Ladies and gentlemen, welcome to Bly Street. I'm Michael Fully Love, the director here, and it's my pleasure to welcome you to this evening's event. This is the first speech, first public speech by our 2016 Telstra Distinguished International fellow, David Ignatius. Ladies and gentlemen, this fellowship is one of my babies. We introduced it in 2013, and the idea of the fellowship was that it would not be for just another FIFO speech, another fly-in, fly-out speech where somebody comes, gives the same speech that they gave in Singapore the week beforehand, and then gives the same speech in Melbourne the following week. Rather, we wanted to bring somebody, a global superstar, and bring them to Australia for a couple of weeks to expose them to the work and staff of the Institute and also importantly to expose them to the Australian debate and to allow them to contribute to the debate through media appearances and meetings with our stakeholders and public speeches just like this one. And we hope that our fellows leave not just as ambassadors of the Institute but ambassadors of Australia. We are proud and grateful that for the last three years this program, which is unique in Australia, has been supported by one of the great Australian companies, Telstra. We have had three previous Distinguished International Fellows, prominent American diplomat Kurt Campbell, who was the principal author of the Obama administration's Pivot to Asia. Steve Hadley, who was National Security Advisor to President George W. Bush, and Ambassador Shamsurran, who was the head of the Indian Foreign Ministry. This is the first time we have appointed a journalist, not a policymaker. But I'm pleased to say that the 2016 Fellow is an unusual journalist in that he thinks like a policymaker and he is widely read by policymakers. Ladies and gentlemen, we're honoured to have David Ignatius as our Telstra Distinguished International Fellow for this year. David is among the world's most respected foreign policy commentators. There are only a couple of foreign affairs columnists in the world that I take care to read each week for professional reasons. I can't name the entire list, but I can tell you that David is one of them. And the reason that his columns are essential reading is that not only are they always thoughtful and insightful, but more often than not, they also contain a news scoop. David remains a news hound at heart and he still has a nose for a great story. He is one of America's most distinguished journalists having worked at the Washington Monthly, the Wall Street Journal, and now the Washington Post for, I think, three decades. He spent three years as the editor of the International Herald Tribune in Paris, which, and one of my great regrets to do with the demise of the independent IHT, is that that always seemed to me like the perfect job. To edit the IHT in Paris seemed perfect, and David did that. On top of his journalism, he is a fellow at the Kennedy School at Harvard. He's also published nine spy thrillers, ladies and gentlemen. And for many years, the CIA's website listed his book Agents of Innocence as recommended reading for its agents with a note that said, though a novel senior officers say this book is not fiction. On top of that, if that is not intimidating enough, one of an international man of mystery, a spy thriller novelist, he has also written the libretto for an opera titled The New Prince based on the teachings, of course, of Machiavelli, which will debut in Amsterdam next March. So I feel thoroughly intimidated having read that CV, and it's gonna cause me to rethink my own life and career goals. Ladies and gentlemen, every day the liberal international order that has existed for 70 years seems less liberal, less international, and less orderly. The United States has inched back from the world and challenges have stepped into it. The West is drooping in confidence. The historic project to unite the European continent seems shaky. The Middle East is a bloody mess. There are more refugees, asylum seekers, and displaced people than at any time since the end of the Second World War. At the same time, we are watching the weirdest election in American history. It seems unlikely that Donald Trump will be elected president, but of course either horse can win a two horse race. And as many of the people of the guests here this evening know, our polling indicates that nearly half of Australians would want Canberra to distance itself from Washington if Mr. Trump were elected president. This is a striking result given that Australia is the most reliable US ally bar none and that support for the US Alliance is the most consistent result in the history of our polling. Ladies and gentlemen, if it could be said that we are at a point in world history where the events we are witnessing are stranger than fiction. And if that is the case, who better to explain them to us than a distinguished foreign policy journalist and commentator who is also a novelist? Ladies and gentlemen, please welcome David Ignatius. Thank you, Michael. They may be stranger than fiction whether they're stranger than opera. You'll just have to come to Amsterdam and find out. It's a pleasure for me to be here for my first trip to Australia. I'm sorry that you didn't have better weather for me. It's been spectacular. I am struggling to learn the native ways. I've been trying very hard to say good day mate, but I haven't quite got it yet. But it's been marvelous. This is a wonderful opportunity. I thank the Lowy Institute, thank Michael in particular. I am going to offer some thoughts that I've written and tried to think through carefully, but then I'd love to take questions from the audience about whatever interests you the most, including politics, which I'm really not going to speak much about in my remarks. I want to begin these comments. The title is Global Order in the Age of Isis and a Rising Asia. It was something that my father told me in the months after September 11, 2001. You'll hear more about my 95 year old father later, but let me start with his 9-11 advice. Think of the way a top spins upon a table, my father began. You can give that top a pretty good whack, but if it's spinning fast enough, if it has the energy and internal force of a good spin, it will bounce right back to the center point. But if the spin is low, if the energy of the top has diminished, then a good hard knock will make the top wobble more and more until it finally falls over. America and its global leadership have been that spinning top for the last 15 years. We got a sharp knock on 9-11 and it seemed at first that the country had come spinning back to its center point, but the wobbles have been noticeable. In Iraq and Afghanistan, in the financial disaster that followed the collapse of Lehman Brothers in 2008, and now, surely, as Michael suggested in our presidential election, the rest of the world is wobbling too in Brexit, in the South China Sea, in the continuing seemingly insoluble nightmare of Syria, as the energy of the American spin, the American system, has diminished. So I would begin these remarks by saying that the American top needs a new pull of the cord, a new spin. It has lost energy. It's not simply a question of diminished American dominance, but of this lost energy and confidence in the system that America created and led after 1945. I want to share with you some thoughts tonight about what might come next in the global order, but let's start with the ASEAN regime. We all grew up in the shadow of American power during and after World War II. 100 years before the organizing myth would have been the story of the British Empire, of which Australia, like America, is both an example and an exception. By the end of the century, the defining global story may well be China's rise to a super state, but for now, the American story remains the foundation stone. I'm biased, but I think this is generally an admirable story. The epic of America's rise was also the time of decolonization in Asia and Africa, which Franklin Roosevelt insisted on as the price of America's aid to Britain in 1941. It was a time of European integration after two catastrophic wars and a subsequent prosperity and union in Europe. It was the time of resurgence in post-war Japan under benign American tutelage, and it was, of course, the era of a rising China, the event in my lifetime that probably dwarfs all others. This was a period when the extension of U.S. power was irresistible and mostly benign. We sometimes forget that it was accomplished through the intermediation of the institutions that Franklin Roosevelt created in 1944 and 1945, the IMF and World Bank, the United Nations and the Atlantic Charter. American power and self-confidence got a pretty good knock in Vietnam, but after some wobbles, that top came back to its center point and seemed, in fact, to spin faster than ever. Australia, I sense, has a similar founding myth. It's a nation of immigrants. It grew by adapting, by living by its wits, though it had colonial roots like America. It became a force for decolonization. Your top is still spinning fast, but you haven't really gotten knocked yet. When I think of this American story in personal terms, I think inevitably of my own family's experience. And I'll return here to my father, Paul Ignatius, who was born in 1920 and is now nearing his 96th birthday. I was pleased that ambassador, Rodin Dalrymple, who I met as I was arriving, remembered my father and wished him well. What do I see in this American story as seen in the life of my own family? First, I see our national genius, our American genius of assimilation and adaptation. My father was