give him a warm round of applause. I write in, this was basically, yeah, just some.  But let's get right to the talk. So what are the goals for this talk? The main goal for this talk is, of course, understanding what Android Safety Net and especially the Attestation API is, and actually how to really implement and deploy it. As you will see throughout the talk, it's not like that straightforward, unfortunately. And then we're just going to look at the Attestation API, really what can it do for you and what can it do for you? And I guess with most security systems or features, it's very interesting. The part what it can do is the most interesting part. And then we're going to look at some attacks and bypasses from other people and some of my own work. And the second main goal of this talk is basically document this API because Google's documentation is not very good. And that's how I thought, hey, let's talk a little bit about this. So of course, this entire system and this entire talk is about app security. And back in the day, all other apps did not communicate. But these days, if your app doesn't communicate, who cares? And mostly, it communicates with an app-specific backend. And if the app and the backend, everything works. The user is happy. Everybody's happy. And if it doesn't work, everybody's unhappy. And the company will not make any money. And they will discontinue their service. So mobile app security is really, really interesting because these days, an app or a mobile app is really just the gateway to the backend service. And these days, there is a lot of online service, which are basically mobile-only or at least mobile-first. If you think about something like Snapchat, they don't even have a website or anything. And app security is also about basically controlling data. So who displaying data and managing data by the app and making sure somebody is not allowed to copy out data that is managed by the app? And altogether, basically, mobile app security is really about protecting your service, your revenue, your brand, and hopefully, really hopefully, your customer or the consumer. So if you look at ad hacks in general, what are we looking actually at? The main part is OS modification. Basically, on Android, we'd say rooting. And rooting is basically just the break the assumptions of the security model. Because if you root like your phone, you suddenly are able to basically take content from apps that didn't want their content to be taken in the first place. And you can do this by just reading data or taking screenshots or instrumenting the app and pulling data out of it. And of course, you can also just modify the app directly. And then you can change whatever the app is doing or what the app is enforcing. And of course, there's also network traffic. But in this talk, I'm not going to look at network traffic at all. So if you look at rooting, what is rooting actually? Basically, it's regaining full control over your device. Because these days, any kind of phone or tablet, basically, you don't have root anymore. You don't have full access to everything like on your computer. And with rooting, you gain access again. You gain access to resources. You can read and write any file and modify parts of the SOR, like the software framework. And all of this rooting capabilities really highly depend on Android versions and really newer Android versions are much, much more hardened due to, for example, as a Linux policies. But I'm not going to jump into that part. So if you look at app security in the old days, what did you have? There were basic rooting checks. So apps would implement something like, hey, is the system, does system expand as you exist? So they were just checking, hey, did somebody root the file and reinstall as you? And if that was true, they would just say, yeah, your device is likely rooted. This app is not going to work. And the same with apps. They would just check if a specific package is present. Or they would check if expose is installed. And maybe would try to detect emulators by just seeing what get device ID returns. And if it returns zero, it's often like an emulator. So that's really the old days. And the old days, for the developers, it was really, really easy to implement because they knew they can just check for certain files or certain packages. And it's really easy to implement. You don't have to be a genius. You just have to check for this file. And then you can very easily deploy those kind of checks. But of course, for the attackers, easy as well. Because they also understand how this works. So they could just rename some files or move files around. And then they can, again, abuse those applications. So modern mobile app security really works by collecting data. Basically, you have some piece of code that just collects data and just sends it to the back end. And your back end will make the decision if a specific thing happened. For example, if your device is routed. And the idea behind it is that the attacker cannot just patch out your app, patch out checks on your app. Because imagine if you just have to file access check to a system bin as you, you can just remove that. And then the app will just work. But if you collect really a lot of data on the device, you really don't know what is used for what. And you basically have to fake all the data. And if you collect really a lot of data, you can't really do that. That's basically what all modern apps that have a high demand or a higher demand for security do these days. And also that is what safety and adaptation will do for you. So just to go a little bit back to Android. So in the early days, Android was very, I would say, very open. But these days, a lot of openness, like when the waves, they have secure boot now, which is basically just a trust anchor. Basically, they just are able to tell if you unlocked your bootloader and things like that. And of course, there's way more as a Linux restriction. So they have much stricter sandboxes. And then Google added this platform security service called SafetyNet. And SafetyNet is really just a brand name for security services on Android. They have a bunch of different services from verified apps to check for PHAs, which is Google's nicer term for malware. And then you have attestation. And then you have a capture service. And SafetyNet, in general, is designed to run on any Android device that has Google Play. So it's part of Google Play services. And the nice part, it's independent from the manufacturer. So this exists on any Android device, not only on the Google devices. And with attestation, you can do remote device and app attestation. And of course, Google also heavily uses their own APIs. For example, if you ever used Android Pay and saw this nice pop-up that meant SafetyNet actually failed to validate or attest your device or, I guess, the Android Pay app.  And one of the intentions, I think, behind the attestation part was they can't really control security of other manufacturers' devices, but they wanted to support Apple Pay on them. So what did they do? They basically found a way to measure if your device or the device's Android Pay is running on. It was modified. And the nice part is they can really change SafetyNet, like the attestation part, on the fly. So you don't have to wait for a system software update. Basically, they can push code to the device at any point to check for modifications. And with that, they can really fast react to, say, new routes or something without having any software updates being delivered to the devices. So what is actually the attestation part? It's really the attestation of the device and the specific app that called the API. That's basically all of the things people used to implement themselves. And as I said, it's part of the Google Play services. And basically, you just call an API and validate that your app and device is the device of the user was not modified. Unfortunately, the documentation, as I said in the introduction, is not super detailed. And they leave a lot of things to your interpretation or just you have to basically use it to find out how this really works. So over time, it got much better. But when I started looking at it, which is by, I guess, yeah, one and a half, two years ago, some of the documentation was really bad. And they add new features without really documenting them. They have a private mailing list where they announce some stuff. But yeah, this is probably, I guess, the only piece of code, actually, I'm going to show. It's basically just how you call it. So SafetyNet is part of the Google API client. And you basically just say, I want a connection to the SafetyNet API. And then you just call it. So how does it actually work? So here in the middle, the box in the middle is basically that's the software that's running on the phone. You have the backend, the Google Play backend, and your application's backend. So if your app doesn't have its own backend, you really can't use SafetyNet at all. And you will see in a second why that is. So basically, what happens if your app talks to your backend for maybe wants to log in or do some very specific operation, and then your backend will say, hey, dear application, I need you. I request you to attest yourself. So the backend will basically send a request to its app. The app will then call the SafetyNet at the station API. And in this step, you actually see the attestation code on the device will inspect the device itself. So the operating system was it routed. And then it will also inspect the actual application. Some minor detail in the call, there should be a nonce to prevent replays. It's just like for documentation.  