identicals, right? But because I've played with the same family members over and over again, I kind of know what they do and their choices of strategies. So for example, my grandma who's like the sweetest person ever, she counts cards like I just know it, she does it. My brother loves risks so he goes big at all times. So just he's going all in.  I do not like risk, I'm not someone who likes risk so I play it easy and just cheat. But maybe I do, maybe I don't, I probably do. So my point is because I played with them for years, I know how they behave and I know their strategies, right? So how about applying this logic to cybersecurity and learning the attacker's playbook? If you wanna block attackers, you need to know how they might behave, right? But then in cybersecurity research that applies game theory, one of the main downfall is they're like there's too many strategies, the number of strategies is infinite and we can't do it. Well, yeah, okay, technically speaking, theoretically speaking, sure, yeah. But no, because we're all humans, right? You might, there might be an endlessly amount of possibilities but humans don't know all of them. So you're already kind of hinting at something, right? Humans are rational, well, some of them are rational, not all of them. So I wanted to start looking at that playbook but then look at it from an evolutionary perspective. But instead of focusing on everything that's changed, I wanted to look at what didn't. And the reason I wanted to do this was a few, before I started this research, I was reading this article that said that there are 20,000 new ransomware per quarter, right? And I'm pretty sure it was actually monthly but let's just be conservative and say it was quarterly. And I remember thinking back then when I didn't really know anything about ransomware, well, compared to today I knew nothing about it, but I was like, there is no way in hell that there are 20,000 new strains that are created from scratch, right? Just didn't really make sense. And when I started doing the data collection, I realized I was onto something but back then I didn't know. So what I wanted to do was look at what hasn't changed and focus on this because the idea was if it hasn't changed in, well, and got like the number of years that I was gonna study, then why would it change now? Why would it change next? And this is not, again, not in a prediction. It's more in a common sense situation, right? And then I wanted to know, well, if we can figure out what hasn't changed, can we prioritize countermeasures to these weak spots? Because then it might give us a chance to equal the weights of winning and losing. This was the idea. So this is the presentation of my doctoral studies. So the question was, how can game theory be applied to study the evolution of ransomware? And again, like I said, the research aim was to identify what hasn't changed in the techniques.  I'm not allowed to say that. So an interactive kill tree using commonly used defense evasion techniques, which I'm not gonna have time to talk about today. But today what I'm gonna focus on mostly is on discovery and defense evasion, because it's what honestly interests me the most. So the methodology. So I gathered over 400 white papers. And the reason I use white papers to create this database was because I'm a criminologist and not, so my malware analysis technique skills are non-existent. So I had to rely on the white papers. So what I did was I took those white papers and I applied the Mitra framework to them and tried to see if I could study evolution this way. Now between you and I, this was the wrong call and I probably shouldn't have used the Mitra framework, but it was a well-established model that I knew was gonna be accepted for my thesis. But I'll explain to later on in the limits why that was probably not the right call. So what I did with those white papers is I collected not only the Mitra IDs, I collected also type of encryption they were using. They're AKAs, all known as, they're known associates and particulars that they had. I'm not gonna have time to talk about all of this today, but I honestly, I kind of vacuumed it up and grabbed as much as I could and then played around with the data. So I ended up with a sample of 116 strings. 51 were cryptoware, 65 were leakware. And then I also redivided for future testing the difference between ransomware as a service versus owned. The sample is from 2016 to 2020, well, I'm gonna say 2022 because I only have one for 2023. I do after Nordsec wanna go back and actually add a little bit more, but I also need to graduate, so we'll see how that goes. But the original idea was actually a 15 year sample and I don't think I would have ever survived 15 years that I didn't have enough white papers. And then I realized here that there's, I took some of you guys's white papers, so thank you so much for everyone who wrote one. I really appreciated it. So the fun part, the reason we're all here, right? So let's talk about some results that I did. So I wanna talk briefly about initial access, right? Because it's the entry point and this is something that's not gonna come as a surprise but phishing remained the most used tactic for technique for initial access and that was very stable per the six years that I was studying. So this is good news and a bad news because the good news is, is because it requires an interaction from a game theory perspective, it teases the idea that it can be stopped. And now, before we collectively roll our eyes because I said phishing can be stopped and we all know, most of us know that this is not that simple. I know, I really know. The idea is that game theory teases this. I don't know how realistic it is considering how stable this been but we can still continue to work on this. When phishing was not an option or wasn't used, vulnerability exploitation was the second one that was used the most. It's harder to do sometimes but they're not dependent on users' behavior so that made it a little bit simpler sometimes. I don't wanna dwell on this too much because I only have half an hour and honestly I kinda wanna geek out about other things than phishing. Not that there's anything wrong with it, it's just, it's phishing. I like funny things better. So then I started focusing more on internal discovery. So when I first started gathering the data, I wasn't really doing any sort of analysis, right? I was just kinda gathering up and looking at it and what did draw my attention to was discovery. So it probably shouldn't have surprised me as a CTI analyst but back then, I didn't know as much as I do now but there was a lot of accents put on discovery, internal discovery and it made sense later on because even though we all kinda know what's inside our infrastructure, we don't know where things are exactly. It's kinda like if you go rob a house, you kinda know that there's gonna be certain money or pharmaceuticals in bathroom but you don't know which bathroom and you don't know where the safe is. You have good idea that it's probably gonna be in the office but do you really know where the office is from the outside? So this was kind of the same logic, right? And as a CTI analyst, I got asked a lot of times like by clients that were just like, do you know what they took, right? I got ransom, they encrypted everything, do you know what they took? My answer was always the same. Whatever you're afraid that they took, that's what they took. The whole point of ransomware, you have to make it hurt, right? If they didn't take what hurts the most or what you're most sometimes ashamed of, then it wouldn't really work. My point in all of this is that you need to know what's in your infrastructure. You need to know where things are and what's valuable to you because they will know it for you. We've seen an increase of ransomware groups that are tailoring their ransom demand to their insurance policies because that increase their odds of payment. So they are looking, right? But what it also tells me was that from a game theory perspective is if internal discovery is really important to them, it can also be leveraged for defenders, right? So if you prioritize what you need to be protected at all costs, right? And I know we always say you need to protect everything, but let's be realistic, no one does. But you need to know what the goal is, like the pure jewels, you need to know what it is and how to protect it and put extra layer around those. And as a by the way, your employees' data falls under that category, please, for all of the employees. So this is what you're gonna wanna do.  But I'm getting ahead of myself and I'll talk about this a little later. So this is from the sample, the discovery techniques that were most used in the sample that I had. And as you can see that it's a lot of looking around where things are, how to move around the infrastructure and looking for documents. So basically one of the main things that I saw was that there were also looking for certain files, extension files, right? They're looking for the Excel files in some Word document. And then the ones that includes things like Revenue 2022 that you know is gonna be on the OneDrive somewhere and it's gonna be shared across multiple people, you want that, right? They're gonna be looking for it. They're gonna be also looking at ways to travel within your infrastructure. So Defensivations, okay. So Defensivation was a big thing because I always thought it was the battleground of game theory, right? This is where the main interaction is where you're testing your defense against your attack. And then turns out this is kind of where things went downhill for me. This is a distribution of Defensivation techniques in my sample.  So when you're looking at something that isn't changing, strategies that are once out of 116 is not good because then you can't really draw any conclusion from this. So when this came out the first time, honestly I was like, I think I'm gonna have to change this project and the pentesters in my life were right and I can't do this. But then I didn't, I kept going and then turns out I was still right. But my point is with something like this, you're kind of like, okay, so there's a lot of possibility of Defensivation, but then why is there not more? So then I decided to do a cluster analysis. So cluster analysis is grouping sets of object in a way that they group the same people together that are more similar and different in different groups, I guess. One of the main problems I had is I had too many variables. So the first few times that I tried running this test, the software crashed twice. And then I realized the mistake was I had too many, so I had to cut down. And this is where things get tricky in research is that you can just randomly select what data you want because then that's just not fair and you're playing with data, right?  So what I had to do is think about it in a way. I'm like, okay, so if my goal is finding out what hasn't changed, then I need to pick the top 15 strategies that were most used. And as you can see, even when I did this, the model is still lower fare. It's still not great cause I had too many variables. Now I could continue to play with it, but then that just wouldn't be ethical. And as much as I enjoy blurring the lines of hacking, this is not one of those times. So I got two clusters, I got two groups. My sample was divided in two. I have, I got no time to evade at 56% and 44% was catch me if you can. I work full time and I do a PhD full time. So I find the fun where I can, which is naming stuff and names that I probably shouldn't. So let's look at them. Let's look at how they're, you know, the main particularies of each group. And what I found was it was pretty surprising because I had really thought that I was gonna be facing groups with a lot more strategy, especially for the I got no time to evade. And this is a group at 56%, right? So it's most of my sample. Well, above average, well, above half. And I kept thinking, why? Right? Why would I have a group with so the majority hasn't done much? And then it got me to thinking there are multiple possibilities for it. One of them is that my framework is not working, that the techniques that they're using are so new or sophisticated that the Mitra didn't include them, which is a possibility. The second option was maybe they do such a good job at internal discovery that they know in advance what to avoid and don't need to use defense evasion techniques or they'll focus on basically what they really can. But because they took their time and mapping out and sniffing things, they didn't have to evade. The third option, and this is maybe more of the CT analyst speaking, but the third option was, well, in order to evade defenses, you need defenses in the first place. So maybe the victims didn't have any countermeasures in place and therefore they didn't need to avoid evading much defenses. The second group, which is the smaller one, the catch me if you can, had their hands in multiple types of strategies a little bit everywhere, right? So for them, I kind of got the idea that they were a little bit more teasing, just doing a little bit of everything at once. Whereas I got no time to evade, really focus on hiding their code and their presence in their code. So I got more of a weasel kind of type for them because the devil is in the details and if the defense is not looking in the logs for any small little abnormalities, they would probably miss it. So this is what I got from this. The common strategies, so this was what both group had in common and it was a lot. Like they both had these strategies multiple times at a higher rate, I guess. And so that's why I wanted to talk about them. So what I saw from this is that the core real defense evasion laid a lot on avoiding sandbox, so sandbox evasion and modifying, well, disable or modifying the firewall. So these were more defensive evasions that were more direct to evading defenses. Whereas the others, even though they're considered defensive evasion, were a little bit more on like trying to set yourself up for your next step, right? So they're looking at ways to move around for lateral movement, persistence, and elevation of privileges, which I thought was interesting because when I thought of defensive evasion, I really thought it was attacking the differences, but then turns out it was also just by kind of weaseling out of them too. So time flies when we're having fun, so I'm gonna keep the short. So this is where I kind of am. I forgot to mention two weeks ago, my partner dropped his coffee all over my laptop and I lost four months of research. And so I had to restart everything in the last two weeks. So this is the result of this. So this is why some of the results are not as push as I had intended it to be because I didn't have time to finish. So the attackers play book. So I know I've been quick on the results, but honestly, I can really geek out about this for hours. So I'll be around today and tomorrow. So if you have more thoughts or questions or anything, I'll be very happy to geek out about this more. So let's go with the short conclusion on this. So in an ideal world, we'd focus on threat actors just not getting initial access, right? In an ideal world, we would all have such strong walls that nothing could get in. But honestly, that's just not the reality. And like, sure, we could increase the security around emails, teams, Slack, LinkedIn and all of this. It would help, but I don't think it would stop anything.  