the son of two Armenian immigrants who were born in the Ottoman Empire. It came to America and excelled. He went to college on the scholarship at USC, went to Harvard Business School, founded a great company, went to work for presidents Kennedy and Johnson in Washington, became Secretary of the Navy, and later president of the Washington Post. Perhaps the most important fact about my dad is that as a young man, he went to war in the Pacific. He joined the Navy in 1942 and fought in the Battle of Lady Gulf and many of the other great naval engagements of the second half of the war. He still eats salad every night out of a teak bowl that he won in a tennis tournament when he was on leave in Oahu. He took with him to war the collected works of William Shakespeare and other great books, Arnold Toynbee, the whole library. And I can still read the notations he made in pencil in the margins as he read in his Bunkett See. My father and his generation of government officials, men who had never really failed at anything in their lives, ran headlong into the insoluble problem of Vietnam. But America and the world survived that mistake. There's even a contrarian theory that the spectacular rise of Asia that started in the late 1970s is actually a consequence of the American War in Vietnam. But I'll leave that puzzle to historians. I hope you'll indulge one last mention of my father. Sometime in the next several months, the Navy will launch a guided missile destroyer named after him, the USS Paul R. Ignatius. In our house, we ask Paul Ignatius, the man or the ship. Having offered this portrait of how we began the American-centric world of my father's generation, I'd now like to discuss where we're going. I'd like to make five basic points about the foundations of wise policy and a stable order in a future that will not be post-American exactly, but will look very different from the world in which I was born. First, a stable new order will be one of multilateralism. We Americans like to think of American exceptionalism, but as Iranian Foreign Minister Javad Zarif told me in a conversation in Tehran a few years ago, Iranians think their country is exceptional too. So do Chinese and Indians and perhaps even Australians. The habit of playing well with others is difficult for a country like mine that spent 60 years as the world's only real superpower. We are still culturally the frontier nation with a belief in what we called manifest destiny. Americans know that this is a new century, but it's a tricky transition. Herman Kahn, one of the great nuclear strategists who were collectively known as the Wizards of Armageddon, once observed that a unipolar system or a bipolar system could be stable and a multipolar system could also be stable, but that the transition from one to the other was unstable. And that's part of what we're living through, that unstable transition. President Obama's goal as he sought to restabilize the world after the catastrophic mistake and wobble of the Iraq War was to operate in a consensual multipolar way. Obama, as he often said, wanted to turn a page, to end the chapter where an overextended America was fighting other countries' wars and started chapter where America would work with its allies in collective security. Obama just expressed disdain for free riders, as he put it to Jeffrey Goldberg in the well-known Atlantic article, for countries that in his words wanted to hold America's coat while we fought their wars. He was widely derided, at least in Washington, for the idea of leading from behind in Libya. But I think that phrase actually did summarize Obama's view of multilateralism. Has it worked? Not entirely. In fact, probably not well at all. The rise of ISIS and the disintegration of Syria led me and many others to start arguing back in 2012 that the United States needed to show more muscular leadership. Obama's reticence had moved multilateralism to something closer to dysfunction. His policies were seen abroad as a sign not of American vision, but of weakness. In October 2012, I was smuggled across the Turkish border and traveled with the Free Syrian Army rebels into Aleppo, Syria, which even then was being destroyed by shelling. Of all my travels over nearly 40 years, I think this is my wife's least favorite. But it was valuable. When I left Syria, smuggled back across the Turkish border, thank goodness, I made three observations. First, that President Assad of Syria would never again control all of his country. Second, that the moderate rebels, so-called, of the Free Syrian Army were a mess, even by local standards. And without significant American covert or overt support would fail. And third, that given the weakness of these moderates, the extremists who were even then visible and aggressive would become stronger and stronger. Note that at that time, ISIS did not exist by that name. I'm sorry to say that I wouldn't change a word of what I wrote four years ago. My point is that the catastrophe of ISIS was not inevitable. It was not the result of specific bad decisions. There's nothing in the structure of a multipolar world or the ideas that Obama had about reducing unilateral American action that requires acceptance of a disastrous civil war in Syria. I made this case in a lengthy article in the Atlantic Monthly in October, and I would urge people who want more detail to consult that. To sum up, in my view, Obama over-learned the lesson of Iraq and over-compensated for the wobble of the American top that was that war. If Iraq taught the dangers of US military intervention, Syria has taught the dangers of inaction. What Obama didn't seem to appreciate is that power in the world does not tolerate a vacuum. As we stepped back in the Middle East, others stepped forward. As we stepped back, ISIS stepped forward. As we stepped back, Iran stepped forward. As we stepped back, Russia stepped forward. Perhaps this is finally in the fall of 2016 Obama's season. The polls in the US show his favorability rating well above 50%. In a recent survey by the Pew Research Center of four Asian countries, 10 European countries, Canada and the US, more than half of those polled in 15 of the countries, expressed confidence in Obama as an American leader. When George Bush ended his presidency in 2008, his popularity was below 20%. Below 20% in Germany, France, the UK, and Spain. Immediately on Obama's election, the popularity of the US president shot up 60 points. But what's interesting is that it has remained high and roughly steady over nearly eight years and now stands at 86% in Germany, 84% in France, 79% in the UK, and 75% in Spain. The Pew poll also says interestingly that perceptions of US economic power have been steadily rising for the last four years and that perceptions of China have been steadily falling. So rumors of America's death as a great power are premature, but its failure as a unilateral go-it-alone superpower, vintage 2003, are indeed finished. America's power survives to the extent that we are leaders of a multipolar system. We have more staying power in this role than our enemies or even our friends around the world sometimes think. The second attribute of a stable future order is balance and acceptance of a rules-based system by all players. That's especially true here in your part of the world. In Asia today, it's not the United States that risks being seen as an arrogant power that acts unilaterally, but China. And Beijing is paying the price, as in your government's recent decision to block the sale of your utility, Oscar to China or to a Hong Kong company. Containing China, and I put that in quotation marks, is a recipe for US-Chinese confrontation, as many Australians have told me they fear. But it's really not the US goal, at least under this president. Rather, the US seeks this idea of a rules-based order for the region in which China, in its own interest, will grow to accept limits on its unilateral actions, thus the significance of the stunningly blunt ruling by the international court in the Hague supporting the Philippine claims in the South China Sea, and rejecting China as assertion of a nine-dash line that supposedly marks its sovereignty. The arbitrator's resounding no could surely be heard even in Beijing. Now China is trying to decide whether and how to live in this multilateral rules-based order as enunciated by the arbitrators, but really as enunciated by its neighbors. It's encouraging that so far, rather than doubling down and announcing an air defense identification zone, as had been feared in Washington, the Chinese are pondering their next move.  