And you will have all the work done by Google engineers to do your security configurations, or security attestations. So what happens after attestation has checked you up on the device, it will send the data back to Google. Google will actually analyze it, and then will determine the state of your device and your app, and actually forward the response to your app in order to make sure the app, because if you modify the app in this case, and if it would not be signed, you could just like tamp it with this attestation response. So this is signed. So in the backend, you should validate that signature, and then validate the attestation, and then you actually know what you're dealing with. That's basically what you get back. It's really, really, really simple. Just some blobs of base 64 encoding. So Google has a signature validation API, which is basically just for development purposes. But yeah, that part is actually pretty well documented. I guess they do that a lot, like SSL, CertValidation. But let's look at the attestation data. So the attestation data, that's basically the main blob. You get back everything else is just like a chain and the signature. So you see the CTS profile match, and that's basically the core device integrity measure. And CTS refers to the Google compatibility test suite. So basically, whenever you build an Android device, you have to run this test suite and give Google the results. And basically, what this API does is basically collects data from your phone, and then it compares it to the data the manufacturer provided. And by this, they can determine if you modified contents of your system file system. And then you see which APK called the API, and then you get a digest of the APK itself.  And the basic integrity is an indicator about routing. So this nice table was actually only, I guess, probably added to their documentation maybe seven months ago. And before, it was like, yeah, there's a true and false field. And yeah. So basically, here you can see, CTS will only be true if your device is genuine and passed the CTS data corresponds to the data that was collected. If as soon as you unlock your bootloader, that goes to false. But basic integrity will still be there. So if you just unlock your bootloader, but didn't modify actually the content of your file systems, your basic integrity is true. And that's basically, those two different indicators will basically help you to understand the state of the device. And with this nice table, you can basically implement your checks. So I wrote this small demo. I actually implemented that for a bigger company. But I also built this small demo app, which I'm going to show you at the end. And you see some, it will basically just run this attestation. And it will tell you if your device is rooted and what the app integrity is. And you see the blob of data below. And you see everything is, it passes all of the checks. And we're going to have some more fun with this later. Yeah, the big issue with safety net and the attestation API is error states. There's a ton of different errors. And if you don't know what you're dealing with, you can basically very easy bypass the entire system. If you as an implementer aren't aware of error messages. So for example, this is one of the nice basic errors. Basically, for some reason, the API call actually worked. But somehow the code inside the API just encountered some random error. You will get this. And they basically say, oh, yeah, we just have this random error message. And you're going to find out how this actually looks like. Because this is not really documented. And this error basically just means just call the API again and try again. Most of the time, it will just go up. Yeah, this is one of the more interesting errors. This basically says we can't really determine which API called the API. Also, they kind of think the device is generally untrusted. So they just removed a bunch of fields from this JSON response, which is also very confusing if you implement this the first time, because you suddenly get broken data blobs back. And again, of course, this was not really documented. So now you know, basically, we have this API. And maybe the JSON field looks strange. So basically, now you can go and implement your app. And have the interaction between your app and your back end, and your app running the attestation. But unfortunately, it's still not that simple. So also, all of the API calls can kind of fail. And they actually will fail on the wild. Like every API you call will actually fail at some point depending on your user group. If you're playing at home with one of your devices, you will never see any of those errors. But if your app runs on 100,000 or millions of devices, you will see every error eventually. When you have things like, oh, Google Play Services doesn't support SafetyNet yet, so what should you do? And one part is you can just force a user to update their Play Services. Or then there is just general error, connection errors. And in those cases, you just really have to retry. If you forget to handle one of those errors, that either means some client will basically not work on your network, or some client will be allowed to connect to your service, even if it was tampered with. In the lower three cases, that's really something you should actually be able to see during development. Because of your nonsense to short, it will actually just like directly fail. Yeah, some more examples. So I just uninstalled the all Play Services updates on this Nexus 7, which is an Android 4, which also doesn't have secure boot. And then if you just start the application, you'll just like nothing will work. Because you really need to update those Play Services. So a lot of the API failure things are basically temporary failures, so you basically have to start with retrying everything. Generic errors, networking errors. And in general, you should be like a good citizen and basically do an exponential back off after each failed try. Also, you can look into this JSON field or this JSON blob on the device itself and then determine if you want to do a retry, then you don't have to do a fall round trip to your back end. But basically, what you really need to do is report any of the failures to your back end and really plan what you're going to do if some device keeps just like throwing errors. Because that's, in the worst case, a user of your app that can never use the app because if they have some random error. So you have to really think hard about what you're going to do. Unfortunately, this, of course, is an app-specific behavior. Because in some cases, maybe it's going to let the person use it once or twice. But maybe you say, we never want anybody who fails this to ever use our service. And this is really more app-specific decisions. So let's look at, yeah. So the main function, or one of the two functionalities, like the OS and device integrity check. And that's basically just like those two fields which give you true or false. But app integrity works a little bit different. Because Google can't really tell you if your app integrity is there. And you have those two fields, the APK digest and the APK cert digest. And the cert digest is really like the digest of the key you assigned your APK with. So in the easy mode, so if you re-sign an application, the cert digest will be, of course, different. So if somebody just uses APK tool on the app, modifies the app, reinstalls it, the APK cert digest will be different. So the most easy check for app integrity is basically just like compare the APK cert digest. And you kind of say if you have five different apps, and most likely they will all be signed with the same cert, you basically only have to hard code this cert digest until you're back end once. And you can just always compare that. If you've done this, it's basically a very, very simple comparison. But with that, you can know if your app is not tempered with. But you can also go into advanced mode and basically also compare the APK digest. With that, of course, a little bit different or a little bit more difficult, because that means for every single APK you ever released to the app store, you basically have to record the digest of the file. Because if you didn't do that, you will just reject people and say, hey, we don't recognize this app. Yeah, you probably modified your app. But in reality, maybe you just forgot to collect the data. So you have to have very tight control over your release process. But you can do cool stuff like revoke specific APK versions at this very early part and the communication with your server by just deleting that specific digest from your database. And then SafetyNet will basically block this APK for you. So basically, to do the implementation and deployment, on the client side, you really have to check for error conditions, retry, and report failure codes in the back end. You really have to make sure to validate the signature and the attestation data. Check really all fields, timestamps, nones, and really make a decision about failures and what you want to do. And