I'm not wasting my time on this, right? So that brings me back to discovery and defense evasion. So what I learned is that the importance of discovery, even though it's logical, defense could use this to their advantage because threat actors may know what they wanna find, but they don't know exactly where it is, right? And this is where you can mess with them. So you can make that job a lot harder, longer and with more traps. So in criminology, we suspect that the longer the crime takes to be committed, the more chances of natural, well, not natural selection, but of natural ways to be stopped, right? You have more chances of getting caught, more chance of something going wrong. So why not apply this to the discovery stage, right? Fool them, make traps and traps that can give you enough time to protect the jewels. So I was talking to one of my favorite pentester of all time, Adrian, who's right here today, and I was asking him about honeypots because I know honeypots are, you can see them from miles away. So I wanted to, what's the alternative, right? Modern day alternative. And he was talking to me about putting vulnerable switch devices in pre-selected spot in order to use them to raise an alarm that would give you enough time to protect the jewels. I watch and listen to an episode of Dark Knight Diaries two days after that conversation and that product was already out there, so I guess I was onto something. So the limits of this paper.  So if I didn't have enough information, I kind of disregarded the strain because I couldn't do much with it. I was limited on that side. Ransom were customizable and they do change depending on their target. So I need to be clear that it's 116 strains that were seen at least once, but it doesn't mean that I got the full, I don't know, like log bit three's full MO, right? Because they changed with their targets. So the result cannot be fully generalized, but it is telling us at least some trends that should not be ignored either. The Mitra framework is great, but when you're trying to analyze it for evolution, the newer papers included a lot of strategies that were not in the Mitra framework that I had to add in myself, which then became kind of a problem. So the next step is to continue to analyze the strategies against the years, but this time I'm going to do it from a qualitative perspective because based on stats, there wasn't that much difference and it was hard to handle. So again, devils in the details, right? Then I'm going to be mapping out the strategies in a kill tree and then, but only focus on defense evasion and I might actually include discovery yet, but I haven't talked to my supervisor about it. And then the final step is, yeah, I got to write the paper. I got to write the dissertation and defend it. So hopefully by next May, I will have something done, but life, you know. So on this, I want to thank you all for coming to my talk and this is, well, if you want to reach me, if you want to talk to me, I'll be around, I'm volunteering tonight and tomorrow and this is my best friend, Kevin, for those who don't like cats. So I put a dog at the end to make sure that you would have someone. He's living his best life in Scotland and he is thriving. So I thought you would enjoy a dog at the end of this kind of grim presentation, even though there was a lot of pink. So thank you so much for your time. All right, thank you so much, Vicky. If you have any questions to Vicky, we'll be asking them afterwards. You can try to scan this beautiful QR code and then write your questions. We'll review them to make sure that they're acceptable. I have no doubt. And then after that, we'll ask them during the, do you want to set up, yeah? The moment. Blah, blah, blah, blah. Alarie, in fact, I have slides. Yes, but I thought we'd come back right away, the next time, you know. No, no, we'll be there in a minute. Oh, please don't go. Okay. All right. Okay, so we'll start with our second talk of the day with Andréan. Please take a seat. Andréan has a PhD in Criminology from University of Montreal and works as a cybersecurity researcher at GoSecure, acting as the social scientist of the team. She is interested in online attackers' behavior. She's an experienced presenter with over 38 academic conference. Are we still at 38? 42. 42? With today, 45, I don't know. Good. I lost the count. With over 45 conferences and is now focusing on the infosec field. So if you want to know what to do when you have an... What you can infer from RDP honeypots, please stay and welcome Andréan. Thank you, Massala. I wish to say thank you to Hugo to schedule me in the afternoon because this morning was hard after the party yesterday. Were you there? It was a good party. I loved it. So yeah, I'm here to talk about the extent to which human is implicated behind automated attack on RDP systems. So, you know, I see human implication on a continuum. So you can launch an automatic attack, a very basic one. And you can think more about your attack and make it a bit more sophisticated. So this is the type of continuum I'm looking at or trying to build to understand the attacker strategy better. So Massala already introduced me. So I don't have to do it all over again. So I'm a cybersecurity researcher at Go Secure now. And I'm also involved in the NordSec organization. So I swapped my red t-shirt just for this presentation and then I'll put it back on. And I'm also part of the research group on open source at the University of Montreal as a scientific director. So a lot of engagement, a lot of fun. I like it. So the objective of our research program, so not just the research I'm presenting today, but also all the other research I do with my colleagues is to understand the attacker strategies to share hopefully, to share prevention advice and also to fight again attackers anonymization because it's hard to really de-anonymize an attacker with a name and an address and it's like we're not police, right? It's not in our interest to do that. But we want to fight against their kind of anonymization just to be or to go as far as we can to try to identify what are their strategies and who are they. We want to scare them. So they have to change their strategies and find other ways and work harder to try to attack in order to increase their cost, right? In the attack, the calculation of benefits versus cost. So the agenda for today, I'll just explain very quickly what is the remote desktop protocol just to make sure we are on the same page. And then I'll show you, well, explain the only part that we used to collect the data. And I'll show you what the data we have analyzed for this presentation, for this research project. And I'll show you the indicators of human behavior versus machine-like behavior and how can this aggregated together can result into an engagement score, a human engagement score. So first, remote desktop protocol is a Microsoft protocol allowing users to access the graphical interface of remote computers. So with the shift to remote work after the pandemic, companies have relied on remote access tool to manage corporate devices and keep operation running. I'm sure there's a lot of you that use some type of remote protocol to access your work files. And well, there's less security-aware organization that even exposed their RDP directly on the internet. And the Cybersecurity and Infrastructure Security Agency reported an increase of 127% of the RDP endpoint exposed to the internet following the pandemic. So it's a lot of tool and since, oops, sorry for that. And since RDP give user complete control over the device, well, it has to be shown, it has been shown as a valuable entry point for threat actor and particularly for ransomware gang. So you understand the urgency of understanding attackers' behavior and proposing solution to improve protection or attack prevention. So to study credential attack on RDP, we operated, we operate, we're still operating, high interaction on the bots on the internet. So the objective of our Anepot is a research Anepot, so we're just collecting data and for research purposes. And our specific Anepot consists is an open source RDP interception tool called PyRDP. So, and it's in front of a real Windows server, so they can actually connect and do stuff on the Anepot. So PyRDP, you might have seen one of the presentation of Olivier Bilodeau who developed PyRDP with a couple of other interns. I don't see any of them here, but a lot of people work hard on the development of this tool and maybe you have seen or listened to Purple RDP, the presentation of Olivier about this one, about the tool. But basically, like this is the list of all it can do. However, I will not read all that. The thing is, like the important thing is that it's basically a monster in the middle which collects a lot of information. It saves basically everything. So we have access, it's also an RDP visualizer. So we have access to basically everything like that the person who connects to our server will type on his keyboard. We see where he clicks. It's really like a video of what he's doing once he connects. So it's highly interesting, but today I just, I will not talk about like the actual video footage. I will talk about the, before the confirmation, so the attack, the credential attack before a confirmation, right? So how do they compromise our RDP system? Let's start with that. And it's not with fancy backdoors and a lot of knowledge. It's very simple brute force attack which consists in just trying as much username and password as possible and try to enter, right? So with all that, we collected a lot of information, like a lot of attempt logins. And it was kind of too much to analyze. So I took a subset of three months for today. So it's from July 1 to September 30, all the attacks on those omnipot. And the information that is collected before the confirmation is timestamp IP addresses, the credential they try, so the username and the password. And I'm kind of excited to show you how far can we analyze the strategies with only those three information. So in this dataset that I'm presenting today, we have like over 3.4 million attempt login. And if we group them by IP, because you know one IP can attack us for like hundreds, thousands of times, hundreds of thousands of times, we end up with 1,529 different IP address in three months. So a bit of descriptive information about the dataset. So most attacks come from IPs that are registered in Asia and then Europe and then North America. We all know that it's not necessarily the origin of the attacker, since they can use compromised computer or proxies or anything, but still it gives us an idea of where they're from. And I classified Russia in Asia here. And this is an important information because Russia is the main attacker. So Russia, Panama and China. And China is Hong Kong mostly, because like for those who can see the red line, it represents the rest of China and the blue line is like Hong Kong. So it comes from Hong Kong, right? So yeah, now if we look at the most common username that are used in the attempt logins, like we understand that there's a lot, like there's 700,000 different username in our dataset, but here is the top 12, okay? So we see a lot of administrators, right? And on the Windows server, the default name is administrator. So it's kind of a good strategy to try this to connect. So if we look at this, all the variation of the word admin administrator and administrator, it represents 60% of the attempt logins. After that, if we look at the most common, no, it's still the most common username. Okay, so administrator a lot. And then we have those three weird ones in the top 12. Their presence in the top 12 is important, because this is information about our computer. It's our RDP name and our host name and certificate name plus something that is related to the fact that we are on the digital ocean. So those are information that they found. And then leverage them against us to try to enter our server. So there's many studies that's saying that brute force attack on RDP are kind of very basic and use, you know, leak lists available on the internet. And yeah, that are pretty much basic, but this is not what we see here because they use our information against us. And it's not like random usernames, it's our names. Okay, now, if we look at the most common password in the attempt login, we still have the top 12 here. Well, there's three important observation or trend here, is here, it's illustrated here. So first, the variation of our RDP certificate is the most common strategies that we see. And then variation of the word password, obviously, and then use of simple chain of number, like 10 or less number. So they are basically very bad passwords or targeted passwords. And so what we can conclude from that is that they basically assume that people have bad password, which is kind of true. So yeah, we have to keep saying to people that they have to change their password and have strong passwords. Our job is not done on that. So here's some observation related to the credentials, okay, that I wanted to highlight here. First, username, we can see a specialization of the username according to the country of the attack, of the origin of the attack. So here are two example of those specializations. So the first one, our RDP certificate name is used by China and Russia exclusively, right? So the attack that are targeted against our information come from China and Russia. This is their strategies. The username ADM is used exclusively by attacker from Nicaragua and Panama. I cannot explain that if you have an idea, you come and see me. And I just thought maybe it's more common in their area to use ADM as a default user. Another observation related to credential is that some, their strategy of some attacker is to use thousands of different passwords, but with the five same username, right? So 15% of attackers will have these strategies. With this strategy, sorry. So it might be a good strategy, but you have to be very confident about those five username that you use. Another observation is that some use the same username as they use for the password, the same word, right? So it's administrator, administrator. We see that a lot and it's in 21% of the time. Another observation, there are some that use the same set of credentials, so the same combination, right? More than one time. And this I cannot understand it because it didn't work the first time, what it would the second time, I don't know. So there's 26% of attackers who use a combination more than one time. This tells us that yeah, so maybe they are a group and they don't communicate very well with each other and they try the same list, which is not very efficient, or they are just like very mixed up and I don't know, they don't know what they're doing basically. So this represents like maybe more basics attacker than those who target us. So I'm done with the descriptive analysis. Let's dive into the research question. As I said, I perceive the attackers to be like a continuum of human engagement. So they are evidence pointing toward the use of automation, so machine-like behavior, and other indication or other evidence pointing toward human behavior. So by human, like of course there's a human at every step like in all those categories, but there's also a machine in all those categories. We understand that, but we just want to see like how different they can be. By human involvement, I mean that they are slightly, they have a slightly higher level of sophistication. This is what it means, okay. So I'll show you my maps. Okay, I love my maps. It looks complicated, but I'll explain. So this is an attack calendar, okay. This is July for July. So you have all the days in July and all the hours of the day, okay. So this is a time pattern attack for one IP. Each little bars represent attacks and like in this case, for this IP, the yellow one represents four attack at the time and this time frame, okay. So here we see a lot of attack. Here we see a very good example of an automated attack that is launched and obviously like there's no human pattern or human behavior here. It's purely computer behavior, right. Because it attacks very rapidly and at all times. So there's, you know, but this is like, I can find this in my dataset, but it's not the majority of what I see, okay. I see mostly those type of patterns. So it looks like, so to understand it, there's a start of the attack there and then it stops. Yes, I was looking at the time, it makes sense. It stops and then nothing happened. So I'm imagining that, you know, you start, you launch a list of credentials and then it stops and then it didn't, you didn't, you were not able to get in, right. And then you have to notice it and then you have to launch another block of attack with another list of credentials and this would look like this, right.  