But in my view, the likelihood is that the Philippine arbitration will temper Chinese unilateralism. The guiding principle of President Obama's pivot or rebalance to Asia wasn't the idea that American military power would suddenly migrate to this theater and away from Europe and the Middle East. Instead it was the idea that American power will be best deployed in cooperation with regional allies. And here I credit Obama. The US has improved relations with both Japan and South Korea, a neat trick. It has opened new chapters with Vietnam and Myanmar. It has revived its once poisonous relationship with the Philippines, all while retaining constructive dialogue with China. So the secret of a successful rebalance is balance. America shouldn't wanna be China, much less confronted using mercantilist policies of its own in an attempt to enforce consensus. Rather we should help our friends resist China together. A third attribute of global order is a system that can reconcile the interests of rising powers with those of status quo powers that can bridge old and new. And my mentor here is the young Henry Kissinger who wrote in his Harvard doctoral dissertation which was published in 1954 as a world restored about how the disorder of Europe after the Napoleonic Wars was transformed into a rules-based concert of nations as it was called at the Congress of Vienna in 1815, beginning nearly a century of peace in Europe. The heroes of Kissinger's tale not surprisingly were diplomats, Britain's Lord Castle Ray and Austro-Hungary's Count Metternich. Kissinger's great insight was that the task for these diplomats in 1815 was to reconcile the interests of the rising and in some cases revolutionary powers, post-revolutionary France, Prussia to some extent, Russia with those of the status quo powers, Britain and Austro-Hungary. He was only such an accommodation that would bring stability. This is precisely the diplomatic challenge of the next decades. Let's start with the revolutionary regime in Iran which has been sending shock waves of instability across the Middle East since its revolution in 1979. Part of what President Obama accomplished in the nuclear deal with Iran was to force the Islamic Republic and its revolutionary ideology to make an accommodation with the status quo powers, namely the permanent five members of the UN Security Council and Germany and forgo building nuclear weapons for at least 15 years. Longer term stability in the Middle East, this story of tragedy that I've been writing about since 1980 when I first went to Iraq. Stability in this region will be impossible without a broader accommodation. I wanna say a Congress of Riyadh and Tehran between Saudi Arabia and Iran whose proxy war, whose Sunni Shia proxy war has been ripping the fabric of the Middle East apart. The cause of this ruinous process in my view is imbalance. An aggressive Iran has been too strong for a feeble Saudi Arabia and other Sunni states that grew up as clients of an America that no longer wants to fight their wars. It's in this context of a future Saudi Iranian balance that I note the importance of the headstrong, new deputy crown prince in Saudi Arabia, Mohamed bin Salman who I was lucky to spend 90 minutes with recently. He has a vision of transforming Saudi Arabia, believe it or not, into a version of the United Arab Emirates, a more modern, more tolerant, more self-confident country and in all these ways, a country better able to resist Iranian hegemony. MBS, as this Saudi leader is called, may run his country off a cliff. He is a genuinely impulsive young man but if he succeeds, he may be able to move toward the kind of regional accommodation balance that I described, a bargain between status quo and revolution. Fourth attribute of my stable world order is U.S. military force. That can deter great power conflict and suppress terrorism. U.S. military power is obviously a conundrum. The world complains about America being too militaristic but it quakes when America can't deter other nations' unilateral actions such as those of Russia and Ukraine and China in the East and South China Seas. I travel often in my job with military leaders and I'll give you a capsule summary of what I hear from them. The U.S. military never wants to fight another Iraq-style war of occupation or for that matter, another war of regime change. The rise of ISIS has certainly concerned the military but some of the strongest arguments that Obama has received against any large-scale American intervention in Syria and Iraq have come from the generals who don't want to do it again. What the four stars worry about most these days is the return of great power rivalry and the resurgent militaries of China and Russia which have demonstrated the ability to operate complex battle management systems that were until recently the unique province of the United States. Pentagon planners fear a decline of what they call overmatch meaning that the chairman of the Joint Chiefs of Staff is now unable to guarantee the president success and escalation dominance in the early days of a war with a major power, in the early days of conventional force in a future war. The Pentagon has begun to respond in ways that are not widely understood. Our current Defense Secretary Ash Carter and Deputy Secretary Bob Work have taken the unusual step over the last year of announcing publicly some of the most secret high-tech programs that the US is working on for the deterrent effect. Collectively, these programs have the unfortunate and very forgettable name, the third offset strategy but it's worth mentioning to this audience because it's important. In practice, this strategy involves the use of new systems, new super high-tech systems, autonomous vehicles, robotic vehicles in the air on land and undersea, swarming drones that would fight a networked war that would overwhelm Russia and China in battle, space systems that would fight the opening, perhaps decisive hours of war in space, lasers and other directed energy weapons, all of which will enable a new kind of warfare. The aim of all this planning is to complicate the war-planning of Russian or Chinese adversary and thereby to re-establish deterrence. I'm certainly not arguing for a new conventional weapons arms race. I'm just noting the, as I say, not widely understood fact that anyone who assumes that the US military is standing still while Russia and China modernize their militaries is mistaken. Technology will add new weapons to the counter-terrorism arsenal as well. I suspect that one thing that's ahead is a combination of drone technology and pattern recognition machine learning fused into a deadly package. It will soon be possible, in theory, to give armed drones and robots a picture, a photographic image of David Ignatius and the instruction, kill David Ignatius with near certainty that the mission will eventually succeed. The battle against radical extremists is a generational challenge, but in my reporting observation, the initial phase of defeating the caliphate, the Islamic State, increasingly appears to be a soluble military problem. In Iraq, the US and its allies have taken Ramadi, Fallujah, Tikrit, Sinjar, and Qaira on their way to Mosul. In Syria, they have taken Shaddadi, Minbij, nearly, and the Tishreen Dam on their way to Raqqa. President Obama said in September, 2014, that he would seek to degrade and destroy this adversary slowly but inexorably, this is happening. Inevitably, as ISIS has squeezed out of its caliphate, it will inspire or seek to inspire attacks elsewhere in Europe, Asia, and the US. This will be a continuing problem for the US, but I think President Obama is right to say it is not an existential one. A final word about military technology is that it's useless unless you have allies who want to fight. Traveling to Syria in May with General Joseph Hotel, the new SENTCOM commander, I met some of the Syrian Kurdish fighters who have seized most of northeast Syria from ISIS. These are fierce fighters, men and women both. Women from the Syrian Kurdish militia known as the YPJ, who fought in Kobani, wore suicide belts into battle because they knew that if they were captured by ISIS, they would be turned into sex slaves. Suffice it to say that these are motivated fighters. In some, the military loves technology, but it has learned through bitter experience over 15 years that technology cannot make up for weak, unmotivated, or intimidated allies. A fifth and final aspect of a stable world order is government systems that fit a world where individuals are empowered as never before for good and sometimes for bad by technology. At the dawn of the digital revolution, I assumed that the internet would be stabilizing. It shares information, it shares prosperity, it produces a connected world wherein theory, it should be easier to identify and solve problems, but I see increasing evidence that technology has had the opposite effect. The digital revolution empowers the individual and motivated groups, but it does not pull them together. Quite the opposite. As we have seen in the U.S., it offers new platforms for polarization. Rather than creating a common grid, it provides new opportunities for conspiracy theorists. Rather than encouraging consensus, it sharpens divisions, as with competing Fox News and in America, MSNBC, views of the world. Rather than challenging people's prejudices and preconceptions, this specialized, disaggregated media confirms them. It tells you that you're right. The people you like are indeed the good guys and that your enemies are sinister and pervasive. It's telling that Donald Trump is the first Twitter candidate, the medium suits him. This world of empowered citizens should resist demagogues, but the opposite seems to be happening. We are seeing the return of big men, leaders such as Erdogan and Turkey, Putin and Russia, Xi in China, who learn to ride the tiger of the empowered citizens of this digital age. This is a world on steroids. Why does it feel so disordered? I would cite two factors that are inherent in the technology itself. The connected world does not have an ordering mechanism. It's fragmented, disaggregated, blown to bits in the phrase used by the Boston Consulting Group. And the internet itself has been an opinion accelerator. It spins fact, rumor and opinion faster than governments can respond to them. Let me conclude with the same image that I used at the beginning. How can we rewind the string and get more spin for our global top? The US presidential election will be a crucial test. I'll offer detailed views in a speech next week in Melbourne, but suffice it to say that Hillary Clinton would be a good next point in the balancing, rebalancing process of our last two presidents, George W. Bush and Barack Obama. She