especially things like, do we want to force users to update their play services? And maybe have something like a white listing mechanism where you can whitelist maybe specific kind of devices because you will run into problems and you probably don't want to prevent a specific user group from not being able to use your service. So that's basically the part about what is at SafetyNet attestation, how does it work, what you should look out for when you're trying to implement and deploy it. But of course, as I guess anybody who is interested in security, and if you implement a new security system, you really want to know if you can actually trust that system or if it just does nothing. So when I first looked at it, I was like, let's see how good this actually is and can we do bypasses? And also, what are the limitations? Obvious limitations, I guess, were different Android versions because on Android 4 and 5, you really don't have this secure boot state. Applications cannot determine the boot state. So anything that would be based on unlocking your boot loader would basically work because if you can't detect that the boot loader is unlocked, you can't unlock a boot loader. And on Android 6, of course, you can detect the boot state. And then you can actually rely on everything that is based on the secure boot mode. But this, of course, already shows you that all devices are very much harder to judge in terms of the attestation system because of certain limitations of the actual OS. So in your security policy in your back end, you basically have to know that, hey, if something, like Android 4 or 5 devices, we might not be able to see certain things if you just use safety net. And you have other things with Android 4, so you don't have the invariate that means you can just remount and write or change files on the system partition. So you can do fun things like change, or rename, or move system X when it's used to some other directory. And then if you just run your safety net-enabled application, you will totally bypass. Or you will actually not bypass, but you will just pass the attestation because the system will say, yeah, fine, nothing. It was modified. And then after using that app, you can basically restore SU to, like, by copying it back. You could also, and that also is like another basically indicator of what you should do. If you only, like, basically run safety net on app startup, you can do things like that. But say if you use it more often, like at random intervals, just the back end server is like at random intervals, just like says, hey, can you rerun this attestation for me? Those things have become a little bit harder. Of course, none of this is documented at all. So this is my small demo application again. It's like this was like a Nexus 5, X with Android 6. And I just unlocked the boot loader. And then if you run the attestation, we'll see something like this, like CQ boot mode. That actually doesn't come from the attestation API. I just read that from the system properties. But it basically detects, yeah, unlocked boot loader. And so it will change, yeah, where is it? Yeah, the CTS profile in the middle to false. And it would also give you an advice. It's like, hey, you should relock your boot loader. And this advice field is also something that just added. I think earlier this year, just under, just like that, just added it. And you were like, I was looking at this JSON file. I was like, hey, there's a new field. And it's undocumented. Nice. So suhide and magisk. So obviously, if a system like that exists, people will try to bypass it. And one of the first bypasses for this was suhide. Basically, you can call it a root kit because it's really just hiding, trying to hide, basically, that you're rooted your device from safety net. And that was the suhide was very simple. And Google very easily actually detected it. And you could actually read in forums, like the people would post, oh, I can't use suhide anymore. They did not detect that. And two weeks later, it was like, or maybe two days later, there was an update. And it worked again. And then it was detected again. And that's really where this short iteration cycle, due to code pushing, comes into play. But Google can just really fast react to whatever changes.  Like, they can change their detection so fast.  Then just updating. But then there's Magisk, which is a more modern way of basically hiding root. But Magisk is based on unlocking the bootloader and patching as a Linux policies and so on. Actually, this is, as far as I know, completely undetectable at the moment due to safety net actually not running with full system privileges. But in this phase, you really have to unlock and modify or unlock your bootloader and do heavy modifications. So it's not probably done by a lot of users. But yeah, basically, those two are basically real root kits to hide root from security services on Android. And yeah, Google is playing a nice cat and mouse game. So yeah, and also, those two basically just try to hide system modifications or routing, which is only one aspect of safety net, or the safety net attestation API. So I was more interested in app integrity because the other two checks can obviously be bypassed. And really, nobody ever looked at app integrity. And I was really wondering why. And I was like, yeah, that's kind of interesting for us. So I was looking into app integrity. And basically, the goal behind app integrity is really to detect if somebody modified your application. And you do that by looking at the APK digest on the cert digest. Because if you could modify the APK, you can do something like remove the TLS cert pinning and modify traffic and things like that. So and you probably don't want that to happen. So that app integrity is very interesting. So how does app integrity or how does the cert digest actually work, or the APK digest? The interesting part is those two values are calculated on the APK file that is stored on disk. But if you know how Android actually works, you know Android doesn't actually execute the APK. Because APKs contain DAX files, and until Android 4 DAX files would be converted to ODEX, like optimized DAX files, which is like a bytecode. And Android 4.04 and 5 and later would just compile the DAX code to a native code. And there was three years ago, there was some work done on patching ODEX files. So this problem of calculating check sums on our digest on one file but executing another file can, I would say, obviously be attacked. So if you rehash the code running again, so on Android 4 and 5, you basically have the data directory, and we have under data, you have app where you're like APK sets. And then you have the program data, and then you have the code in data, Dalvik cache, and then you have this super long file name, which is basically the very optimized DAX sets. On Android 6 and later, you have just your package directory, and in the package directory, you have an APK, and you have the base ODEX file. But in this case, it's actually not an ODEX file. Oh, it's like an ODEX file, but it contains native code. The interesting part is those files are all owned by the system, and they can only be read and written by actually install D and Zygote. So your own app can actually not read its own binary, which makes this very interesting. Because Zygote just loads it into memory and then executes, so your app doesn't really need to be able to read its own code. So if you go back and look at generic app modification, how does this actually work? Normally, you would do something like APK tool, and then you just unpack the file, modify the Smiley code, and use APK tool to rebuild the APK. Then you just sign it to sign the file, and then you can just run the modified APK. Of course, in this case, the signature would be broken because you don't have the author's keys. On the device, APKs are compiled using DAX2out. We can just say, this is DAX file, this is the ODE file, and then you have the modified APK. So then what you do with this ODEX file, you still have to patch the modified ODEX file to be the ODEX file contains a CRC32 of the DAX file it was generated from. This is not a security check at all, it's just for the VM. So the VM can see that maybe the APK was updated, and now the CRC doesn't match the DAX file, and just recompile it. That's just a pure let's not run old code feature. It's not a security feature. And in order to patch the CRC file, I made a small tool that's really tiny, and that's also open source, where you can just patch the CRC of the ODEX file. So what you can do, basically, which will work on any Android version, you can just like, you need to override the ODEX file of the specific app. So if your device is rooted, you can just go and overwrite that specific file. And so either in the Dalvik cache or in the app, ODE cache, and then just stop the app and restart it and you can just have this modified APK. And it will actually bypass all of the checks because you only modified the code that's executed, but not the original APK. And then, of course, you have to unroot because you want to still pass the general device integrity checks. So if you go back to, if you think back about earlier slides where I said, oh, on Android 4, you can't really detect if a bootloader is unlocked. That basically means on Android 4, you can trivially bypass app integrity checks because if you