So that's why there's time that appears to be pretty random in between the blocks of attacks. Because of course, and this is maybe like more of a human behavior than the other example, because of course we're not in front of the computer at all time and we have to sleep, right. But there's other example that are even more interesting. Well, for me, maybe you might not be as excited as I am, but here we see two things. We see first that they impose a delay between each attack, right. So this is a strategy that is more thought out because they are trying to imitate human behavior to avoid detection by imposing a delay between attacks. But the cool thing is, so we know that this is automated, right, because there's a delay included in the script and everything. But what is interesting is that there's days here, there's a hole in the calendar and this falls on the weekend of July. So we can imagine, like it has been documented that China employs people like office hour of people trying to hack other countries and this might be an example of this because they work full time during the week and then they close everything for the weekend, go home and come back on Monday. So this could be an example of this. It also can be someone who has a weekend job and do something else, we don't know yet, but it's hypothesis. And the final example that I wanted to show you, so he starts attacking our, the person starts attacking our on a putt on the 18, this is not important, but what I want to show you is the block of eight hour during which there's no attacks started. So attack can be running alone without a human in front of the computer, but there is this block of eight hour that we do not see any attack that is started. So you know, eight hour, this is what you need to sleep. So it might be during the night for this country. It might also be like eight hour shift of a day job too. So there's a lot of hypothesis here. So I was looking at this and I was like, okay, there's something human behind it, right? There's pauses, there's weekends, there's vacation days. So this is why I wanted to look at the extent to which the human is present behind the screen. So I identify indicators of machine like behavior and indicator of human like behavior. So we know that machine is everywhere in those indicator, but I would say maybe machine like behavior would be associated with a more basic attack, okay? So when we see a high number of attack, of course it's not a human that is trying by himself or herself, so I will associate it with a machine like behavior. When the passwords are present in the popular list of list credential and to know that I took the ROCQ 2021 with like eight billion passwords in it, if the password used by the attacker will mostly, like most of the passwords used was in this list, I consider that the passwords were like basic and part of a leak list that is available easily on the internet. So I consider this as a machine like behavior or like less sophisticated attack. Then the constant presence of the attacker over the observation period of three months, of course would be associated with machine like behavior. And finally, when there's several attack per second, it's an automation, of course, so I associated it with a machine like behavior. Now here we have the indicators of human like behavior or sophistication. So there's the start of attack blocks after long pause as I show with the calendar. This would be associated with the human. Those screens are very hot, by the way. I'm like burning. Attack is customized for its target as I show you the took our information, they leverage it against us. So I said, well, this is more of a tout-out than a basic attack, so I associated it with human like behavior. And finally, the delay between each logins. Of course, this is automated, but they are trying to imitate human behavior. So I classified it as a bit more sophisticated because they thought about it. So if I give a point, I made a plus one to each of those criteria when I see it. And then I remove a point for each of those criteria. We end up with an engagement score from human to machine on the continuum. So we see that there's more people on the human side or on the sophisticated side, always with quotation mark because we can talk a long time about sophistication and what it means and everything, but you understand where I'm coming from with all this presentation. So a bit more on the human side. So the conclusion of this is that we were expecting a lot of automation and basic automation and this is what other research has found before. So this is what we were expecting, but this is not exactly what we saw. We saw a lot of human patterns in the attack pattern calendar. We saw information leverage against us. So we saw attacks with characteristics that are more thought out than what we expected. So it's a bit worrying because if it was only basics, it would be encouraging, but still now we know. So we can defend against this. So the mitigation. First, our nepot is exposed to internet and you can, of course, use a VPN and not be exposed. So this is the first thing we should say, we should tell everybody, please hide behind a VPN that will, we will avoid a lot of problems this way. After that, you saw that the attack very fast all the time. On the new Windows 11, they installed the Lockout Policy Automatically and this is, I think, a good idea. Every time you try, if I'm not mistaken, like 10 passwords, they will block you for 10 minutes. This is very not efficient for an attacker who attack a lot, you know. Over the month, it will take them a lot more time to do so, to do as much attacks as they do. So this might be imposed on our system, maybe a bit more. This is a good idea for now. And also, we keep saying, I give talks about the passwords and everything and we keep repeating the same thing. The password hygiene is the best way to protect against those attacks because you saw, they use pretty much like simple passwords, variation of the word passwords and also they use our information. So we can consider this as personal information and we always say, like, don't use personal information in your passwords. So we have to keep saying that because it's true, it's still true, but also, keeping the default username is not a good idea and maybe we have to repeat it too because you need two information to get in, right? Why waste one? So username is as important as the password. So the next step, do I have one minute? Yes, okay. The next step of our research, we will look at the tool that customize attacks because we suspect that this is automated. They collect our information and they create their list, like automatically it might be. So we will be looking at this tool that they might use to customize their attack. After that, we want to investigate what lists of credential they use and it will be even better when we analyze the compromised session because we see all their tools and what they use. So we might be able to identify those credential they use since most are not data leaks. And then we want to investigate the shared and origin of proxies because for this presentation, I only took, like, I separated the IPs but some IPs are highly related. They might use more than one IP to attack us, so we want to do this aggregation. And finally, analyze the successful gain activities with the video footage. So more research should be performed to reveal precise tooling and strategies employed by opportunistic attackers. And we believe that exposing some of these group might have them think twice about attacking and about performing their opportunistic, sorry, brute-forcing RDP system on the internet. So we want to make their life hard, basically. That's all I got for today. So I'll be around if you have questions or thoughts or anything. Thank you. Thank you, thank you. Thank you so much, Andréanne. We'll have five minutes. If you have any questions, please scan the QR code so I can ask them after that. And the next presentation will be in French. Okay? In French. What's that? It's hot. Wow, you just have to plug that in. Okay. So we're going to start the last presentation of this series of presentations a little bit more in connection with criminology. Today, we have Professor David Descarriers-Dus who presents, who is a professor at the School of Criminology at the University of Montreal who is also the chair, the director of the Scher-Darknet and Anonymity Research Center at the University of Montreal. And with him, there's Mélanie Théoret who just presented. And I like that we give her a big applause because it's her first presentation at the University of Montreal conference. Thank you for being here. And thank you for presenting. Mélanie, she's a student who ends up in baccalaureate in criminology at the University of Montreal and she did a great research with David. And so she's presenting it today with you. So I'm going to leave you the stage. Thank you. Thank you, Massara. So I'm really happy to be with you this afternoon. Massara has just presented in a really elegant way. And I'm sorry for my voice, which is everything, except elegant. I didn't see you yesterday. It's coming back quietly. And I took a few moments where we usually present ourselves. We say to each other, we're beautiful, we're ugly, we're good. To invite you, in fact, I'm one of the co-organizers for B-16 Montreal. If you want to submit a talk on our CFP, it's open at the moment. So I'm going to take a little break to start. And I hope we'll all see you there. Now, for the moment, today, we're here to tell you what to do, to actually talk about cryptic telephones. We heard during the last few years the problem of going dark. How did police services ultimately have a lot of problems to investigate the criminals? And how did encryption actually change the balance of power if we want between the investigations, but also the criminals? And so today, in fact, what we wanted to be interested in was to say, OK, but does this problem really exist? How does it actually happen? So we have a presentation that is divided in two parts. In the first year, Melanie will go a little more, in fact, a review of everything we've seen on cryptic telephones that we're going to talk about now. What are these devices? We don't sell cryptic telephones, I have to say, from the start. But we'll see how interesting these phones are for criminals and how they're also a little more convenient. And so we're going to look at these phones a little bit. How are they available? We'll see that Canada plays a really central role in the distribution of these phones. And in the second part, I'm going to come back with my voice, I hope it will last until then. And we talked during the last few months to several lawyers, prosecutors, policemen, and we asked them, in fact, how do you manage this cryptic telephone problem? And we'll see that the point of view is really very, very, very different than whether it's a defense lawyer or a prosecutor or a police officer. And to see a little bit, for you, I think it will be interesting too, how can we protect our phones, how can we manage it, and what can the police do if the problem never arises and we were stopped. So that's the menu for today. And on that, I'll let Melanie start. Thank you, David. Before starting with the subject, a little context about electronic listening and encryption. In fact, we see that electronic listening, as you know, is surely a tool for police officers who can be very useful and who plays an important role in the investigations. Although it is still used quite rarely because of the costs and resources that it takes, when we use it, it actually brings an irrefutable proof. And with the development of listening capacities today, we can do electronic listening on text messages, internet connections, telephone lines, all that. So it's problematic for clients, in fact, because they will have to find other means to communicate with them because, naturally, they don't want to listen to the police officers. So the solution for them, you see me coming, it's going to be the encrypted phones that will allow them to anonymize their communications. So in fact, we would have two categories of encrypted phones. There are more regular phones, Android and PES, which we could say that these phones will be encrypted the phone's content by default, but we also have encrypted phones that we could say modified. So we really have suppliers who are going to create phones in this bubble, in the end, to encrypt the communications. So at the level of the PES and Android phones, as I said, there will be a fingerprint by default of the phone's content. So it's going to prevent the analysis of the content. However, it's not going to prevent access to the copy of the watch and the data and the calls that are transmitted when the phone will be seized. And we can also have messaging applications like signals, WhatsApp, telegram, even a Snapchat that can be used by some individuals in fact to encrypt the communications because the messages that are exchanged will be encrypted from one user to another. So it brings a plus protection for these individuals. However, we see that it's not something that is unfavorable because in the Salvatore-Montagnan case, in fact, we saw the GRC that was able to intercept messages encrypted on a Blackberry phone within users. So in fact, even though these applications say it's unfavorable and that we can't intercept messages, sometimes it doesn't work always. And on the side of modified calls, in fact, it's really phones that we're going to come to, for example, remove the GPS, the camera, the microphone, the Wi-Fi card, even the modem, all of that, to ensure the anonymity of the communications. So in fact, all the content of the phone will be encrypted automatically. And it's keynotes that are basically kept on the phone itself, which ensures a protection against electronic costs and the discovery of evidence on the phones. And the big feature of these phones is that all the content is unfavorable at a distance. So even if a criminal is going to intercept his phone, he will be able to erase the content. So even if the police force has access to the phone by technical means, it doesn't mean that the data will be there again. They can be erased. So in theory, the police services wouldn't be able to analyze encrypted phones. So it's really going beyond regular phones and commercial messaging applications like Signal and WhatsApp. A small global survey on the encrypted phones. In fact, we can see that Canada is in fourth position behind the United Kingdom, Germany and the United States, among the countries that produce the most encrypted phones. So it's really a problem that is present in Canada. We have providers that operate directly from Canada and also servers that are operated in Canada. So we really have a record in the encrypted phones. So these are some examples of providers that we have had over the years, which have succeeded. And as you can see, they have all been put out of service today. I'm going to talk a little bit more about what happened. In fact, Fentum Secure and Inetcom were simply Blackberry