has learned lessons from both. Hillary Clinton would not be a panacea. American leadership will suffer badly if she sticks to her announced view that she will oppose the Trans-Pacific Partnership. That will seed momentum in the Asia-Pacific region to China. I hope that President Obama carries through on his promise to Prime Minister Lee of Singapore to pass the TPP during the lame duck session of Congress after the election. We will all pay a price if he fails. American power under Hillary Clinton would seek the five basic attributes that I described to you tonight. It would strive to be multilateral and balanced. It would seek a security architecture that reconciles revolution and status quo. It would project military power using new technology and it would seek a fact-based world that can resist polarization, partisanship, and entropy. Will she succeed in these five tasks? Almost certainly not, but she will at least make a good start. And Donald Trump, Americans as a general rule, should not attack their own politicians when they travel overseas. But I owe this audience my opinion. On current evidence, Trump's election would be a demonstration that good countries can make very bad decisions. I fear that Trump wouldn't rewind my father's top. This emblem that I've tried to use tonight to describe the American-led global order. Instead, I fear he would take it off the table and bring it home. Thank you very much. Well, thank you. Thank you, David. Ladies and gentlemen, I think we've received a treat tonight. That is one of the most interesting, one of the broadest and most thought-provoking speeches to the Institute I can recall. And I was particularly struck by the story of your amazing father, because my father also served in the Second World War, landed on Sword Beach about 10 days after D-Day. And I know how precious the connection is to that generation, and I know how special the commissioning of USS Paul R. Ignatius will be. David has agreed to take questions. We have about 15 minutes. I'm gonna keep the questions going quite quickly so that people have an opportunity to ask something. I'm gonna ask one while people are getting their questions ready. There are so many entry points into your speech. It's hard to know. Such a rich presentation at the grandest global stage, the Middle East and the Pivot and ISIS and so on. But let me ask a very parochial question. Let me bring it down really to the Australian level and ask you about how Australia is perceived in Washington. And you mentioned the Goldberg article in The Atlantic. And there was a very intriguing reference in that article where Goldberg asked Obama and people around Obama about different world leaders and what he thought of them. And he asked him about Obama and this is what Goldberg wrote. He said, Obama has apparently formed a good impression of the new Australian Prime Minister. But Turnbull has a structural advantage. American presidents tend to like Australian Prime Ministers. One administration told Goldberg, our allies all give us headaches except for Australia. You can always count on Australia. Now my question to you is, from our point of view, is that a good thing or a bad thing? We pride ourselves on being perhaps the most reliable ally. The only ally to fight beside the United States in every major conflict of the 20th and 21st centuries and supporters of the Alliance like me say that this makes us a credible and reliable ally. But critics on the other side of the argument would say it makes you a slavish partner. Obviously we participate in these conflicts because we think it's in our interests. But we also want to be as influential on these debates in Washington as we can, especially as the locus of power moves towards our part of the world. So from your point of view, does our reliability as an ally add to or detract from our influence? Well, everybody loves a reliable friend. We love our friends, especially when they stick by us when we're down. And in this period of seeming difficulty for American power, the fact that Australia has generally been with us, I think reinforces the sense Americans have that this is a stable, dependable, in truth, a beloved friend. There is an affinity between Americans and Australians that I hope everyone in this audience feels. Whether it's good for Australia to have this affinity with the United States depends on whether the United States proves to be a strong and reliable partner in this region and a wise partner. If you make a bet on the United States, it's important that we deliver, that American outward-leaning, internationalist, engaged policies continue. I think there is a fear in the world, certainly I encounter it in Asia. I heard it from Prime Minister Lee of Singapore when he came to visit us at the Washington Post, a fear that America is in a period of retreat and retrenchment, that Donald Trump is popular with voters because they share his feeling that we have badly overstepped that our elites have led the country into wars that didn't succeed or immensely costly that brought the country nothing but difficulty, that our free trade policies have helped elites but not the ordinary worker. I mean, this is a broadly shared feeling. And I think it's crucial at the next present. I'm gonna assume that that's Hillary Clinton speak to that uneasiness and that anxiety in American, build a base for a different kind of internationalism. If that happens, Australia will be very glad indeed that it continued to be America's reliable partner. If our role in the world diminishes, you'll wish that you'd made a bet on Beijing or a stronger bet. And I think in life, we often tend to think it's wise to hedge our bets. Certainly in our investment lives, we wanna never sure of the precise outcome. Nations do that, but I think they do that only up to a point. One thing that I've learned watching the United States is that countries make a real mistake when they depart sharply from their values as the United States did in this wobbling reaction to 9-11. The United States did the things that we should be deeply ashamed of that betrayed what the world thinks we are and also what we think we are. And so I think Australia should be very careful not to do anything that for the sake of hedging bets, for the sake of short-term calculations takes Australia away, not from America per se, but from what makes this a country that endures. Okay, the first hand I saw was Rob Thomas over here and then the lady behind him. And if you could just wait for a microphone. Thank you. I'd be interested, you talked about multilashism, how America can really implement that successfully without actually being seen to be, for one of a better word, the big brother or the big stick and trying to impose its values in particular on the Middle East, where I think occasionally the Middle East looks at the America going, all you're trying to do is impose your values on our values there. And in particular, and I suppose I would also say the same perhaps with China as well, where it's seeing America acting like a big brother. Well, we are pushy, our soft power is overwhelming. Our culture, I'm always amazed when I travel around the world, every country in the world seems to have its own version of rap music, how unlikely, but you can hear Chinese rappers and Indian rappers and I'm sure Australian rappers. We do need to respect other cultures. It's something I think Americans are getting better at. I have an image of what American power at its best looks like, drawn from my years covering the Middle East. There's an institution some of you may know called the American University of Beirut that was founded by Protestant missionaries in the 1860s and has been an anchor for good, I wanna say American style education now for all these many, many decades. There's an arch on the rubeless that has carved in it, I think since the university was built, the missionary injunction that they may have life and have it more abundantly. And for so many generations that was the American ambition in the Middle East and in other parts of the world that distinguished us from the colonial powers, it's why America really was loved and welcomed in the Middle East in this period of decolonization. We said to the British and the French, that's it. You're not gonna continue the kind of, and it's a tragedy that we fell into a kind of neocolonial role, that neo-imperial role without really meaning to. But I do think one great benefit of this period after Iraq is that Americans in general have come to understand what I was trying to say in my remarks, that unilateral policies that attempt to impose American views and order has been unsuccessful has only brought us unhappiness. So I think any future president, at least for the next while, will refrain from that in its worst form. The lady just behind, Rob? Hello, my name is George Sianovich, member of the public. Thank you so much for a fascinating talk. David, I wonder if you could elaborate on the succession problems in Saudi Arabia given the age of the current brothers. It's a part of Keg and the relationship between Iran and Saudi Arabia is particularly important to stability. You mentioned a particularly interesting person who might be able to succeed, but what are the challenges there? And with respect to artificial intelligence, Toby Walsh, an artificial intelligence expert seconded by dozens of experts from around the world is working with the UN to limit development of artificial intelligence killer robots because currently drone strikes are very, the failure rate is very high. He actually quoted 90%, which could compound the issues that we are facing right now. And the