have a root that is based on an unlocked bootloader, you can just do that. So that is bypassed. But I was like, yeah, so I bet we can also find other ways to do this. So the main goal for this attack is like as before, we really want to overwrite this one ODEX file. But we know only basically two demons can actually write or two binaries actually have the as a Linux privileges to write to this file or this class of files which is installD and thygod. But who else can write to any file in the file system? Of course, the Linux kernel. Because access anything that's like as a Linux or file permissions do not exist for the kernel itself. And two years ago, no, one year ago, there was this nice kernel bug by the name of Dirty Cow, which for this talk, I just like, yeah, you basically allowed you to overwrite any file in the file system that you can read. So as a shell user, you can obviously read all ODEX files. So now we can go and basically, since we can read any ODEX file, without routing the device, we can actually do this attack without routing a phone. So basically the same procedure, we APK tool the file, modify the ODEX file, and patch everything. But the one small issue is Dirty Cow cannot only overwrite files, but basically not depend or increase the size of a file. And the one easier trick that I've found is, so normally Dex2Out runs with processor-specific optimizations. As you can see down here, it's just like Cortex-A53. And optimizations can usually make files much bigger. So if you just compile, if you just run Dex2Out without optimizations, you will actually get a much smaller file. So even if you add a lot of code to the patched app, your file will still be smaller. And you can very nicely overwrite the ODEX file using Dirty Cow. Yeah, I'm actually going to show you, do a little life demo, because it's actually that simple. First, I'm going to show you. So let's see until I just have to wait a little bit until the camera adjusts to the white. There we go. So this is like the demo app I wrote. Yep, and we pass all of the checks. And so basically, un-routed device, un-modified app. Looks good. So is this readable? I think that's OK. That's fine. So this is the APK. So if you just unpack this APK quickly, and then we're just going to modify some code. So this is just some smartly code, which I'm going to patch into this application. That's all we need. So and now we can just rebuild with basically use APK tool again, and also use the JAR signer with the default key store to just have a self-signed APK. I guess I didn't set the path for that. Where is that path? Who knows where that file is? It's in build tools. Now I have the path for JAR signer, the command arguments for JAR signer. Yeah, that I guess I should have. Where is that? Oh yeah, I heard JDK is where that's exactly where it is. Where is my JDK? Definitely not here. Where is the JDK? There we go. It's like checks. Nope, should be more of those. Yeah, I was pretty sure. There we go. OK, so let's do this again. Yeah, so now we've re-signed the app. So what else do we need to do? So we have our re-signed app. So we want to compile this app on the device with basically pushing the new APK and getting the modified compiled ODEX. Now we want the original base file because we need to extract the original CRC. And now we can do, let's say, this is the original one. And this one is the one we want to change. So what you're going to do here is I want to change this one to this one. Now if we write it on this, nope, old CRC, new CRC. Yeah, it's always nice if you forget the command line of your own applications. And now we modify. Yeah, now it's modified. So this is like patched. And for the attack, basically, we push this modified app, the modified ODEX file to the device and then run dirty cow. It's another nice point of failure in this demo. And it didn't work. I can try again. I have a few more minutes. Yeah, I like life demos. They just turn to sometimes they do not work on the first try. It's all good. So you're just going to reinstall the original APK. Since you already have all the modified files, you can just skip everything else. So let's try it one more time. And it worked. So let's go to the camera. Let's wait until the white. And now you see this nice pop-up we added. And you will see all this checks passing. And so, yeah, and basically an unrooted device, but complete, basically, app compromised from the integrity level. So what is the actual impact of this attack? Yeah, it's, of course, limited to Android device. It's still vulnerable to dirty cow. There's probably a lot of them. The nice part is that basically the owner of the device has to perform this attack himself. Because apps, so if you get a malicious app that runs on your device, it could not modify another app because apps cannot open ODEX files. So that's good. Of course, the attack goes way beyond safety net attestation. So any device that any check you do on ODEX files or something will be vulnerable to this attack. The nice part is Android 7 devices will not be vulnerable because Google changed basically the policy for their CTS test. So they will actually check if your kernel still has this bug, and then you will not get Google certification for Android 7 devices. The generic attack I told Google many, I guess, now it's probably two years ago. So they know it, but it's hard to fix. Copperhead OS is like hard Android clone. They actually, not by accident, by design, mitigate any kind of these attacks by just recompiling every app on every start. So that would kill modified ODEX files. So I made some observations over time. So basic integrity was just like July 2016. Suddenly I found this, and I was like, hey, does anybody know because this is not really documented. And then again, I guess May this year, they added this advice field that will tell you about your bootloader or please reflash your device because we determined your device was temperate. So that was kind of interesting. Now there's also a mailing list where you can subscribe and they will tell you, I guess, about new features, but the website will still not be updated in a timely way at all. Also, the little bit more interesting part, so since attestation is based on CTS data, and CTS is run by manufacturers before they release an update or a patch or a phone, so if this data is false and not up to date, of course, the CTS test will fail and will tell you, like, hey, your device has been modified. And I actually found that on some Yota phone where I guess they rolled out a security patch and did not submit the CTS data. So on all of those patch devices, actually all of this would just fail just because Google didn't have the up-to-date data. And actually Google did it themselves. Here in March this year, Google had to pull a security update for the Nexus 7 because it broke their safety net and thereby also Android pay part. And that's probably the last part. I don't know how that happened, but basically if safety net attestation has an outage and you can't react to this outage, you will have an outage too as an app developer. And you probably do not want that. The fun part about safety net in general, Google really improves it all the time. If you follow forums, routing forums, and so on very closely, you will see this cat and mouse game. And it's mostly, for Google, I guess, mostly about protecting Android pay. But yeah, I guess the big benefit of safety net and the attestation part is that really you have a bunch of people at Google who constantly work on improving basically the results for safety net. So if you use that to secure your own app, you get a lot of security for free, where you otherwise would have to employ a bunch of people or buy a third-party product that does app and device integrity checks for your service. The nice part is attestation is free. But of course, it can go down and have outages. They basically don't get an SLA. There's rate limits which you should never be able to reach. Yeah, and it's free. If you compare it to third-party services that are not free, this should be interesting. On the side note about malware, so there's a lot of Android malware that basically is repackaged Android apps. So basically, people just add whatever they want to do to Angry Birds, and then you will download that modified Angry Birds. If that game or that app would actually run safety net, they would basically that repackaging wouldn't work, because the app would just say, hey, I was modified and it don't work. So they have to either cut out a lot of functionality of that specific app, and they probably won't do that because they will just go after some other app. So you can basically use this to basically prevent your product from being targeted by app repackaging malware as a side effect. So summary and conclusions. Basically, it's one of the essential platform security services. And if you're serious about any kind of app security on Android, you should really, really use it.  