that had been modified. We have Skyglobal, which had been operated from Canada and the United States, which worked on iPhones, Goldpixel, Blackberry and Nokia. Then we had EncroChat, which worked as an Android operating system, by default. Then we did a little manipulation. We had the operating system of EncroChat that lit up and it was a encrypted operating system. And Anum, its partiality, it was actually, it was created in the case of a police investigation just to trap the criminals. So that's it. For the price and the subscription, naturally it's available as a cryptocurrency to support an anonymous user. Then the prices, it really varies from one supplier to another, but it still looks like, often we have a price for the device as such. So we see here for EncroChat 1,000 euros to process the device. Then we have a subscription per month which varies from one hundred dollars. This is for assistance. The assistance services are available 24 hours per 24 hours. And this assistance service, mainly, we talk about the distance distribution of the phone's content. So that's mainly the service that it offers. So basically, the phone is encrypted. It hasn't been customized for criminal reasons. However, it has become with time. We see that it has become a central element of organized crime. We find it in traffic of suspicion, money laundering, human traffic, terrorism. And we still have a lot of users. We see that SRE Global had reached 170,000 before its closure. And among these users, there are several that are actually criminals who use them for criminal reasons. So I'm going to talk a little bit about police operations that were done in relation to the phone's content. So for Inetcom, which is still open for three years, it was actually started by an investigation on the owner of Inetcom, Danny Manupassa. Then, following this investigation, there were inquiries about the company's servers because in fact, the key numbers were kept on these servers. So following the investigation, it was by the Dutch police. And the servers were based in Canada. And following this investigation, there was the arrest of the owner and other arrests that led to the closure. For Phantom Secure, it started in 2008. We saw Mexican drug traffickers with these phones. But it's really more in the 2014, 2015, 2016 that it became more known and we heard more about it. Then, after that, the FBI started an investigation in 2017 on the owner of the company, Vincent Ramos. And in fact, what the FBI did was that infiltrated agents had bought encrypted phones to Vincent Ramos. And during the purchase, during the discussion, Ramos would have said that, in fact, Phantom Secure was specifically created to facilitate drug trafficking. So once they announced it, the error that it made was that the FBI stopped them and put an end to the company. For N-Cruchart, in fact, we saw a growing presence of these phones in organized criminal groups, which led to the beginning of an investigation in 2017. And then, following this investigation, the method that was used was, in that case, the police forces tried to export a security file by pirating the phones. In fact, the method that they used was not revealed exactly what they did, but the spot is that they would have installed a file on the servers responsible for updates or they would have installed a file on the phones, which makes them infiltrate the network and then access to encrypted communications. And then, after that, it ended up in the N-Cruchart service. So in fact, N-Cruchart, when they realized that the security forces had infiltrated them, they sent messages on everyone's phones and said, I'll throw away your phones, it's no longer good, it's done to be. For Skyglobo, once again, following the growing popularity of a start-up investigation in 2018 by the Belgian police, in cooperation with other countries, France and Belgium, then the method used in that case was that the police forces bought Skyglobo's phones and installed damson applications on the phones and sold them in the past for regular Skyglobo's phones and people who bought them, thinking that it was real phones. And like that, the police forces were able to listen to the communications and access the messages on encrypted. For Anum, as I said earlier, it was still created by a police investigation and it was an alternative to the other founders who had just been closed in 2021, just before. And in fact, it's the FBI that was responsible for that. They wrote an informant in the field and it gave them contact to sell their phones. So there are people who bought them without knowing that all the messages were actually sent to the police servers. And that led to the arrest of more than 800 people per session, 16. So the operation worked. And these are other companies that we have in activity today. We can see that we have a little bit in different countries. In Canada, we have Armadillo Phone and Wireless Warehouse which still exists. Their sites are accessible. We can buy encrypted phones. On the other hand, is it related to criminal activities? We don't know, probably, but they are still in service today. And well, challenges in police investigations, it's sure that the use of encrypted phones brings certain challenges for the forces of the law, especially its delay, it increases the cost of investigations because it can be very long to be able to access the phones, it requires technical skills that not all the forces of the law have. So it's sure that its delay in the investigations can prevent the arrest or the arrest of evidence. Or even that the investigation has been carried out in the end. It happens that the police can just not access the phones, so they will just abandon the accusations because it's their only proof, for example. And then, at the level, it's a traditional and modern method. Traditionally, what we did to access the phones, we went through these errors until we were able to get in. However, it can be very long, it means taking millions of attempts. And if today that the phones that we have, they will be locked up after a dozen attempts. So it's not really impossible to do that today. So today's methods are actually to exploit a security fault in the phone that is unknown to the manufacturer. However, it is necessary to have the skills to do it, which is not always the case. And then, at the level of the choice to decipher a device, normally we have two choices. Well, I would say three. The third is that the suspect lets us access his phone, but naturally he will not let us. But the two choices would be to give to the manufacturer to decipher the device, for example, by having a mandate or by asking him, but if the manufacturers will want to prioritize the confidentiality of their users and give them all that. Otherwise, the other, it would really be to control the deciphering with the help of technical means, as I explained a little bit by exploiting the security faults and all that. And then, at the level of the court, it also brings certain issues to the court and all that. We see, for example, that in the UK, it is considered as a serious factor when we use a phone to hide its criminal activities, it is considered as a serious factor. Which, the same thing with Canada, we see that in the decisions, the range that we see and that we draw, the use of a PGP phone has been considered as a serious factor, because it was used to hide criminal activities. And then, the big difference between the cryptic phones and regular phones is that the cryptic phones are not just to access a crime, as regular phones like the US or Apple can do, but they were created to hide criminal activities deliberately, so that's the big difference at the level of the court. So, I'm going to let David talk about the rest of our research. Excellent, thank you. So, a little bit of what Melanie explained, is at what point the service offer was really important, but also what makes it interesting to see that about all the cryptic phone services that were launched over the last 15 years have been infiltrated by the police, have been closed, and in the end, we haven't given all the secrets that the criminals would have liked to have. And there are also a lot of legal contests, in fact, in the case of Encrochat, for example, the French police have still put in place, all the encrochat users, without knowing who they were, in which country they were, whether they were criminals or not, and there are a lot of questions to be asked, well, since the police can listen to anyone, no matter how, so there are still a lot of questions that are made about that. And our goal was, therefore, to try to better understand this phenomenon, by talking to the people who are in the justice system, who will investigate the criminals, who will be able to manage all of this. And that's why, in fact, we talked about, in the last few months, the police, the lawyers of the defense, who are probably the most fun people with whom to talk to, I encourage you to do so. Find yourself a lawyer if you haven't already, go to the gym. And lawyers. And the judges, it comes from, in fact, we are in negotiation, always a little more delicate for the judges. But in fact, the question that we all asked them, very simply, is it possible to get phone calls, crypts and encryption, it changes something for you? A really simple question, but then we hear them talk for hours. And basically, when we talk to them, it's interesting to see, in fact, but this problem, in fact, it's called Kaki. And then, right away, we could think that, well, that would be hyper-high-level delinquents. And it's really interesting to see that already, the delinquents of organized crime are high-level. In fact, they just don't have a point phone. Why? Because a lawyer, you can't be followed, your GPS, we can put you under hearing. And so, in fact, the problem, we can completely eliminate it by not having a phone, even if I don't know what kind of life we have if we don't have a phone, but good. But so, what spoke a lot, in fact, it was all organized crime, when we talk about encryption, organized crime, in fact, of a medium level, because when we talk about street gangs and others, they are not necessarily enough lit to use this kind of technology. And even I had a presentation this week where I was listening and finally, well, street gangs put all this on YouTube, finally, everything they do. So it's like the reverse of encryption, I don't know what it would be, finally, the term. But hey, they are like completely decrypted. But otherwise, they talk a lot about frauders, of course. Even I don't know if you receive that regularly. I constantly receive offers to invest in cryptocurrencies. So people try to use messages that will be encrypted, a lot for fraud. And of course, without a big surprise, well, the pedophile who doesn't like that we know they have pictures of young children and that we monitor their communication. Here, in fact, it speaks a little, we can say OK, but the people who do piratage, the people who are involved in this kind of community, well, since practically no one is accused, it goes a little under the radar, so we speak a little about it. One of the really interesting points is what we can do with AI and the images today, that's what that means. But more pertinently, in fact, what point does everyone have to whom we talked about our goal was really to find, like one delinquent somewhere, who used this modified phone, the encrypted phones, and speaking to everyone, finally, it's like a problem that doesn't exist. And that was still quite interesting to see that Canada produces a lot of this phone. The companies that sell this phone are active in Canada, but speaking with people, in fact, it's not necessarily a problem where people don't go to that level. And we can understand it too. I don't know if this is someone who still uses a BlackBerry, but when we look at his neighbor, who has a Pixel 7 or an iPhone, if I tell you, look, let's take my BlackBerry, you'll see, you'll see with people, it's not something that's super interesting. And so the problem that they were observing was a lot with all the encryption, what we do with the phones, but it's probably all Android and iOS, a little bit of a base that people used. And here, there are still some constructs that are really interesting. One, we can always question, in fact, we know that the police like to sell themselves, to say to what extent they are capable of doing everything. When we talk to them, and when we finally talk to even the prosecutors, what they're going to tell us is that today, there is no encryption that resists the tools they have.  You have to forget that. And the big question, in fact, is how much time will it take? Will it take months to get there? Probably. But depending on who you are, they might be going to put the resources to get there. So, in all the cases that we were telling us, it's that we are able to break quite any encryption, but the flexibility, on the other hand, is not always guaranteed, it's that if you are the police body, I don't know, my Rosemary, and there is a Cambrillelage, you will find a phone, the chances that your phone will be encrypted are pretty bad, but if you have a murder in Montreal, if you have something of national security, we realize that, finally, we will have more powerful, more accessible tools, but there is still a huge lack of accessibility for the tools, and also, perhaps, for the criminals to protect themselves, and so on, you will never find the information that is on my phone. And so, here, there is no need to have, obviously, the older the phones are, the easier it is. It's still a package of numbers, saying that you are not helping if you are stopping, but it's no need to be a necessarily important tool for the security forces. And the last thing, and this is the thing that we often forget, is that we focus on the phone, but the phone will make backups every day, every minute, in fact, in the cloud, whether it's WhatsApp, whether it's iOS, and in addition, the other companies are starting to encrypt backups, but it's far from being generalized, and often, what the services will do is turn the encryption into a complete one, and just go to the backups in the cloud to look for the data and finally save months of work. And here, it even applies to things like Snapchat, which is still quite interesting and quite questionable to see. We think that all these faces are of service, but not necessarily as much as we would think. Here, one of the things that was really interesting, and we could have made a little survey, I would have had a little more time, but one of the questions, in fact, is to say to yourself, OK, but when the police will seize a phone, when we talk to the lawyers of the defense, the police look like that, and they say, wow, once we take the phone, we are able to go to any place, take anything, and if we take any of your phones, we have access to your bank accounts, your couriers, your messengers, we have access to an incredible amount of information. And here, it's really interesting to see the point of view of the defense, which will tell us, well, once we take the phone, the others are gone, they will go and look for anything, they will find additional crimes, and in fact, it's not bad to end the game, if you enter the phone, we are not quite dead. On the other hand, when we were talking to the prosecutors and the police, it was a completely different discourse, where they said to us, when I go in a phone, I have to be able to say exactly what application I want, what information I'm looking for, for what period. So you really have to limit this extremely, extremely pointed out. And in fact, it's not them who will do it, so we have a technical service, and what they said is that even when we send the mandate, well, the people of the technical service will make filters, but it may be wrong between the 5-1 and the 6-1, because of course, it's all the same. And so you don't even know if it's all the messages that you're supposed to have in the phones. And here, other problems are really quite important, it's that when we're going to ask for a mandate, for example, we're going to say, well, we're going to have all the communications between Massara, Andréane and David, but obviously in our phones, what you think is the name of Massara, Andréane and David, which is clearly not well written, which means that when you're in the phone, there's no message that comes from Andréane, so you have to try to pivot, you have to try to find the legality. What's Andréane's other name? Or his hacker nickname, we'll talk about it later, in the Q&A maybe, but you have to try to find how you can connect people to their virtual identity because the mandates are going to be extremely limited. And here, it's reassuring or disturbing depending on which side of the law you are, but even he was telling us that when we're going to send someone in a phone, we're going to send around the date of the crime so it's not true that you can say, there's a murder last week, I would like to see the messages two months ago, the judges will tell you no, you have to watch the days before the murder, the days after the murder, and that's it. So it's really interesting to see at what point are the challenges to collect and pivot in the phones, it's really a real crisis at the moment and one last thing about the challenges, it's the fact that surprisingly, the most difficult thing to access, what was it? Well, it was the photos and videos that people take, which is probably the thing we want the most, to have, and apparently, the expectation of private life is so strong that in the end, the judges will never give it to us. Now, as I was telling you, still, are the phones playing an important role?  