cost of the technology is going to be accessible to everyone in no time. Thank you. Tough questions at the Lowy Institute from the Saudi succession to artificial intelligence. Well, so let's, I'll start with the Saudis and then turn to killer robots. There is unusual turmoil in the Saudi royal family. I wrote about that at length a couple of months ago and I'd be happy if people looked for that. But I've talked to many members of the royal family. We have a deputy crown prince who is 30 years old, who is ambitious, who has his big ideas, but who has sharp elbows. And other members of the family have been unhappy. The nominal superior, the crown prince, Mohammed bin Naif, has been especially put on his heels by the young man. When I met him in Washington two months ago, I didn't know what to expect. And I have to be honest, I was impressed by him. I was impressed by his raw political instinct. I don't know if anyone in this room remembers Rafiq Hariri, the Lebanese leader. He was a big, physically big, larger-than-life figure. Just sucked the air out of the room. Got to grab you by the shoulders and wanted to gossip. This young man is like that. He's physically big, he's self-confident, he's brash. And I think the Sunni world needs a person like this. I don't know if he's the person, but they need a person like this. The Sunni world is in a kind of freefall, lack of confidence, Egypt, Syria, Iraq. Just go across the map and you see this collapse of power and confidence in the Sunni countries. And they need a robust, vigorous Sunni champion. Maybe he'll be it, but that's what interests me about him. On this question of new weapons, we are kind of moving headlong into the future. I mentioned these Pentagon programs because I think it's important that people understand that this threat of a very aggressive modernization program by Russia and China is being met. The weapons that are on the horizon are genuinely scary. Machine learning allows a kind of automation, the ability to populate the undersea space. That's the part of it that really interests me the most with pervasive, stealthy unmanned submarines that just lie in wait for conflict that allow the projection of power in entirely different ways. Advances in drone technology, similarly. I mean, as you say, it's gonna become pervasive. The idea of the United States alone will, you know, the leading maker of drones in the world today, guess what country that is not the United States? I'm told it's China. So, you know, this technology is out of the box. And I think, yes, it's important to research the ways these technologies could be used in conflict, but it's probably even more important to think about ways in which the technologies could be controlled in arms control agreements in the same way that we learned to do during the nuclear, the age when the nuclear threat was overwhelming. I mean, that was a breakthrough. That's part of what made the world liveable. I think it's time to begin thinking about that in terms of these new technologies. Last question in this corner. If you could just wait for a microphone, Rod. Good evening. I was asking myself the question of whether Obama and Netanyahu have got on better of recent times because it didn't look as though there was a great relationship there. And now that the US is so energy-sufficient itself, might the only time that the US go back into the Middle East is if Israel itself was threatened. I assume that commitment is still high on the agenda of the US government? I think that commitment is never wavered. Netanyahu and Obama had a famously bad personal chemistry, but the relationships between the militaries and the intelligence services, it said, were stronger than ever in this period. The US and Israel are just completing a new memorandum of understanding about US military support to maintain Israel's so-called qualitative edge over any Arab adversary, which is a big accomplishment. In a sense, I think Obama and Netanyahu have survived each other and come to the end of the story, at least in terms of Obama intact. I think there's a growing appreciation in Israel, and this would be a final comment because I didn't say much about it, that the nuclear agreement with Iran is broadly speaking in the security interests of every nation in the region and internationally, including Israel. I think more and more Israeli analysts would say, taking this off the table in what appears to be an enforceable, verifiable agreement probably has more good in it than bad. Israel was really anxious about the agreement. I sense much less of that anxiety today. Well, ladies and gentlemen, as I said, I think we've heard a terrific speech today. David, you set out all these global challenges, and I kept getting drawn back to the central role of the United States in dealing with all of them. And when you were describing George W. Bush and then Obama, I couldn't help but think of the story of Goldilocks, who went to the house of the three bears in the woods, and you remember the first bowl of porridge was too hot, and the second bowl of porridge was too cold, and the third bowl was too right. It was just right, I should say. And there you go, I'm injecting a bit of Australianism into my story, but President Bush was too hot in the sense that he was perhaps too unilateral and too promiscuous in the use of force. Perhaps President Obama has been too cautious and too cool a cat. And I think all of us hope that there might be a female Goldilocks candidate who can come up with a US foreign policy that's just right. I think it might be slightly harder than the fairy tale says. We'll either get Goldilocks or we'll get the big bad wolf, I don't know. Ladies and gentlemen, thank you for joining us, and please thank David Ignatius.


Hi everybody, how's it going? I'm Joe and this is 2018 2019 Chronicles basketball fat pack rating number 46 with two of those national treasures basketball first off the line spots being given away We'll do at the end of the break Chance for a fraction of the price to win things was like $700 $800 spot pretty crazy big Thanks to this group for making it happen or in going big on it scared money don't make money. Thank you There are the teams right there Let's do the break first and then the second dice roll will be for the giveaway part But for the break we're going to go three and a four seven times for names and teams one two three and seven and then three and a four seven times for the teams one two three four five six seven final time Hornets down to the wizards I know trade windows in these filler packs as you know by now So big things the first half. There's the second half right there. Thanks everybody for taking the risk on this Be some surprises in this pack. This is the 1819. So Luca and Trey young rookie card opportunities Exclusive bronze parallels according to the pack camera here. There's the final printout Here Monday the 13th Day after the Super Bowl, I guess we're kind of shifting our focus to the hoops world now hoops world End of the hockey season and the basketball season beginning of the baseball season start of start of racing seasons end of European soccer seasons Mo Bamba new Laker even Chenzo Julius Randall bronze Marvin Bagley Shamit Simons Michael Bridges Some blast from the past here There's Troy Brown jr. And here's a here's a nice Robert Williams Turn out to be a pretty solid part of that Celtics team right now. It's gonna go to Oren Michael Bridges got traded, but Suns fans were very disappointed that goes to Oren as well and Mo Bamba. Let's see. What what can this guy's ceiling be? Definitely got the athleticism What's his ceiling Alan with the Orlando Magic? We'll get that one. All right Now, let's see who's gonna win at those tiered random team spots So as it stands now We've got two full spots left and one more of these fillers and then we're in Brakesville Or if those two spots don't sell in the other filler sells out first Then we can take those two full spots back out and create a final filler So we'll pivot to whatever helps the break move a little more quickly. Let's gather all the names new dice new list and Fingers crossed everybody. There's gonna be a lot of sad faces only the top two will be in the break top two after two snake eyes easy one and two All right, so there's gonna be a lot of sad faces here, but thanks everyone for giving this a shot Oren very close, but no cigar, but you do have a lot of spots. I hope you're up there Top two happy times for orange. There we go last spot mojo and Steven P sneaks in with a spot I think that's a one-spot snipe right there. Look at that After two so congrats to you. We'll see you in that break. Hopefully a little bit later tonight. Jasper's case breaks calm