And the majority of apps will just benefit from this. And it really will really get better over time. And you can really see Google doing improvements to that. And that's it. Slides are online. Tools are online on my GitHub page. Or if you go to malinar.org slash Android, you'll find everything related to this talk. Some more references to read up. That's it. Thank you very much. And I guess we have two minutes for questions. I'd like to take one question from the internet, please. Oh, and we just mentioned that people really like to run in the Q&A, and Google has another tool in the Q&A. We do the Q&A. Yep. What does safety net not run with full permissions? Because it runs inside the Google Play services. Basically, the Play app, the Android Play app service, and that only runs as system service. And so it doesn't run with full services because of that. It just runs in a slightly privileged app. And I think that's by design. Also, think about other manufacturers, like maybe Samsung or HTC. Other companies probably do not want to have a super high-privileged Google process on their phones. Now, it's just by design. That's the only thing I can think of. Yeah. Thank you. Next question from microphone number two, please. Hello. Can I hear you? Yeah. Thank you for your talk. First of all, it looks like safety net runs under a system user, right? Yeah. And it has way more privileges to check for a file system when ordinary application. Yes. Do you think it is still worth to do enough checks for things like root attack devices? I think that it really depends on your risk model. If you're very concerned about modified apps or modified devices, of course, it makes sense to add your own checks in addition. But I think if you're starting to develop a new app, you should first implement safety net at a station and get all of this right. And then you can start investing money to build your own. Because if you start rolling your own, basically you have to have a team that constantly keeps up to date with Android versions. Because if something changes in your app and your own detection has false positives, you will just disable your app for a lot of people. So yeah. It's like depending on what you want to do and how much you want to spend on that. Thank you very much. Unfortunately, time is up by now. So whoever else has questions, please find Colin after the talk. I know you probably all know that it's pretty nerve-wracking when you're on stage. And your demo or whatever you were planning in your presentation doesn't work as planned. So I hope that you're going to show a lot of empathy and give Colin another big round of applause. Thank you very much.


It's been a really wonderful day today, the first day of our major conference on women and national security and so I want to welcome you to the National Gallery of Australia for what I hope will be a different tempo, a different tempo of conversation but a conversation that's no less fascinating and no less serious. I think a few lessons as head of the National Security College that I and my colleagues have drawn from the proceedings today. I think one lesson which we shared a little earlier today is the importance of listening and the importance of really listening to the flow of discussion in the presentations today. We've taken a few views away that we'll certainly be applying next time we hold an event like this. One is that as I think to reflect on what the secretary of attorney generals noted this afternoon he began to realise how it felt to be a woman at some conferences that he's attended. We will encourage more men to be in the group of participants for a conference like this in future because I think there are so many powerful messages that we'd like to share more broadly. Secondly, the appetite, the demand really for more awareness and education in this space and of course as an educational and training institution the National Security College sees it as its core mission really to increase the networks, increase the awareness on the whole range of critical national security issues. I'm really pleased to say that we'll be introducing an executive development course on women and national security drawing very much on the conversations, the themes, the outcomes of the conference today and we will also in our academic program be looking quite seriously at the prospect of introducing a course on women and national security into our master's degree. An immediate I guess lesson learned, thank you. I'd also just emphasise I think as Francis Adamson drew out this afternoon that an event like this really is very much a team effort and not only my colleague Marina Tservas who's seconded from the Department of Prime Minister and Cabinet but others as well Sharon Deane seconded from the Office of National Assessments, our events and policy officer Chris Farnham, Chris wherever you're hiding and a whole range of other colleagues from the conference from the College I'm sorry have really done all the work behind the scenes that have made this event what it is. So I'd like to ask you to also join me in acknowledging the team if you like. And so in a moment I'll be inviting our guests from the ACT Government to really commence proceedings tonight and later I'll be inviting the Acting Vice Chancellor to invite Penny Wong up to the stage, the Shadow Minister for Foreign Affairs. But in the meantime before dinner before our mains are served I would like to welcome Minister Megan Fitzharris from the ACT Government to the stage. We had a great conversation this afternoon Minister on themes that would be very familiar to your experience so if I may I'm just going to share a little of that with the group the importance of women as practitioners not only policymakers but practitioners in the national security community and the perspectives that they bring and of course Minister Fitzharris as many of you may know but perhaps not all of you know has background and experience in the space that we're discussing today as a practitioner in national security. Before she entered the ACT Legislative Assembly she worked for the New South Wales Police during the Sydney Olympics and as a Senior Policy Manager for the Australian Federal Police and for the Commonwealth Attorney General's Department. Now of course and I note as someone speaking from a university Megan it's fantastic that you're the Minister for Higher Education but also the ACT Minister for Transport and City Services, Training and Research and Assistant Health Minister. We're really honoured to have you here with us tonight. Please join me in welcoming Minister Negan Fitzharris. Many thanks Rory and thank you very much for the opportunity to speak with you this evening and welcome you to Canberra on behalf of the ACT Government. I'd like to start by acknowledging that we meet on the land of the Ngunnawal people and pay my respects to their elders past and present and particularly acknowledge any Aboriginal people joining us this evening. It is a real pleasure for the ACT Government to play a role in sponsoring this. At one level I was surprised to think that it was really the first Women in National Security Conference that had been held and it's so great to see so many women who are practitioners, who are policy makers, who are decision makers in this space because we know that national security really matters to women both here but particularly matters to so many women around the world who face insecure lives, who face lives of conflict and for whom national security, security, defence and law enforcement makes a very big difference in their lives. Women play a role in this space both at the grassroots level and being peacemakers in local communities right up through decision making in both the public sector, the private sector and the community sector in our NGO organisations so really great today to see so many of you who are at the table, who are having conversations, bringing skills, bringing your knowledge and expertise but you will bring a woman's perspective into this really important policy area and for that I think we will get better outcomes and people will be more secure. So the ACT government, you may see us popping up more and more in this space, we're really pleased because we are very proud of the institutions we have here in Canberra, we have of course major government agencies, Department of Defence, Foreign Affairs, National Security and Intelligence agencies, we have terrific higher education institutions and of course notably thank very much the ANU for putting on the conference that you are attending today and tomorrow but we also have of course major defence industry here, just a loan Department of Defence contributes $3 billion to the ACT economy, we really appreciate the role that the defence industries also play in Canberra, for our part the ACT government has identified this as a real opportunity for the ACT community and the ACT economy to grow, we have recently appointed former Senator ACT Kate Lundy as our Defence Industry Advocate and if you are in this space you will know that Kate is a very effective advocate for not only defence industries but for what the ACT has to offer as well and on that front just a couple of weeks ago we appointed our first Defence Industry Advisory Board to advise the ACT government of the opportunities that we can take to collaborate and to connect people working in this space with one another to really make the most of the incredible skill base we have here in the ACT in our national institutions, in our Commonwealth departments, in our universities and part of that is also growing the skills base here and one of the challenges that this industry has is a skilled workforce coming up and one of the reasons that we have some gaps in the skills is