It was really interesting to see at what point, is that today, a large, large party, in fact, the proof will come from the smart phones, and that's why the police will put so much energy to break the encryption to have access. He gave me an example, in fact, a murder that happened last year in Montreal, he was doing the file on a subject, and the subject that he was saying in the file, well, it was shot by someone. So it was still good because it was still there. They were able to follow the shooter until his car, where they were saved, and finally, when they were in the car, they were able to stop the two people who were involved in the murder. Then, by taking the phones, there were all the messages on who was in charge of the murder, how much was paid, all the details, there were even photos, in fact, of the plagues of the person who showed that he had had the surveillance of the target in front of him. It was perfect, and in the end, you don't even need anything else. You bring the phone in front, you let it show, and it was absolutely everything you needed. So today, it's really interesting to see how much all the evidence and all the energy is put on the smart phones, and it also asks the question of how do we manage this problem, but also, do we invest elsewhere, and how much are we not all of us in the same panel, and it's not problematic. And here, obviously, the last thing, it was to say, well, we know that this is an incredibly important role, but at the same time, it will make that if we don't cooperate, it will bring problems, but in fact, it's true in many cases, yes, so the sophisticated, the fact of having a smart phone not to collaborate, not to give its code, we were losing months in the system of justice, we brought really important costs, and all of that, it made that we could have penalties that would be higher, simply because we used encryption, and that too, I think it's still enough, which is great to know if we can be punished simply because we use encryption technologies, I don't know if we want to live in that world. And so, to finish, well, of course, we asked people how can we improve all of that? In fact, that's where there are all kinds of solutions that come in, and of course, when we talk about the police side, well, we should actually be able to unlock all the phones if we had a smart phone, and that would be interesting to say in our Q&A just now, at what point do we want to be able to protect these data in England at the moment, so there's a lot of debate on exactly the access to encrypted data, I think that the government would like to have access to everything, and we will come up with solutions, for example, we will make an organization that will manage our encryption keys, which will give access to certain information, but is it still quite questionable to see if we really want to allow this access to everyone? And the other thing is that there is really a feeling, and that's still quite interesting to see at what point, is that the police, are they not going to cheat a little? Mainz-Sylmanda says, you have the right to look at the photos. Are the police really going to not look at the photos? Are they going to stop the flow in the phones? At the moment, the police are with the phone, and we have no idea, except their good faith, that they did not abuse the system, and there we have a lot of stories that we hear about precisely how we find the proof in the phones, and then we are going to find a reason to legitimately have this information. And that's still really questionable, and it's the same thing for the computers too. So, at what point are we able to protect our data? And at what point can we not put in place finally measures to prevent that there is surveillance, or that it depends on the world? And finally, the last thing, we do not understand too much, is the fact that several judges we will see to tell them, we want a mandate to monitor a phone, they do not necessarily understand what is happening, what are the implications, and the fact that there is still a big disconnect that often allows the police, finally, to go a little further, where they should go. So, that's all for us, I hope it was interesting, and that it raises important questions for Q&A. If you have any questions, you can write to us or talk to us in a few moments. Thank you. Scan the Q&A, write it, and then we'll see you in 15 minutes for a little Q&A session together. It's time to take a little coffee, a little beer, and see you right away. Celebration, let's go. Oh, we have less people for the questions. Yeah, they're beautiful, aren't they? Oops. Okay, thank you for coming back. Let's start this Q&A session, and don't forget the Q&R, which I said earlier. I cut QR, if ever you wanna ask questions or abode questions too. So yeah, I guess before asking the audience's questions, I had prepared a few questions for our speakers, so I'll start with that just to kick off. And we'll start with Vicky, because you were the first one to present. Thank you very much for the time and for the presentation. Thank you for having me. So, I know you have a background in criminology, and you know that in our field, we often talk about different theories, and we know that often when we have opportunities, delinquents will often try to reach these opportunities, and then after that, we'll kind of see a lot of them being exploited and will plateau. So this was applied, this kind of theory was applied to cyber crime, where we saw that different types of cyber crime were highly exploited for a really long time, and then slowly, less and less people exploited it just because the marginal revenue was less. Do you think that for ransomware, we're kind of reaching this plateau, or are we still in the higher ups of the curve, if you see what I mean? So, all right, I've never had a mic before, so let me know if you can hear me. Yeah, great. So I think the answer is not that simple, because as things progress and we have new software coming out, there's always new opportunities that are born. Well, not born, but are created. So until software are being sold with zero vulnerabilities to them, and like, defense is in the creation of those projects, those software, I don't think we're gonna be in a position to say that the opportunities for ransomware are lacking. And I also think that opportunities are sought after and they're gonna find one when they are looking for them. I also think that they're still money to be made, so if monies is still at play, they're still gonna find a way. So that would be my answer. I used to think that ransomware was sold 2018, to be honest, and then just, just, RAS has happened and it just never stops, and I'm just wondering when we'll reach that plateau where ransomware will be out and we'll have like another kind of threat that we'll all be talking about, but it just doesn't seem to happen, so I totally agree with you, maybe not. Maybe I can ask Andreanne another question. One thing that I would wanna say is, if you know Andreanne, you know she works with Olivier at Gosecure and they're doing amazing research, and maybe now you'll know, because I'll tell you, that they've been accepted at Black Hat USA this year, so they'll go and present there this summer. And I know that the research that they'll be presenting is kind of a follow-up of what she's presented here, so maybe if you would wanna talk, tell us a bit what you're gonna present at Black Hat and what's the plan, it'd be nice, of course. So one of the next step of our research was to analyze all the compromise session, so that when the attacker succeed in entering our system, so we will analyze all the video footage, we have over 100 hours to look at, so there's a lot of work before Black Hat. But we already started looking at them and we saw kind of different profiles, and for our Black Hat proposal, we suggest that those profiles should be analyzed under the D&D team, Dungeon and Dragon team, so you have those people, oh, I can't remember the name of the categories now, but there's a sorcerer for sure, no, there's a wizard for sure, there's the bard who doesn't look to know what he's doing, there's, I can't remember the name. There's always a goblin. The what? A goblin. No, there's no goblin there, but you know, there's people entering not knowing what they are doing, it looks like they maybe have buy, they maybe bought the RDP access from someone else, other that they know exactly where they're doing, they already have their tools, they install it very fast, and they do their thing, there's other who compromise other computer to this RDP session, so there's a lot of different behavior that are very interesting, and we will be presenting the video footage with example of the video of what we see and all the analysis of the different profiles that we see. Nice, and you're really actually seeing what attackers are doing in your Honeybuds, so this is rare data that we don't usually have, which probably explains why, and that and your amazing work that you've been accepted at Black Hat Existing. Yeah, it will be interesting. So I have a question for you too as well, when is B-Sides and where? So B-Sides is going to be in September, I want to say 16th of September, it's going to be at the bank, so same venue as last year, we're going to have free workshops and trainings, tons of free food and amazing talks like last year. We did B-Sides the first year and we kind of had to get the talks that we could, and last year we were really just submerged with so many great talks, and so hopefully this year we have the same quality speakers as we had last year, and it's $40 and you even get a free t-shirts, so what more can I say? And it's another chance to gather all together the community and see each other, which is kind of nice, half of the year in Nordseg, the other half at B-Sides Vancouver. But no, truly on your, I'm sorry, sorry, sorry. Sorry. A question on your presentation. Since you've interviewed lawyers, as well as police officers, what group of individuals had the best vision of the problem and the best knowledge, at least a little bit experientially, of the fact that there is a use of phone numbers in the Dominican Republic? I'm going to get a little too punk to trust Avergle-Layman at the police on the fact that they don't need to be in the phones. I'm sure that Melanie will answer this one of everything you've heard about. I'm sure that you'll be able to answer this one of everything you've just seen. So can we trust that our rights are respected? Well, you know, it's for sure in relation to police officers, it's always interesting to say to us, give us the information where, you know, there are things that can't be said too, technical investigation, all that. I would say that you know, the lawyers, they just want to get around in relation to the opinion of the police. So that's what they gave us, more information on that. But as I find interviews, it's fun, because it gives us different points of view, and it's really opposite of the police side and the side of more lawyers and criminals. So that's what's really interesting, I find interviews. But you have to see that there's a huge amount of risk. Even if we can think that when the police will have the phones, they will do what they want, there's still a huge amount of risk of going crazy in the phones, of being caught and realizing that, we have the worst conversations we haven't had. So I like to think that they respect our rights and all that, but there's a little bit of, how can I say, we'll look a little bit in the corner to see if we find something interesting. But in fact, I think I was just asking the question really, are those people you had interviews with, you answered by their idea that that was what was happening, where they really had a concrete experience of using digital phones in cases as such. Yes, absolutely. So it was really people who had their experience, so the files they had, how did they treat those files? So they really counted on the victim. And was it something that was recurring in their experience? Yes, in fact, there's probably no more case where there's no smart phone that's involved, no criminal case, at least. The question becomes more, are we able to use the proof of the phone to condemn someone because the phone is going to be encrypted? But a little bit like today, what crime is not vaguely cyber? I think all crimes are going to be cyber. I don't know if that's because the criminals are talking about Messenger. OK. That's good, thank you. If I ask a question to the whole panel, I might change it in English. That's very Quebec-Maurial, in fact. Just a question for the whole panel. I think there's one thing that comes out of all your presentation, is whether or not attackers are sophisticated, like either through using shadow phones or ransomware or attacking RDP honeypots. Like, are they sophisticated from your perspective? Are we really facing individuals who are, yes, kind of innovating all the time, but being sophisticated and we're having a hard time, or are we mainly facing dumb people trying to just hack for hacking? Just really, it's a really broad question, but I think it's a question that needs to be asked because we live in an industry where we always talk about attackers as the guys with the hoodies or the girls with the hoodies who are highly motivated. And I'm just wondering, from your experience, what is it? So, I don't think, well, it's important to have the same definition of sophistication. This is where the argument is. In my case, in my research, I think of sophistication as anything else than the pure basic easy, well, easy. Again, like, my mother cannot do this attack, right? So, it's not, like, you need some knowledge and how to do it, but you know, there's the plain basic, very opportunistic. I think we can, like, use this term, so opportunistic, and then I considered a bit more sophisticated those who think about what they are doing and try to do better, right? By leveraging information and by trying to imitate behavior. So, this is my definition, but people don't have the same definition. I think that most, I look to answer the question, I think that most are not the highly motivated, very good hacker, most, at least for RDP attacks, are kind of basic opportunistic attackers, and that's all. So, reaching for the low-hanging fruit. Yes, exactly. If I can just revert the question for you just before we go to the other speakers, is how many attacks on your RDP were actually really sophisticated? You could see a human was behind the attack, really trying to get in. It's hard, I can tell for sure. Like, who is the human and who is not? Well, there's a human behind the screen, but I mean, you know. And I, because I don't, I, like, no, I cannot tell. I don't have an answer for you because I can't tell. I guess it would be the ones who actually compromised the systems and then started to do things like watching offensive videos. Yeah, of course they are human, right? Because like they were able to compromise it and I see them, I see their clicks, their keyboard, and it's obviously not a computer doing that. So, of course there's, well, for those people, we have like 3,000 session, like video, different video footage. So there's at least 3,000 human. And then from these 3,000, at your next presentation, you'll be able to let us know how many were at least reaching for the stars. Good answer, yes. Exactly, yes. What about you, other? So I think from my research, like I would say like your top 1% of ransomware creators would be very sophisticated. We can think of like the writers of LockBit for one and like the top dogs, well not dogs, but like top ones would be yes sophisticated. I don't think that the affiliate and going down or as sophisticated because they rely on other people's product. But I also think the question should also be, do they really need to be sophisticated when their target are not?  