And I have one last announcement before we begin this talk. This is a personal announcement to whoever slapped the sticker saying for recto use only onto my microphone. Microphones are not supposed to be used this way. Please trust me, I am very familiar with microphones. I know how they are supposed to be used. However, our next speaker is going to tell you about things that are supposed to be used this way, and about how to secure and protect those things. So please welcome Vianne and the talk you all came here to see, Internet of Donks. Around of applause. Okay, so hello everyone. My name is Vianne. I am working for a second consultant as an IT security consultant, and besides penetrating all the things at the Second Consult vulnerability lab, I have been studying information security for the last five years at the University of Applied Sciences, St. Pölten, back in Austria. And about a year ago, I was facing a massive challenge. Some people might know this challenge. This challenge was to select a proper topic for my master thesis. You might know there are always those predefined topics by the universities. Some of them are quite interesting. They are taken most of the time quite fast by all the other students, and you are left with the boring topics. And I thought to myself, yeah, I don't want to stress myself. I just want to define a topic by myself. And that was the challenge. So the first thing I did to get a better overview of the topics was to take a look at the topics my colleagues have chosen and created a word cloud out of that. So we have basically all the interesting topics there. We have Bitcoins. We have GDPR. We have cyber, cyber, cyber. We have DevOps, management, mailware. But some of you might have already noticed it. There is one topic missing at my colleague's thesis, which is very, very important in the year 2018, and that's the Internet of Things. So I guess I don't have to explain here at the Congress what the Internet of Things is. It's basically the interconnection of all the devices which were analog a few years ago with each other and even worse over the Internet. And I thought, yeah, maybe I can combine the knowledge together at SecondsOut and conduct the penetration test in this Internet of Things. The problem here is still there are like millions of products and I just have to write one thesis, so I had to select one subcategory in this Internet of Things to conduct the penetration test on. And of course the first thing which came to my mind were smart home devices. We already had a lot of interesting talks about smart home devices. There are like smart coffee machines, smart lawnmowers, light bulbs, thermometers and stuff like that. But this category has two problems. So first of all, there is already a lot of research done. And the other problem is the impact. So I don't want to downplay the vulnerabilities which were found there, but when there are vulnerabilities found, I mean, yeah, if there is a DDoS on your lawnmower, you can just go out to your garden and mow the lawn yourself. It's not that big of a deal. So I thought I have to select a subcategory where the impact is a little bit more critical. And I came up with the following devices. So for example, dolls, smart dolls, there was this doll kyla. Some of you might know it. Someone found out that it has a built-in microphone and the data was sent to some dubious service in some dubious countries and it was even declared as an illegal telecommunication device. It had to be destroyed. Or there is a lot of interesting research at baby monitors. A colleague of mine wrote a very interesting blog post. You should take a look at it. Or devices which affect our body. So for example, smart pacemakers. They were developed by Sanchu Medical. That's the biggest manufacturer of pacemakers in the world. And they built a pacemaker which is programmable via Bluetooth. But yeah, they forgot authentication, which is quite a big of a problem when everyone is able to reprogram your pacemaker. So as we can see, this category is the impact would be quite critical. But there is, again, a lot of research done. So the deadline was coming closer and closer. I had to hand in some kind of topic for my master thesis. I was doing a lot of brainstorming with myself. And then suddenly it came to my mind. There is one category out there where the impact would be very critical. And there is not a lot of research done. And that's the Internet of Deal Does. So that's basically the integration of sex toys into the Internet of Things, where we interconnect the Deal Does with each other and over the Internet. But before I'm going to show you what I found in this Internet of Deal Does, we have to talk about history. Because you might think now that's something new, but that's not true. Because the Internet of Deal Does, as we know it, is existing for about 50 to 60 years. And as always, when there are new inventions or interesting ideas, they first appear in movies. And that also applies to the Internet of Deal Does. So those are quite old movies. We have, for example, Baba Rella or Flash Gordon or August Mo. And in those movies, those are real movies. It's not a joke. The Internet of Deal Does appeared first in this movie. So, for example, at Baba Rella, the evil guy used a device called the August Motron to cause so high levels of arousal in humanity to kill people. So basically, the Internet of Deal Does was in the 60s and 70s a weapon of mass destruction and not a weapon of mass pleasure as it should be. So, a few years later, a whole research area was formed. This research area is called Teledildonics. And that's also not a joke, again. And it was first mentioned by Ted Nelson. He's a technical philosopher. And he coined quite well-known terms like transclusion, virtuality, and intervingularity, and Teledildonics. And he mentioned this term at first in a book called Computer Lib Dream Machines. Very interesting book, by the way. You should read it. And in this book, he did interviews with people who had, yeah, innovative and interesting ideas for the time, but the technology was not just ready yet. And he did an interview with a guy called Hauwaxpress. And Hauwaxpress developed a device or had the idea for a device called Audituck. When you Google for Audituck, you find quite an ancient website called Audituck.com. And when you dig a little bit deeper, you can find out that he's still looking to find a manufacturer to sell his sonic stimulator. Sounds already quite interesting. And he even has a patent and a small graphic for it. So it's basically a radio with one input and two outputs. One input, of course, the antenna. And the two outputs are one for the headphones. And the other output is for the sonic stimulator, which is inserted from below in the human life form. You even can find the patent and Google patents. And he writes there, in his abstract, random or controlled electronically synthesized signals are converted to sound waves that are directly coupled to the skin of a life form, such as a human body, for example, to stimulate the skin or internal portions of the life form. So as we can see, the IDs were there, but the technology was just not ready in the 1970s and 1980s. But now we are in the year 2018, and we are definitely ready for a penetration test in the internet of the others. And before I'm going to talk about the test devices and the vulnerabilities, I'm going to make a promise now. I will try to keep this as serious as possible. I will try to keep the, I will call it the IPMs, the innuendos per minute as low as possible. Yeah. And now I just want to talk about the test devices, because those are very important. So I selected three test devices for my math thesis. On the right side, we have the, that's not a joke again, VipratisimupentiBuster, that's the real name. In the middle, we have the magic motion Flamingo. And on the left side, we have the real love Lydia. So the devices on the left side in the middle have one thing in common. They are manufactured in China. And the device on the right side is manufactured in Germany. So I have to admit, I was a little bit biased, because I thought I'm going to take a look at the Chinese devices first, because there will be a lot of low hanging fruits. Question to the audience now, who believes that I found most of the vulnerabilities in the Chinese devices? Raise your hand. Who believes that I found most of the vulnerabilities in the German device? Who believes that I found vulnerabilities everywhere? Yeah, you're basically all right. But when I took a look at the German device, I found so many really, really critical vulnerabilities that they immediately stopped there and wrote my whole thesis about the Pantybuster. OK, so the Pantybuster itself, it's just one product out of a whole product line. I just bought the Pantybuster because it was the cheapest one. They are basically using all the same back ends, the same iOS and Android apps. And yeah, the Pantybuster is basically a device which is connected via Bluetooth to a smartphone. And it can be used, for example, for long distance relationships. But there is way more behind those apps, because there's like a whole social media network built in. You can make group chats. You can create image galleries. You can maintain friends lists. Yeah, that's real. That's real. It's not a joke. Yeah, and now we're going to analyze this Pantybuster and take it down to the last parts. Yeah, we're going to analyze the software. I'm going to tell you a little bit about the transport layer and the hardware, of course. So I'd like to start with the software. So the first vulnerability where we have to talk about is a so-called information disclosure. So you might think, no, boring. Just some random version numbers. Yeah, that's true. Most of the time, information disclosures are boring. But in this case, it's really critical. Because I found a so-called DSStore file in the web route. A DSStore file is basically a metadata file, which is created by the Mac OS Finder. And it contains a lot of metadata, like files and folder names. So when you find such a file in a web route, you have basically a side channel directory listing. This DSStore file has a proprietary format. But for all problems in life, there is a Python module to decode it. Yeah, and it decoded the DSStore file, and it was presented with the following contents. So that's basically a side channel directory listing of the web route. There are a lot of interesting files and folders. For example, old page example. I have no idea why it's there in the productive environment. There is