because we don't have enough women participating in this industry so that's why an event like this conference is really important, one that we're really happy to be involved in and to help sponsor, I would have loved to have come along to some of these but I did get a promotion last year and now I'm also the Minister for Health so we have the real pleasure in the ACT of having a whole range of different portfolios that intersect with one another but the higher education one is also one that's that's vital to the ACT so again thank you very much to the ANU and I hope you enjoy the rest of the evening and I very much look forward to hearing from Senator Wong and notably mention that so many senior positions both at the federal government level and in opposition are held now, foreign affairs, defence, I don't know if Gay Brotman is here but I know that she is also one of the shadow ministers in this space, there are so many women contributing, we hope to see more of them and we hope to see a second Women in National Security Conference, thank you. Minister thank you, thank you for those remarks and I think for the emphasis on education and learning which of course is as I reminded, core business for the Australian National University, I just would just add I guess one or two thoughts on that from the perspective of the college, National Security College and ANU more broadly and of course we have the Acting Vice Chancellor here who may say a little bit more later on but the mission of the National Security College is very consistent with the theme and the direction that we've heard so resoundingly today at this conference and that is really about improving the quality of policy and practice right across national security in Australia both at a Commonwealth level but also in engagement with state government, with local government and indeed with industry and on that note I just would also acknowledge the support we've had from industry for the conference today from Taylor's, from KPMG and also from partners, Department of Defence, Department of Foreign Affairs and Trade, the US Embassy, it's been really, really wide and resounding support and the ACT Government so thank you. Time for dinner, we will be inviting the Senator Wong to speak a bit later on but in the meantime please carry on the conversation and we look forward to more of those ideas, thank you. I'd also like to acknowledge first of all the traditional owners on whose lands we meet this evening, the Nanoa people and Pema respect to their elders past and present. I'm here this evening representing Professor Brian Schmidt, the Vice-Chancellor of ANU and I know he would be extremely, he is extremely disappointed to not be here to join with you at this conference and indeed celebrate the dinner this evening. He is overseas and unfortunately otherwise engaged at present for those of you who are star gazes and astronomers of course I expect he will be back in town at the 11th hour for the ABC BBC coverage and stargazing that will be held at Mount Stromlo and has been earlier this week at Siding Springs. We are delighted as the ANU to be hosting this event, I'd like to acknowledge also and thank the sponsors very warmly and our industry colleagues here following on from Professor Rory Medcalf's opening remarks but tonight our guest of honour is the Senator the Honourable Penny Wong, Shadow Minister for Foreign Affairs. Senator Wong was appointed Shadow Minister in July 2016 and this appointment followed a varied parliamentary career but one that has included responsibilities for trade, finance, climate change and water. Senator Wong has also served on many committees including related to intelligence and security. She was the first woman to serve in the positions of Leader of the Government and Leader of the Opposition in the Senate. Please join me in welcoming Senator the Honourable Penny Wong. Thank you very much to Margaret for that introduction and thank you for hosting me. Can I first acknowledge the traditional owners of this land and pay my respects to Elders past and present? Can I acknowledge my parliamentary colleague Megan who spoke earlier and my former parliamentary colleague Kate Lundy who's here. Nice to see you Kate. There are a few ambassadors and heads of mission here. It's good to see you. Thank you very much for your attendance tonight and your involvement in this conference. Thank you to Rory and the team for putting this conference together. It really is a wonderful opportunity to speak here at this inaugural Women in National Security Conference. It's obviously a pleasure to be here but it's even more gratifying to see a conference of this calibre focused on such an important issue. To those of you who are still eating please go ahead. If you've ever been to a Chinese New Year dinner you know what I'm used to dealing with. So she's right. Can I start by saying this I have always believed that our institution should seek to reflect the diversity of our community. So you may well be expecting me to bemoan the fact that there are still too few women inhabiting the secret coasters of the national intelligence and security community particularly in senior positions and you might expect me to issue yet another appeal for a concerted attack on the glass ceiling. You might also be expecting me to offer you all further encouragement in tackling the somewhat clubby character of the intelligence and security community which remains predominantly a male preserve. Let me say this. There is no doubt we need more women in the security business. Equally we need more women in leadership positions so can I say this to you tonight more strength to your arm collectively and individually in your pursuit of equality. But what I want to focus on tonight is why. Why women are so important in enabling our national intelligence and security community to meet the challenges that uncertain times bring with them. I want to consider equality with a focus on the why not just the what. At one level the rationale for more equal representation in the national security space is similar to that offered in the political and management spheres. As the 2014 UN Women's Australian National Committee's Conference on Gender Equality noted a more inclusive leadership cohort can improve performance bringing a diversity of experience and perspective to both problem identification and decision making. More generally there is a grown recognition of the relationship between gender equality and community well-being. Professor Valerie Hudson who is with us here tonight and whom you heard earlier today is perhaps the leading authority on this topic. As Professor Hudson wrote in her 2012 book Sex and World Peace the very best predictor of a state's peacefulness is not its level of wealth its level of democracy nor its ethno-religious identity it is how well its women are treated. There is intrinsic merit in greater engagement by women in our national security institutions and a stronger focus on women when identifying the collective problems we face and the solutions we help generate. My emphasis tonight however is that the time and circumstances we face make that cultural shift in both personnel and in perspective even more vital. I've previously made the point that we live in more than interesting times. I've suggested that the circumstances we confront go beyond uncertainty or even discontinuity and that this period is best characterised as one of disruption. Whatever nomenclature one uses I suspect we might find broad agreement around this central proposition that we are unlikely to successfully deal with today's problems by simply replaying our past responses. There is a need for careful reconsideration of what security is fundamentally about and whether our national responses to security issues are the most appropriate for these times. The paradigm change that may be necessary in our approach to security questions is only possible if the security community itself undergoes rejuvenation and transformation. One of the best ways to ensure fresh thinking and innovation in any business is to ensure that gender equality and ethnic diversity are put to work to drive change. Much of our public discourse and visible signs of our national security efforts focus on hard responses, CCTVs, bollards, static barriers and armed guards. Now there's no doubt these responses are necessary. The question is whether they are sufficient. As important as these may be, are we thinking sufficiently broadly both about security risks and the way in which we respond to them? Should we elevate our discussion of the values we are seeking to preserve as an open and inclusive society? Equality, cooperation, tolerance and compassion. Do we need to remind ourselves more persistently that we will not succeed nor become safer by closing ourselves off from each other or from the world? Security challenges are best met working with others rather than turning inwards. And history reminds us of the risks that inward-looking, disengaged societies pose. Risks of misunderstanding, of tension and of conflict. Senator Hanson's recent foray is a reminder of the risks we face.  