It would be probably smarter if your intention is to get money to hit in the path of lease resistance and sometimes sophistication is not needed for that kind of attack. So that would be my answer. That's a good point. Well, I would say for encrypted phones, once again, if sophisticated, what does that mean? But you know, often the encrypted phones, the people who use it, it's the organized crime or the, you know, the smaller, you know, the bigger, the bigger group, so I would say in what is also maybe more of the encrypted crime and it won't be the smaller criminals who are going to use encrypted phones. So I would say more sophisticated. And maybe one last point is we've seen a change and I think Andrian's work really showed it, is we have this professionalization of the attackers where they're gonna be attacking from eight till four, Monday through Friday, and there's this question of relentlessness also. So it's not someone who's casually poking targets, trying to get in. If you remember the movie hackers, great movie, but they're just poking around, they stumble into something. But right now it's a bit more coordinated. We have state actors that are attacking, companies that are attacking each other as well. So I think this professional aspect in this organization doesn't mean they're more sophisticated, it's just they're more organized, and even if they're not better than they used to be because they're organized, they can achieve more. True, thank you. I'll go with the questions from the public and maybe jump in after that. David in Mélanie, there's a question that says, in relation to the presentation, the force of the order and the system of justice seem to take a position against the protection of private life in order to help them in their work. What do you think? Tough question. It's not necessarily to take a position against, but in fact it's always the point of view. And we have a continuum, we're going to, on the one hand, protect people by arresting criminals, and on the other hand, we're going to protect people by preventing their private life from being made public. And I think it's a choice of society, and a choice of politicians to say, where do we want to put the barrier? And of course, the people who want to succeed in their work, to have promotions, to put the criminals behind bars because it's the thing for them to be born. That's why they breathe. But they're always going to push to finally have the work as simple as possible. So we see a certain movement to have access to this information. But at the same time, I find that the counter-power works really well, until now, in the word Canada, or in the sense that what we see, when we were talking, for example, to the prosecutors, when we actually see what they have the right to look at, is so pointed at the point of being almost useless, in the end. I think we're still good here, especially when we compare a little, as I said, to England, where we're going from the other side completely. Or in the end, we wonder if we still have a private life. Melanie, you're right. I would say quite the same thing, that David said, there's always this debate, and not just in the encrypted phones, in the Sberk that has been in general, between private life and security. So this debate is always there. But I would say that, you know, in Canada, we still have access to the safety of the data, all of that. A chance, at least in my opinion, but in all cases. Maybe I'll just continue with you when we talk about encrypted phones, just to know, have you seen legal use of encrypted phones in your search? Can you give examples, talk about it a little bit, or are we really just in an illicit world? The advertising should really be done for criminals. Are there companies that use this phone? Because precisely, it allows you to have a higher level of confidence, possibly, but it's probably a drop in the ocean. Because finally, these phones are not known to all. There is no advertising on TV to say, buy your BlackBerry PGP. So it's not going to be in those circles. And so I think we can say it's a lot of criminals, finally. And then the example, the supplier, if that's the case, in the end, that after the closure that other suppliers had had, they tried to make their company more legitimate and try to hunt down the clients, like criminals, to prevent them from closing their company. But they didn't really succeed. They rather decided to just close the company before they were stopped. So I would also say that the majority of people who use this phone are the people who do it to hide criminal activities, illegal stuff. Have you thought about questioning these operators to find out if they are available, to find out why they develop these phones, and precisely if they don't necessarily have a different vision of what their service is for them? Yes, exactly. But in a universe where we are financed by the Foundation of the Barrow of Quebec, that's the question. Okay. Vicky. So from somebody in the audience, do you think game theory could be applied to analyze attacks and identify potential false flag operations? I think you can, but then it would also be difficult because it's like what we found with ransomware groups is that they share a lot of similarities in how they behave. So then attributing who does what becomes very difficult and you can't know for a fact, there's also a lot of, I'm gonna make this look like somebody else did it so I can put the blame on it. This is often done for political reason. So when you're playing with that and then trying to compare it to like with false positive, it could all, you could do it, but I don't know if it would be the most efficient way to use game theory. What would be the most efficient way to use game theory? In cybersecurity, I guess. In cybersecurity, okay. I do think that it's a good way to use it when you're studying extortion, when you're looking at a conflict head on, like I don't think phishing as a whole could be, like that would be a good use of game theory. Ransomware is interesting because there's that back and forth in that, I don't want to say collaboration, but you do need to collaborate with the victim to get a payment. There is that interaction that can be studied. So I think in crimes where you need both parties to interact with each other would be a good usage of game theory. Yeah, true. Thank you. Andrian, in your IPs, you had Monaco. Do you know why? Monaco? Yeah, I don't know why. No, I don't, but you know, this is also a part of the next steps is to look at shared IPs or very close IP from one another and we want to investigate where are those IPs and are they from, you know, the words is missing, but the companies that are specialized in, like making the traffic go through them. DNS? What is it? DNS? Maybe, I don't know. I don't know either. DNS? So, like when there's company that you can go to... Do you want to scream it? Yeah, I don't... Do you want to scream it? Yeah, let's say that. Okay. Like a company that only is there to... Forward traffic? Forward traffic, yes. Sorry for that. Team effort. So it's not like from one computer, but from like a seller of proxies. So this will be part... Like this... We might be answering this question by this because if it's a company of proxies... Okay, to determine whether or not the attacks... Are really from Monaco? From a proxies or not, okay, I see. So determining whether the IP... where the attack comes from, whether it's owned by a proxy server... Yes. Makes sense, yeah, yeah. Sorry, difficult to answer, but... Yes. This is alignment. Tell me, somebody asked where were the honeypots located? Did you deploy them all over the world? No, they are all located on an AWS computer site in the United States. So this might change. We want to... Well, it had been... I know that Olivier already tested like putting honeypots a bit everywhere in the world, but he didn't get like so much... conclusion from it, but I would like to do it again and look at the data for myself to compare, like, if the United States were targeted in this case or if there's a difference between the honeypots, but they were all in the same place for this project. Interesting. And it's true, he did try. We did it for... Yeah, you were there. We hosted honeypots all over the world in the research project and we thought that it would be different, but it was not. In the end, it was just the same thing. So I would be wondering whether RDP Honeypots would have different findings. Maybe one last question that I would ask you all is if I gave you the opportunity to do research with the millions of dollars I have and absolutely no... let's say absolutely no headaches in the sense that you can do the research you want and sort of research questions that you can and reach the study population that you want. Whom would you reach? What would you study to answer the research questions that you have answered today? And why? Because what I'm seeing is in criminology and in other research that we do, we're stuck doing secondary data analysis on secondary data from white papers, from, for example, interviewing people who have heard about it or seen it but haven't used it for the purpose that we want to study. So I'm just wondering, if I ever you could do a research to answer your research questions reaching a certain population, what would it be? And I gave you my funding, like my million-fundation dollar. And we have no problems with ethics? No problems with ethics. And that's the hard part, honestly. This never happens. It cares for sure. So to me, it's this whole class of enablers, basically, you know, people who enable others to do crime. I think these are the most interesting people we've barely managed to talk to, interview and try to understand who they are, where they're coming from, what their goals are, are they happy? We don't know. One of my students, she spent months hanging out on different forums that exploit XSS and Alligator and other forums.  And that's the kind of stuff that I really like. It takes forever to earn their trust and to just be there, and that would be something if I could... I wouldn't want millions of dollars. I would want a time machine so I can fast-forward through all that part and get to the juicy stuff at the end. Interesting. Okay, so I have so many ideas. And since ethics is not a problem, I'm going to go with the real one. So what I would really want to do if ethics, and none of that was a problem, I would want to do group interviews in one room, and you put all of, like, all the APTs, like, from Russia, from Iran, from China, from, you know, North Korea, put them all in the room, and then no agent anywhere, obviously. And then I would just ask all the questions about the rules of engagement and the tools for espionage, because I think that would be so interesting to study from inside of how things are happening, because APT groups so far have been one of those things that are really hard to study because you can't get close. So that's what I would do. That would cost a lot. Well, you said millions.  So call me not creative, but I cannot think of any other project that what we are doing right now with, like, kind of looking, like, with the video footage of what they do, of what the hackers do once they compromise a computer. I would just expend this a thousand times and look at the footage for, like, hours. I love video footage.  I think so. Yeah, for my PhD, I looked at the footage of, like, the police interviews and things like that, and I loved it, and, you know, I know how to study that. So I really liked it. It's a bit voyeur to, like, look at... Like, they don't know we're looking at them, and they're, like, compromising computers, and I kind of like it. Nice, interesting. Melanie, do you want to add something? I was going to say a little bit of the same thing that you said, Andrea. At the end of the day, it would be them who would be more difficult to join when we're doing the research. But really, you know, yes, the interviews, yes, you're often going to have bills of reliability, yes, or other bills, but just to see them, as you say, in their environment without knowing a bit about them, it avoids those bills, and I think it would be interesting to study that. Interesting. On my side, I'll share just because I can. I think I'd want to... I think I'd want to chill with hackers, but real ones, like in the sense of in Eastern Europe or in Russia, and see what's their reality and understand how and why they participate in such activity. And with no judgment, and when I say chill with them, it's basically just talk, you gotta explain that you're not looking at them, but you also are interacting with them, so you're having an impact on them. I mean, we could share the project, and then we'd pick a nice destination with a beach somewhere, combine all of them together, we study them, we hang out, and then have a nice vacation, because like, hey, we're not paying. Exactly. Well, thank you so much, everyone, for being here. We have a 15 minutes break, then there's two other presentations coming up, and the closing ceremonies, so please stay. And thanks for listening to us and for being at Nordsec. Thank you all. Thank you for... Oh, there's a... There's a raffle, too. That will be so...  