a database folder. But the most interesting folder is the config folder. So when I navigate to the config folder, there was real directory listing enabled. And there was one file in there. And it was called config.php.inc with the following contents. So basically, I had no access to the database host name, database names, user names, and passwords. The problem now was that, as we can see, the database host is just local host. So there might be a chance that it's not directly reachable via the internet. And we have to find the so-called exposed administrative interface to connect to the database. Yeah, of course, the first thing I did was to do a port scan. A lot of interesting ports, sadly no SQL ports. But some of you might remember this, yeah, let's call it weird, brown, orange web application called PHP MyAdmin. And I found a subdomain which contained the PHP MyAdmin installation. And I was able to use those credentials to connect directly to the database and get access to all the data. So I basically had access now to the real-life addresses, to messages in clear text, which were exchanged, images, videos, and a lot of other stuff. So yeah, and what hurt me the most was the following slide, because the passwords were stored in clear text. And that's really not necessary in the 21st century. OK, so in real life, about 30 minutes have passed by, and I tried to do a write-up as fast as possible and submit it to the German Z-Bund. And a few minutes later, I got a really interesting call from the German Z-Bund. They told me that they already informed the manufacturer and they're already trying to fix those problems. So my problem was now that I still had to write my math thesis. And I just have content for about 30 pages now, and I need like 100 pages. So I did a little bit of more research and found way more vulnerabilities, of course. And the next vulnerability I'm going to talk about is a so-called insecure direct object reference. Sounds cryptic, but it isn't. It's basically always a vulnerability, which is consisting of two sub-problems. So the first problem is when someone uploads resources to a backend, those resources are most of the time renamed to a random string, which shouldn't be guessable. The first problem would be if it would be guessable. But the second thing is there should be authorization checks in place. So if someone is able to guess those unique identifiers, there should still be some process which should check if the user should even be able to download these resources. And in this case, yeah. It was just really easy to guess the identifiers, and there was no authorization whatsoever. And I had to learn this the hard way, literally. There is a feature in the smartphone apps called galleries. So you can create galleries. You can set the visibility to no one is able to see it. Just your friends are able to see it. Everyone is able to see it. You can even set the password on those galleries. And just for a test, I created a gallery with a few cats. And when you request this gallery, you see the following requests, user manager, PHP, blah, blah, username, password, and some ID. And I thought, yeah, maybe I should change this ID.  So yeah, the problem behind this is quite easy. Everything which is stored on the server is renamed to a global counter. The global counter is incremented by one after every upload. And there are no authorization checks whatsoever because the images are just stored on a server. So it doesn't matter if you set a password or set the visibility. That's just nonsense to do it. OK. So the next vulnerability, yeah, I called it improper authentication. To be honest, it was just a weird authentication. So at second salt, there's already a lot of different ways of implementing authentication. Some are good, some are bad, but it can be fixed. But in this case, it was just weird. I've never seen something like that. It's basically like HTTP basic authentication, but a little bit worse. So normally, authentication works as follows. You're sending a username and password to a server. And if this process is successful, you get some kind of authorization information like a cookie or an API token. You can use this cookie or API token to authorize all the other requests. In this case, every request contains just username and password in clear text to authenticate the request. That's just weird, to be honest. And also, if your password is compromised, it will also mean that you have to change your username because it's part of the authentication information. So weird, weird implementation. OK, the next vulnerability is called the Remote Pleasure Version 1.0. It's 1.0 because there is a 2.0. Yeah, there is a feature in those apps where you can create remote control links. They can be sent via SMS or email. And everyone who is in possession of those links can directly control the devices. There is no extra confirmation needed. We will take a look at the email now. There is a button in the email called Quick Control. And there is an ID again. Yeah, the thing is, yeah, it's just a global counter again. And what an attacker can do now is download the app, create his own quick control link, decrement the ID, and pleasure just random strangers on the internet. OK, I will show you guys a video now where I'm doing exactly that. So when the video is going to start, it's going to start perfect. On the right side, we're going to see an attacker device, which is just connected to the normal mobile network. And the attacker creates his own quick controlling and decrements the ID. And on the left side, we can see another smartphone, which is connected to Wi-Fi, to have internet access, and via Bluetooth, to the smart sex toy. And this attacker device should now be able to control. Yeah, we'll see that now in a few seconds. That's just what I explained. There is no confirmation whatsoever, so you can directly control all the devices. OK, I have to stop talking about software now. There is a lot more like cross-scriptings, HTTPS problems, outdated software. But there is not enough time left now, so we have to talk about the transport layer. Before I'm going to tell you something about the vulnerabilities I have identified, I will tell you something about Bluetooth low energy. In general, the security basics and how authentication and encryption works on a very high level. So you can imagine that Bluetooth low energy basically works like a web API. So that's a very high level explanation. You have API endpoints. Those are the service characteristics. And you have properties where you can read and write to. So for example, the device name can be read or written to change the device name. There are also a lot of other characteristics which will be very important when it comes to remote pleasure, version 2.0, a little bit later. So that's a very high level explanation I know, but we don't have enough time left. Talking about the security basics, Bluetooth low energy is using ASC-CM that's counter-CBC with Mac that's basically considered secure. But as we know, security also depends on the key material and the key exchange. And at Bluetooth low energy, the key exchange is defined as the pairing methods. For Bluetooth low energy, we have five pairing methods. We have just no pairing. So yeah, we basically throw packets into the air. And if a device is nearby, it tries to do something with those packets. We have just works. We have out-of-band pairing, pass-key, and numeric comparison. I don't have to tell you the details now. You all know those. It's numeric comparison, very compare numbers. To exchange the key material, you have the pass-key, which is always 0, 0, 0, 1, 3, 4. We have out-of-band pairing where the key material is exchanged via NFC, for example. And we have just works that's really secure, where the key is just set to 0. And it can be, of course, brute-forced with ease. But it just works, of course. So out of those five methods, what does the audience think that the sex toy is using? Is it using no pairing? Raise your hands. Is it using any of the other more or less secure methods? Yeah, it's using no pairing. Um, that means that the Android and iOS apps just throw the packets into the air. And if a device is nearby, it starts to vibrate. And that's, of course, easily exploitable. You can just sniff the real traffic and repeat it. I did exactly that using a so-called Bluetooth Lineage Sniffer. I used the Bluefruit device. It works very well. And I placed it between the sex toy and the smartphone app. And I sniffed the traffic using Wireshark. And I found some interesting endpoints or handles. There is the 1F handle, which is like an initialization handle. And there is the handle 25, where you can send values from 0 to ff to set the vibration intensity. Yeah, and now it's time for a little bit of war-dealing. I wrote a small Python proof of concept, which basically scans the air for Bluetooth Lineage devices. If it finds a device, it tries to find out if it is a sex toy. And if yes, it basically turns it on to 100% to ff. So the next thing I want to talk about is not that funny. So please don't laugh now, because when we released this, a lot of people on Twitter asked, is this rape? So serious topic. For example, the evil attacker is using my war-dealing script in the metro, in the U-Bahn, in Vienna. And he would pleasure just random strangers. Is this rape? In Austria, we have two different things.  