Now I don't claim expertise in all these issues and you're all in a much better position than I to evaluate the various security measures that governments have mandated. And you're no doubt in a better position than I to assess whether the language we use to talk about security issues deals with them accurately and intelligently. And I want to return to that issue in a moment. But I can say this. The concept of security for most Australians would also encompass economic and financial security, affordable health care, job and income security, quality childcare and the promise of a dignified retirement. In other words, security has a much broader connotation than the more threat based protective and response concepts with which a lot of public policy concentrates upon. This of course in no way diminishes the work that you do. But what it does suggest, what it might suggest, is that a broader understanding of what security means for the general populace and where it impacts on people's lives may in turn expand the range of tools at your disposal and the effectiveness for the programs you design and implement. The philologists amongst you would already know that the word security and sinecure derive from the same linguistic origin. Siner meaning without and cura meaning care. So far from having connotations of sanction and punishment, the word originally brought with it the sense of being without care or worry. Disrupted times however bring with them a raft of care and worries. The French economist Thomas Spichetti has identified economic inequality as a principal cause of the political instability currently infecting Europe. The Brexit vote and its currently unforeseeable consequences, the rise of radical parties on both the left and the right, the resurgence of nationalism in countries like Austria, Hungary and Poland and the politics of exclusion on religious and racial grounds. Into this mix come historical grievances driven in more or less equal parts by colonialism on the one hand and its collapse on the other. And the picture becomes even more bleak when we see political leaders who reject the operating rules by which the international system has worked for the past 70 years by the emergence of new international players that want to impose new operating rules and all of this rendered even more toxic by the emergence of nihilist ideologies that advocate death rather than tolerance. You would be familiar with the impact that discontinuity can have on complex systems, but complex systems generally have sufficient resilience to manage discontinuities to bounce back relatively quickly. Indeed many of the security features inbuilt into complex systems are specifically designed to deal with discontinuity. But as I've said the uncertain times into which we are currently heading are less characterised by discontinuity than they are by a much more destructive phenomenon, disruption. And you know this, disruptive changes can generate existential threats. Disruptive technologies have allowed Amazon and Kindle to challenge the very existence of the book trade as it was. Disruptive business models like Uber and Airbnb threaten current practices and structures in the taxi and hotel industries with real implications for working conditions and income streams for those who work in those industries. And disruption is at the centre of the malaise we see globally. Political and economic disruption are the main drivers of strategic disruption. It is that form of disruption that is undermining the confidence of people everywhere, generating care, worry and more alarmingly fear. And fear is always particularly dangerous because it prompts irrational and dangerous actions. It is a curious fact however that disruption can generate a critically important reaction and that is innovation. More than a decade ago the American political theorist Philip Bobbet published The Shield of Achilles. He dealt deals with that most disruptive of all human activities, war. And his thesis is essentially that war generates substantial constitutional changes people recoil from the destruction and horror that war inevitably brings. Now his analysis of the relationship between war and constitutionality may be contested. But what is pretty incontestable is that disruption is best addressed by innovation. And that is the challenge I think that faces all of us in the security domain. No doubt you are aware of the call by many international commentators for governments to deal with the root causes of the various forms of politically motivated violence presently affecting the global community. Of course few of those commentators actually identify what those root causes are. What we do know is that the so-called root causes lie at the intersection of the economic, social, cultural, ethnic and ideological forces that lend movement and colour to human collective activity. And the agent who acts at the intersection of these forces is always an individual. In a thoughtful opinion piece published in the UK Guardian a couple of weeks ago, the novelist and former security specialist Nicholas Searle cautioned against rhetoric as a component of security policy. Sweeping terms like radical Islamic terrorism cannot alone explain the breakdown of law and order across the Middle East, nor radical groups that have spread their tentacles into Europe, North America, South and Southeast Asia, Africa and even Australia. And it is interesting to note that the incoming national security advisor in the Trump administration, General McMaster, has also counseled against the use of terms such as Islamic terrorism. Politically motivated violence is a form of criminal activity and it needs to be dealt with as such. And as an international phenomenon, politically motivated violence will best be contained and eliminated when nations, some of which are Muslim, work collaboratively to address the broad security needs of the communities in which the perpetrators live. And that kind of collaboration depends for its success on the ability to address the human security needs, that conditioned fear and violence. That kind of collaboration will also serve to identify, detain and prosecute those who undertake politically motivated violence. As Bill Shorten said recently, we have a solemn responsibility to counter that argument of the extremists, of the extreme right and the extremists in the Middle East, who say that being a Muslim citizen of this democracy is incompatible with their faith. We need to counter that argument and not amplify it. It is our job, our duty to foster a more inclusive, a more respectful, a more egalitarian Australia. We don't just tolerate diversity, we embrace it. We don't just acknowledge multiculturalism, we embrace it as a bipartisan achievement and as a shared priority. Recognition that language has consequences was also at the heart of the success of the Northern Ireland peace deal. And Sirle, Nicola Sirle commented on the highly deliberate and painstaking efforts that eventually led to the Good Friday Agreement that ended violence, political violence in Northern Ireland. Careful timing, nuanced language and emotional gearing on all sides enabled the moment to be won. And this is what should inspire all of us and all of you in your professional efforts in the national security domain. Rejuvenation and regeneration should always be front of mind for those who lead high performing organisations. Subtlety and nuance in both policy and operations are most likely to be effective when organisations are representative of the communities they serve. Let's remember, open communities have the strength of inclusion. Closed communities have the spectre of fear. So conferences such as this and people like all of you in this audience tonight provide the critical aware with all that keeps our national security community ahead of the serious problems it is designed to address. So I wish all of you well in the work that you do including for gender equality and be confident in asserting the importance of women in enabling the national intelligence and security community to meet the challenges of these disrupted times. Thank you very much. Please don't go away Senator that was a I would say a subtle and powerful and very wide ranging speech and I'm sure that our students will be paying close attention to it very soon. I think you've intuitively captured what the college is all about because you've defined national security in a context that is much broader than the narrow definitions of security that some would see and I think you've identified those themes of disruption of society, a rhetoric of technology that are really making many of us so uncomfortable but also so focused on finding policies solutions at the moment. So I really thank you for that. I'm going to ask if you would take a few questions from the audience because I think you've got a really a really important and interesting and diverse group in the room tonight that will have some very interesting questions to put to you. So we can take a couple of questions for Senator Wong if you please raise your raise your hand and a microphone will come to you and please identify yourself we are on on record and we only have a few moments so I'm looking for hands somewhere around the room. I will begin with our colleague from Pakistan. Thank you. Thank you so much. I am Boldova and I am impressed and I'm a citizen of the world. I came from Pakistan but I have lived everywhere and what you have said today is what we need to do but how do we educate the media? I can tell you this that I as a citizen of the world not as a Pakistani Muslim