A raffle. Hello, hello, hello. Good. So we continue with the unofficial subsection of the conference. So we have Magno here. Magno Logan works as a information security specialist for Trend Micro. He specializes in cloud, container, and application security research, threat modeling, and DevSecOps. In addition, he has been tapped as a resource speaker for numerous security conferences around the globe. So please welcome Magno. There you go. Thanks, everyone. So, yeah, today we're going to talk about GitHub, just abusing GitHub for fun and profit, actions and code space security. I'll focus more on the actions part. Code Spaces is a research that I did together with my teammate, Nitesh. I'll present a few things at the end, and there's more stuff coming up in the next few conferences as well. We have another talk in NDC in the next week. Stay tuned for that. So, yeah, just a little bit about myself, originally from Brazil, been in Canada for five years now, and I'm part of the Nebula cloud and container research team. I have a blog there called Katana Security. It's currently offline now, but I should probably restart it. I'm also an instructor at GoHacking. It's a cybersecurity company in Brazil. We provide intermediate to advanced trainings in cybersecurity, and we're trying to bring those trainings to Canada and in English as well, so those are live and online trainings. But, yeah, the best way to reach out to me is through the LinkedIn. This is the QR code. If you want to scan it, feel free. I guarantee there's no malware there. So, yeah, on this one, at least, but yeah. So, yeah, these are the topics for today. I'll try to go over them really quickly since the time is short. But, if you want to learn more, this research that I did around GitHub Actions, I took about at least three to four months doing the research and then writing this blog post. There's a lot of content there that I won't be able to cover everything here in this talk. But, yeah, a special thanks to Felipe Proteus, a friend of mine who helped me with this research as well. Okay. So, who here has used GitHub Actions? Okay, a few hands. Who here uses it in production? Last, okay. Who here has played with GitHub? Yeah, okay, that's sort of expecting. That's fine. But, yeah, if you work with CICD tools, things like Jenkins, GitHub Actions has a similar approach, but in a way that you don't need a separate server or separate environment who do some automation, your CICD, continuous integration, continuous deployment. And basically, the idea is that you have a file inside your repo and whenever there is an event, something that happens inside your repo, it can be like a push or a pull request or something changes there. That triggers this event. And this event spins up or actually assigns a VM inside Azure, right? Since GitHub is now owned by Microsoft and these VMs, they're not containers, they're virtual machines, they're called runners.  So, inside your action, you can call other actions. So, there is some dependency there. And there is three kinds of runners that you can have. You can have, like, Windows, Linux, which is based on Ubuntu or Mac OS. You can do that. And these are provided by GitHub. So, these are any account, any free account today, you can leverage actions. Of course, there is a limit. I believe there are 30 hours per month, but you can use those today. I guess the high adoption rate for GitHub actions, one of the reasons is because it's free. Of course, people like free stuff, but also because of the marketplace. The marketplace is basically anyone can develop their own actions and provide it, make it available on the marketplace so people can use it, avoid reinventing the wheel. And so, companies are developing their own, like, plugins and providing that on the marketplace. And I think this number is already higher today. And so, yeah, it's happily increasing. So, people are making available automation where you don't need to write your own action.  Okay, but if anyone can upload actions, what happens if attackers also do that? What if I'm a malicious user and I upload something to GitHub? There is no today, as far as I know, there is no security process being done around GitHub actions. There is no verification. So, if I upload malicious actions there, there is no checks or anything being done in that front. So, what are attackers are doing in that sense. Basically, they're abusing GitHub actions to mine cryptocurrency, right? It's free money. So, if I have 30 hours, this is basically one of the YAML scripts of one of the actions that I've analyzed. There's hundreds of those still today available on GitHub. And basically, what they're doing at the end here, you can see that they're running a node.exe, Axe and Briggs, so usually Monero Crypto Miner and then the username and stuff. So, I'm not big on crypto, but yeah, this is what we're doing. Some of the attackers they're even limiting the CPU percentage to avoid detection. So, some attackers in this command they have like a limited 70% to avoid being detected. This top thing here, the strategy, it's basically to parallel, to scale your actions and maybe deploy different runners at the same time to make more money faster. And this part here is that I'm using third-party actions. So, this uses parameter. It's like I'm calling a third-party action. And this one is actually provided by GitHub, basically to download the code of your repo inside that VM, inside that runner. But this one here is not. It's not provided by GitHub. It's a third-party action by someone else. Someone made an action to retry your action in case it fails. But attackers already are using that. They're leveraging this third-party action, which is a legitimate action to their own gains, to their own profit. So, this is really interesting. And in here, of course, they're abusing like a Windows runner, but I have more examples of Linux and macOS as well. So, yeah, I've analyzed this third-party GitHub action, and it's actually a legitimate one. And attackers are using that for their own gains, which is interesting because it's like they know better than us who are trying to build pipelines and use actions. They're doing it better than us here. And, of course, the node.exe there was a malicious file. It was flagged by VirusToto and things like that. So, yeah, bad thing. Another example here. Now using PowerShell, it's still with Windows runners. And this script is really interesting because I found hundreds of examples of scripts, of repositories with the exact same code. So, basically, at downloading the crypto miner and then extracting the file and running there. So, pretty basic stuff, but they're making free money, right? Whatever. Until the GitHub security team can flag and can monitor that for any suspicious activity, they're making free money. So, these are some of the examples of the repos with the same code. There is probably a hundred more. We reported those to GitHub. I think they took it down pretty much most of these, but if not the attackers were able to just create a new user, create the same repo or a new repo and then start, you know, mining things again. So, it's just like a cat and mouse chase in this scenario because it's like, yeah, it's hard to block and especially when they block the actions, they block that specific repo. So, they don't block the user itself. So, if the user creates another repo, they can still leverage the actions to continue mining. Some other examples here are now using Linux. Same thing. Just downloading, extracting the crypto miner and then running there. XmRig again. So, you can find that even just doing basic search on GitHub, if you look for XmRig where it's inside the .github slash workflows directory, the folder where you're supposed to store your actions, your automations, just search for XmRig and you're probably going to find some examples there. And, yeah, similar way to just mining cryptocurrencies. And the latest example that I have here and it's from abusing macOS. As I said, you can also run a macOS runner, macOS VM inside through the GitHub actions, which runs on Azure. This one, like, okay. This seems like a legitimate thing, I don't know, core book, whatever. It's Chinese, I guess. But, oh, yeah, you can run. There's some instructions there. But, when you go to check the YAML file, that's where it shows exactly what it's happening. You can see that there is XmRig no fee and there was a file there as well. I think, yeah, XmRig no fee down here. So, that's the one, the file that it's using. But, basically, yeah, it's a crypto miner. I'm not a macOS expert, but I asked my help from my team there to analyze the binary and it's definitely a crypto miner as well. So, not a good idea, not a good, not a legitimate file. So, I'm not sure why they're doing this core book hacking task, why they name it like this, but they always try, as you can see in the previous examples, they're always trying to, you know, make it sound legitimate. I don't know why, but, yeah, the name, CICD there, run tests, things like that to try to mask it, but it's not that great, right? Okay. So, if you ever see this on a GitHub action, if you go to the tab there and you see GitHub action is currently disabled for this repository, it's probably means that they did something bad with that repo and that's blocked because okay, now you're not allowed to deploy the VMs, the runners inside Azure to run your automation, right? But as I said, if you create a new repo and then that repo is allowed to deploy actions again, so it's not really effective in a way that, okay, the attackers can just create new repositories and then start mining cryptocurrency again. Just another example here. Okay, so after this introduction, basically my research, the focus of my research was the main focus was on malicious GitHub actions, right? Third party, as I said, you can leverage the marketplace to use GitHub action developed by other people, but what happens if this other people is a malicious user? So what I did was I created a separate action in another repo and I try to call it from my own repo. That was the goal of my research. Of course, I didn't upload to the marketplace, otherwise I would get fired, but yeah. So the idea is you have to treat your GitHub actions as a third party dependency, right? Just like you have to interact with your libraries in your code that you import a lot of libraries and you don't know where they're from. Basically you need to treat your actions like this. A few things here to highlight is there is one validation from GitHub that checks the creator of the GitHub action. So you can see here this blue check mark. It's not like the Twitter check mark. If you pay, you get it. No. That's a domain validation from the company or the user. So most of the companies will try to get this one. But again, this is not a security verification. It doesn't mean that the action was checked for, you know, any malware, backdoors or crypto miners. And the other example there is that every action is a public repository. So when you're calling actions over there with uses, actions slash checkout, you can actually go to that repo and see the code that it's being downloaded and run inside your runner, inside your VMs. So if you go to github.com slash actions slash checkout, you can read that code. And if you have proper tool to static analysis, for example, you can analyze that code and see what it's doing. But these ones from actions, the user or organization actions, these ones are provided by GitHub. So technically, they should be legitimate, unless someone has compromised their user name or something. Okay, so this is what I was able to do during my research. Not just exploiting the third party action, but basically running inside, technically you can't run interactive commands inside your VMs, your runners. I was able to do that and running an end map inside the Azure network, doing a reverse shell from the runner to external server. And you can also leverage your actions, since there are VMs, their servers, to pivot that and attack other targets, either inside Azure or even outside, because they have outside connection as well. So this is just an example from the end map scan. The first one is my actual runner, my VM bear. You see this is an old screenshot, but basically you see some ports that are known. But there is one port there, 8084, with a server called Mono XSP server. This one, it was interesting because it's a very old ASP.NET server that was there. And I couldn't figure out the reason why it was there. I think it was more for health or monitoring purposes for internal from Azure. But what's interesting is that this web server was the only one that was enabled by default. So you also had Apache and Nginx installed, but it wasn't enabled. So on the latest versions of the action VM, the Ubuntu one, this has been removed. So this server, I'm not sure why exactly, but this one has been removed. So you don't see, it's not even like inactive, it's not there anymore. So here is where I did the reverse shell from the runner. So basically, the Ubuntu VM has a lot of tools that come installed. One of these tools is NETCAT. But the NETCAT version on the Ubuntu is capped because you can't use the dash E version. So this was one way, of course, there are other ways that I used to download and download this from scratch to create like a reverse shell to my instance. So you can see, this is the demo script, and this is my EC2 instance on AWS. And basically, I'm just opening the back door and listening there and waiting for my connection from my action. So we can see the information here that the username, runner, which we call the VMs, runners, we can see here as well, this is from Azure, from the VM provided by GitHub for this scenario. So yeah, now I can have interactive commands, right? I don't need to build this YAML file and submit and make a pull request all the time to wait for the changes, wait for a VM to get assigned for my actions. Now I can with this reverse shell, I can basically write the commands anytime, anything that I need. There is a limit here. I believe that every job has six hours limit, so every set of actions, you can only have six hours to interact with that VM, but that should be enough for research purposes. And each runner runs until 72 hours. So you have like three days until your runner gets disconnected. And once the runner is disconnected, it's shut down. You don't have access to that runner anymore. So anything that you're doing inside that VM, you need to either upload or copy or collect those artifacts, otherwise you lose access, you lose everything that it's there. So yeah, since I can do reverse shells from the runners to my server, I can also issue malicious commands to the servers to my runners, such as scanning or attacking other targets even outside of Azure. So this is, of course, this pivot part I didn't actually execute it, but that's a possibility as well. Okay, now what happens if someone uploads a malicious action to the marketplace? So similar to what I did in this previous slide, this code here, I basically created that in a separate repo. And then on the first repo I call this code. So it's similar to, in a way that marketplace works, just calling a public repository from another location, another user. That's what I did. So yeah, hello word, the example from the GitHub actions documentation there. But then it calls this shell script there, which basically is the same one that I showed earlier which does the backdoor for me, the reverse shell. So what happens is if I provided this into the marketplace, anyone that would use of course I wouldn't label it like that, I would try to make it less suspicious and things like that. But anyone that used this action they would create a reverse shell to my C2 server, my connection there, the EC2, whatever I had it that would work as well. So same way okay, now this is the demo file calling this third party action. So this is another repo. It's the GHA test. They're all public repos. If you want to take a look, there is not a lot there but this is what I'm doing, right? They use this calling this third party action fake GHA which runs that code here, which basically in turn gives me the same reverse shell that I showed you earlier but now from a third party. So be careful with actions that you're downloading that you're leveraging from the