which I am also I am quite irritated by the media as it fuels terrorism. I work with children who are militants who were militants who I have deradicalized them and they quote these statements. So what do we do? How do we educate the media? Thank you very much for that question. A politician being asked about you know the media being irritating. Well jokes aside I mean this is on issues of inclusion on issues of equality tolerance and compassion whether the the divide is gender or religious or other really the only answer I think to your question is for leaders whether they are political leaders or academic leaders or community leaders to continue to say what we believe to be right. It is always easier to frighten people than to give people hope. Human history has shown us that it's always easier well in many ways it is easier to divide than to unite but you know we have a task all of us collectively and the media are a medium and they will write what they will write sometimes we will agree with it sometimes they don't but I think you know in life there are things you can control and things you can't what we can control is what we say and how we construe problems and well when we need to stand up against what others are saying which is not a which are things which are not only false but are damaging then we ought to do so. Thank you can take a few more I know my colleague Maria I should talk for longer than I want to get more questions. We have to get from Marina because we went to law school together. Absolutely please. I think she studied a lot harder I have a horrible feeling about everything. We're just going to do a plug for Adelaide you know I just would like you to know Marina's from Adelaide I'm from Adelaide Julie Bishop originally from Adelaide and Francis Adamson so we've got it covered and that's the real hidden network there. Senator I actually just I loved a lot of the words that you used values in the context of Australian foreign and defence policy talking about a values driven rules based global order and disruption I actually wondered what sort of disruption do we need in this space on gender equality to embrace it in terms of moving forward. What sort of disruption do we need I was making a slightly different point I was making the point that I think hopefully we all agree that institutions do better if they broadly reflect the community from which they come or which they're part of that the times we are in I've described as being disrupted times because it just seems to me that uncertainty and wasn't quite cutting it and if we believe as I do that simply replaying past solutions is not going to be sufficient to address these times then we have to be serious about thinking innovatively in terms of our policy response and the point I'm making that is that the rejuvenation and regeneration of the intelligence security community has to be part of that and I see gender as being part of that there is the you know the data that Professor Valerie and others have spoken about I think which is a sort of different layer on it I guess I was making a point about leadership and about decision-making and about problem identification and that at a time like this you actually really want to make sure that those making decisions are thinking outside the square and I do believe gender is part of ensuring that occurs. Take one from Dr Sarabi from Afghanistan. Dr. Good evening senator and good evening to all of you. I am Habiba Sarabi from Afghanistan. I'm from Afghanistan the conflicted area but not I am not from citizen of the world because yeah this is something that I have to the people should recognize me that I am from Afghanistan and suffering from the war and conflict more than three decades it's almost four decades. My question first of all I impressed a lot by your speaking and so I congratulate you and I congratulate all the women here and around the world because if we have strong women like you and confidence to have enough confidence of course we can bring some change. My question is that what will be the policy of the Australia Australian government it's political question that if you could take the power what would be the policy of your country toward the peace for Afghanistan because the Afghanistan problem is not only Afghanistan problem it is the regional problem it becomes the international problem what will be the policy of Australian government because some countries are playing a role but Australia is a place or a country a little bit far away from the region so I think you can play a big role for the bringing peace to Afghanistan thank you. So thank you very much well first can I thank you for being here and for sharing with us your experience I I'm sure that has been a great use but also very important to the people who are part of the conference in terms of Afghanistan and the region obviously it is a it is an area of the world which has endured conflict for a very long time and you know we certainly will over this coming period in between now and the next election be thinking and talking to our partners and allies about what are the next steps for that region and what what Australia can constructively do bearing in mind we're obviously not a major player in terms of of regional stability so I suppose my answer would be we should talk again in a year or so I try not to think I try to prepare for the possibility of government without actually counting on it that's that's democracy I guess we'll take one it's also superstitious please at the back of the room there thank you yes you know usually I have to do an affirmative action thing where I say after three men there's a woman I haven't had to do that tonight thanks very much senator amy big sprinch my question is about yourself as a senator and your parliamentary colleagues as members elected from their electorate or from their state you obviously have people in your communities that aren't receptive to both discrimination for whatever against racial against women against ethnic city groups how what language do you use how do you bring them on board what what's your tactic meaning they aren't receptive to the proposition that discrimination on those bases is a bad thing is that what your question is that as well but but but bringing them on board getting them on the bus yeah yeah no no no I understand um I'd make a couple of points I came to Australia from Malaysia as a kid in a long time ago I'm getting quite old now in the 1970s and it was the first time I had being conscious of a personal experience of racism and I learned a lot through that time and one of the things I learned is that for most people not all but for most people prejudice doesn't survive personal connection and that part of what we have to do to confront discrimination and prejudice whether it's gender or racially based is to try and diminish the capacity of people to see the other as some distant other like we have to try and in gender as far as we can a personal connection with the other as individual rather than as some externalised personality and how we talk about it I think is important what we do in our communities is important so you know events which encourage events and program which programs that we're talking about race for the moment which encourage cross-cultural engagement I think are really important how we talk about it is important so my disagreement with the government over the recent racial discrimination act changes was not simply a legal argument about what their proposition was I and I've explained my view about that on in the parliament my argument my concern is also what message is sent because what message you send to the community as a parliament as a political leader is important and the perspective that was not given sufficient play at that time not given sufficient attention at the time by too many people in power was the perspective of the victim of racial abuse what is it like for the kid on the bus or the Muslim woman in the street and that if you talk to people in those terms about the human experience are right behind these principles if you talk it's not when I talk about gender equality I talk about and it's a trite in many ways it's trite but I say do we really want to live in a society where we explicitly say we want our daughters to have fewer opportunities than our sons is that really what we want and I think to make sure we say to people talk to people in ways that make it personal not as a rhetorical device but to try and actually tap into our shared humanity I think is is the only way I've ever thought we could we could win these arguments thank you very much for your time it falls upon me to thank the senator thank penny for what was an insightful motivating and reinforcing speech I know that a lot of the messages around rejuvenation and regeneration will have resonated with our industry colleagues and others in the national security community 20 years have not dimmed your intellect or eloquence penny I have to say and it's also a demonstration of the importance of leadership having someone like you here tonight to reinforce these messages and share your time and your thoughts reinforces the importance of leadership and the importance of these messages so on behalf of the ANU on behalf of the national security college myself and all of those gathered here I'd like to thank you again for your time