marketplace because since there is no verification as far as I know then you can, yeah, if you're not validating those these can happen to your environment as well and once they're inside that environment once they have the control of those VMs there are a lot of credentials there's a lot of tokens including the GitHub token which allows you to maybe change read your repo information there or even write depending on the permissions, write information to back to your repository and you know things like CICD or supply chain attack can happen here as well. I know I'm almost out of time so some counter measures here related to GitHub actions it's not great as far as I know there are no tools today to actually check your actions for malicious intentions, malicious purposes I've been working on writing some rules for other static analysis tools to be able to provide that and I'll probably make that public very soon but as far as I know, I don't know maybe on the next talk Logan can say if the GitHub is working on something like that that would be beneficial but yeah, basically make sure that you have the least privileged permissions to your actions you don't allow to give right permissions if you don't have to because otherwise while that runner, while that VM is valid, if someone compromises that token then they can compromise your repo this is something as well that used to happen in the beginning especially because people were able to fork the original repo and then send a pull request back to the original one and that would trigger the action so people were forking GitHub repos back and forth and that would trigger the action that would basically spin up the runner and mine-crypt the currency but not on the malicious username on the legitimate one that also happened so GitHub added this feature or this protection there which is enabled by default to avoid when someone sends a pull request from a forked repo, it doesn't trigger any actions unless you allow, unless you recognize that person, that user as a contributor to your project and of course, not just the GitHub token but any token that you can leverage, first thing basic stuff is you shouldn't hard code your tokens inside the YAML file, this is basic security approach, you shouldn't do that, there is something called secret inside GitHub where you can add all the tokens and then you just call them by the username I'm not sure if I have an example here but basically that way the token is protected even from your own developers, they can't see it anymore after you add them there so protect those secrets as well because they can give you information access to even other tools so just some examples here if you're not using actions just disable, I think that's the basic approach as well, if you're not using a service or a tool just remove it so you can disable all the actions there and this one is the one about the forked repos, if you're not using or if you need approval for someone forking your repo, then okay, require approval for first time contributors to avoid triggering your action and you know, compromise your environment as well. Okay, I'll try to be really fast here. The next slides are more about code spaces and related to the research as I said that my friend did but I'll just present here a few things. The same way that actions, GitHub actions is based on Azure pipelines as far as I know even the same people worked on both projects, code spaces or GitHub code spaces is based on VS code online which basically an idea of having an idea from your browser that you can quickly spin up your projects, you can start coding directly from the browser, you don't need to set up dependencies and libraries sometimes when a developer joins a company takes them at least a few days to get that environment set up so code spaces tries to avoid that issue with creating the virtual environment for you. When you create a code space environment basically you get this long URL which specifies your username, code space and random ID and the port so you can forward that code space to expose a port as well and we described I think a few months ago I think in January where we published an article where okay, if I can leverage that and I think the total amount of space that each code space gives you is 512 gigabytes so I can use code space as my C2 server to deliver malicious files to other people and if I provide that URL oh it's coming from GitHub so it must be legitimate right so just like it's nothing new here but just like what attackers do with Google Drive and things like that it can be a way of exploiting and tricking even developers that are not aware of that so we did that we showed the directory listing we provide that from our code space and we can provide malicious files there so there is open directories and all that stuff and we we published an article I think was in January talking about this basically we saw that in February where we only found out a few weeks ago that attackers are already leveraging that they are already abusing code spaces to deliver malware to deliver malicious files there as well so we saw this tweet two weeks ago I guess and yeah so this probably going to increase this source of attack this leveraging code spaces to deliver malicious information as well so just be aware of that from your environment especially if you are using for developers leveraging code spaces you should be very careful okay that's all I had for today so if I still have time I'm open for questions if not I'll be here for the next talk and that's all thank you any questions do we have time for questions okay no questions okay go ahead it's not a question specifically but it's kind of a feedback on something you mentioned sure so there is a thing I don't know if you're familiar step security harden runner so it is a get up action you can put at the top you put it the very first one in your job and it will basically interstep it will modify the kernel and the VM and basically you can set firewall rules and it will snoop things and it will basically block execution of untrusted so basically it's kind of a way to harden the rest of your execution okay so it's like is it like a container inside the action inside the VM it's effectively a daemon little daemon that runs at the very top like of your job and then everything that runs after is subject to like it can have firewall rules that can basically prevent those things you were mentioning sounds good so yeah I'm working with OPPA Open Policy Agent to basically develop some rules based on rego to analyze let's say I want to analyze this YAML file focused on get up action and let's say is this YAML file running a malicious like linux command or is it running a crypto miner that's what I'm working on and I should have that available very soon so yeah thanks again for sticking around until the end and please stay around for the next talk from Logan and yeah thanks everyone so we're gonna take about 10 minutes of break to the next talk and don't forget there's a raffle after the the end of the day so we have books we have rubber duckies, flippers a bunch of stuff to give away so stay here alright so welcome to the last talk of Nordsec 2023 still have a little bit of music so you just heard about how to pound get up and now we're gonna talk about how to make money out of doing that so we have with us here Logan McLaren he's been a security enthusiast since getting online in the 90s and finally focuses on helping grow get up bug bounty program during his free time Davils in powerlifting, CTFs and retro gaming so please give it up for Logan well good afternoon everyone I'm glad I have a captive audience here with a raffle coming after this as well so thanks for hanging out goal here today is just chat a little bit about github's bounty program being one of the bigger ones out there but more so focusing on lessons for so years of running the program ways we've learned not to do things ways we have learned to do things and really the key stuff we'll come at the end is the picture slides as it were for takeaways for folks who are either looking to submit stuff to bounty programs ours or otherwise or anyone who's looking to set up a bounty program or work on one as an engineer so hopefully my slides cooperate we had some technical difficulties here we are so I'm a senior product security engineer at github I've been there since about 2019 long time ago I used to run a whole bunch of like hacker zines and stuff that nobody's ever heard of but that was always good fun I am a kilt enthusiast as you can probably guess from this I am actually Scottish I haven't just appropriated kilt but professionally worn many hats everything from support to professional services engineering so never stay in one place for too too long but github's kept me hooked for a little bit so before we dive into things just to get a feel for the audience here who here has submitted bugs to a bounty program before is at least familiar with it raise your hand Magna perfect and perhaps a more niche audience here who here works on a bounty program okay more than I was expecting which is pretty cool so good it's going to be well well rounded so talking about the github program just to set the stage for all of this we started back in 2014 we've been working with hacker one since 2016 so a lot of these numbers are looking at 2016 onwards because that's when we have metrics for but during that time we paid out a little over 4 million US for bounties across about 1350 reports as of this morning so reasonably large payouts compared to a lot of other ones and the overall range for that is bottom end $617 up to 30,000 plus plus plus depending on severity so if you can find something that's pretty narrowly you can walk away with a pretty good payday there but obviously a lot of that's changed over time I like to say it's aged like a fine wine hasn't gotten corked yet so things are pretty good we started out originally being sort of a side gig for our appsec team and it's changed pretty significantly since then so we're now a team of four full-time engineers that are just doing bug bounty stuff to deal with various projects we have on it but also looking at our overall life cycle for vulnerability work as our scope has changed a lot our payouts have changed a lot we originally started out doing 1,000 to 5,000 as I just mentioned it's about six times that much right now and the big part of that as I said is the change in scope so thinking back a couple of years GitHub was primarily source code management and not a lot else now we have actions and code spaces and everything else that we just heard about and many other bits and pieces so a lot more surface area to look at we've also been looking at other ways to expand bug bounty out and this is sort of going into the takeaways a little early but looking at ways to bring this into our release cycles and look at other opportunities to collaborate both internally and externally for this kind of stuff so the process we have is about what you would expect from a bounty process or really a lot of bug triage work first off we'll review any reports that come in just to make sure they pass a sanity check that's relevant sort of what you'd expect go through reproduce those make sure they're actually reproducible so that we can continue an investigation of them validate that there's something we care about that we want to pursue further sometimes if there's any ambiguity in that we'll pull in the engineering teams or product teams just to make sure that everyone's got a good picture of it from there we'll fix it simple point and then pay things out so we'll talk a little bit about the payouts in different ways the programs do it our current setup is we'll pay out whenever things get fixed which could be a couple days could be a couple weeks could be a couple months but that way we're ensuring that our customers are actually protected by the time any information gets out there in the world so when we get reports the key thing we want to do is figure out what's actually going on so we want to understand what the actual vulnerability for these things are so not just whether or not it is something we care about from a security we actually understand the overall scope for it quite often when I've looked at stuff in bounty programs we'll see reports come in it's a little bit unqueer and you may have wildly varying severity wildly varying severities that's a tongue twister as they evolve over time so we want to try to get that in advance so that when we push this off to our engineering teams to actually formally fix it and continue our investigations with our our cert teams and whatnot that we can prioritize that properly next thing is can we take this and actually increase the impact for it does this advance other attacks are there other things we need to focus on for this rather than just whatever has been reported to us I think the key takeaway for this with our program and I think many others is it's not necessarily the job of us on the bounty side to increase that impact we just want to understand it but if you submit reports and it looks like it's reasonably minimal that's sort of on you as the reporter to demonstrate what that impact is to make sure the severity is clearly represented in terms of a payout that said we do argue diligence on that nonetheless next thing is understanding the trends we're seeing overall and this is both for our program other programs security world in general we want to understand both what we're seeing across overall ecosystem so if there's new vulnerabilities or popping up with rails or git we want to understand that pretty well to begin with so we can be prepared for it and sort of get out ahead of that and the other part of that is to retrospectively look at reports we're getting so take that data feed it back into our overall SDLC and make sure that we can say hey we've got a lot of problems in this particular product area or we're seeing this type of problem persist across many different product areas so let's actually focus on that moving forward as we go through our overall life cycle for it and the last part of this I mentioned earlier we collaborate with our CERT teams a lot we want to understand what the blast radius for these things are you know is there a user or customer impact to it or is it just you know sort of a security software bug that hasn't been exploited so as part of understanding that overall impact we will go through work with our CERT teams both internal and customer facing for that to either send out notifications if we need to or at least make sure we understand the depth of what's happened there I've been talking about affecting users and customers and a big part of that is that we have two different product streams for this we run a SaaS offering as well as a non-prem product so with GitHub Enterprise Server we are doing releases every couple of weeks for it major release every quarter but there are different concepts that come with this so we're effectively shipping the same code for both if you ever download GitHub Enterprise Server you can if you're crafty enough basically get a lot of the source code out of that but the fun part of that is that we can ship fixes really quickly on github.com it could be hours, it could be a couple of days but for shipping something on-prem we have to go through a full release cycle for that it could be a few weeks if we miss back port deadlines that can get extended out a little bit further but the key takeaway here is if something affects one it probably affects both so when we go through and look at fixes and look at payouts and disclosures we want to make sure we've got full coverage with that one too many things here so again all this needs to get done to all the investigations we've been talking about if we need to cut CBEs