And they have two preconditions. So that's three preconditions. We have violence, threats, or deprivation of liberty, which is just not the case in this scenario. But we have a special paragraph called, pooh, it's really hard to translate that. It's called the Pograbsparagraph. I know that it's a little bit different in Germany, and I'm not in law export. So it just kept the Austrian laws, which got verified by Tornis. And according to this paragraph, this would be an unwanted sexual act via third-party object. So it's not rape, but it's an unwanted sexual act. Okay, the hardware. Last but not least, the biggest problem is that firmware updates are not possible. That was confirmed by the manufacturer. The problem here is a lot of vulnerabilities can just be fixed by doing a firmware update. And the manufacturer came up with the idea that the end users can send in their smart sex toys to do a firmware update. And I'm quite sure that nobody's sending in their used devices to conduct a firmware update. And the other problems are debug interfaces. The other just forgot to remove it or deactivate. There are serial interfaces on the sex toys. It's just really easy to extract the firmware and do a little bit of more research on the firmware.  What can I do? Yeah, the tin foil is not working. But there are a lot of interesting open source projects out there. So first of all, the most famous project is the Internet of Tongues project. There is a really interesting person behind that. He's called Render Man. You can find him on Twitter. He invented this project to make this whole Internet of Tongues a little bit safer. And he's doing like penetration tests and stuff like that. He's even handing out DVEs. So that's the equivalent to CVEs. Then we have Pathplug.io and Metaphate-ish. They are developing open source firmwares for a lot of different sex toys and they are independent from all the manufacturers. And there is also something called Onion Dildonics. Which has the goal of rerouting all the smart sex and traffic over the tour network to make it a little bit more safer. Okay, there is one more thing. I had a lot of calls together with the manufacturer and the chairman, Tert Bund. And one call was outstanding because we were discussing the remote pleasure vulnerabilities and we tried to explain the manufacturer that it's not good that you can basically out of the box pleasure everyone on the Internet or if you're nearby, we told them that it should be at least like an opt-in feature where you can switch on this feature in the apps. But the manufacturer said no, that's not possible because at least they believed that. Most of our customers are in swingerclubs and you don't know beforehand who is in the swingerclub. So there is just no opt-in in a swingerclub because you're basically always in. Yeah. Thank you. Taking questions, we have five microphones, two in the front and three in the back. So please line up and ask whatever you want. So apparently people on Twitter engaged in a drinking game where they were drinking every time you said penetration testing. In the meantime, we have a question from microphone number two. Yeah, did you come across anything with the patent trolls and teledildonics? I came across what, sorry? Patent trolls. There is an issue with the teledildonics patent and some companies have been threatened to go out of business because of frivolous lawsuits. Yes, yes. There was the, I guess it was called the teledildonics appreciation day in August because the patent ended. So you can basically use the term wherever you want or... Thank you. Microphone number three, please. So this was very funny, obviously, and you showed us the really low-hanging fruit. On the website in the database, you would have been able to see the social graph of the users. I don't know if you have managed to look at other devices. Can you elaborate a little bit more on something that I believe more serious, which is the profiling of users' behaviors, social networks, and so on? So, of course, I didn't take a look of all the data because it was a critical mapping and I directly contacted the z-point so I can't give you any information about the data, of course. I also took a look at things like tracking and stuff like that. And in this case, there was not a lot of tracking going on at the German sex toys. But when you compare it to the Chinese sex toys, there is way more tracking and stuff like that going on. But it didn't took a detailed look into that. Okay, thanks. Thank you. Thank you again for the educational and entertaining talk. And hopefully, that's a lot of time to talk.


Welcome to this seventh and eighth module in which we covered JavaScript. And this video is just the introduction to the overall module which consists of a number of smaller videos introducing the different topics. The content is basically as follows. We look at the terminology of client service site, execution client service site applications. We look at the document object model which is an essential part of using JavaScript in the front end for client site applications. And then we dive into JavaScript. So we look a little bit at the history, the versions, different principles, of course a lot of basic syntax how to use JavaScript. Then a couple of the advanced concepts, namely the ones mentioned here are hoisting, callbacks and the JavaScript execution which is often referred to as the event loop simply. And finally we also look at Ajax, at Asynchronous, JavaScript and XML. The learning outcomes are that you should be able to define in contrast what client site and service site applications are. You should be able to define and explain key language concepts of the three languages all together now. So this lecture covers of course only the last part. Similarly, you should be able to develop such applications after this lecture, but also predict how these things work. So looking at a web application based on HTML, CSS and JavaScript and tell how it should behave, how it should look like, behave, how Asynchronous JavaScript behaves, which is a bit more complicated. And then use Ajax to actually add Asynchronous behavior to websites. And finally there are three, I would say more analytical learning outcomes which look at analyzing source code, proposing improvement or improve existing web application code. The literature for this module is again lots of references for looking up different things. The first one is actually an old specification of the DOM of the document object model. It's mainly here for reference because they have a quite nice summary of what the DOM actually is. Then the W3 school is linked here with three different links. The general JavaScript tutorial which covers a lot of different things, a little bit on the history of the different versions and what is supported right now. And then a reference on the different event attributes in HTML that you can use to basically trigger JavaScript. The last two links go into the event loop, into the execution of JavaScript. One explains how this thing works and the other one is a simulation tool where you can actually look at how the code works. So this is the introduction. Please follow the following videos for getting the content.


Hey, thank you for coming. I want to do a really short talk today about some aftermarket vehicle accessories we've been looking at. Now I'm going to start by looking at some aftermarket alarms, which was research we published back in February this year, and then I want to move on to some new stuff, which I wasn't going to be able to talk about, but responsible disclosure, you've got to follow it. The vulnerabilities were fixed yesterday, so I'm quite pleased we can actually talk about some of these live now. Now I want to go back to look at what we looked at before. I want to look at some smart car alarms, and what got us interested in the smart car alarms was the vendor advertised themselves as unhackable, and I'm thinking, wow, that's got to be really interesting, unhackable. You might remember some work our team did about a year ago on a certain cryptocurrency wallet called BitFi. The cryptocurrency wallet marked it by John McAfee as unhackable, and about two days later the team had rooted it, and yeah, that went well. We got a pony for the second time at Black Hat on Tuesday this week, which we're really happy about. Anyway, let's move on to it. We're going to look at a Russian alarm vendor called Pandora. Anyone heard of Pandora? One or two of you. Okay, they're big. They've got two million customers with these devices installed, and they advertise themselves as unhackable. We started looking at it, looked at all the words they were marketing, and I don't know about you, that means nothing to me. It's a waste of time. We looked at the mobile app, looks very much like the classic mobile app you get with a smart vehicle, so you had a telematics interface. You could identify the vehicle. You could find it in real time. You could check that your vehicle was locked. You could pop the trunk stuff. You could also start and stop the vehicle. I'm getting interested in this, right? The problem being is if you have keyless entry vehicle, some of them are becoming hard to ensure now. So manufacturers are, sorry, insurers are insisting on aftermarket alarms. We started looking at them, and I'd like to introduce a colleague of mine who's sat over there, Vangelis, very clever guy. He doesn't always dress like that. We were doing some TV work for the BBC, and they said, can he put on a black hoodie and some dark glasses? So he doesn't always come on out like that. Within moments, he'd found vulnerabilities in the mobile app API. They found an insecure direct object reference. Remember those vulnerabilities that we knew about 10, 15 years ago that keep popping up again? He found a vulnerability in the JSON parameter and the one that allowed you to reset the email address when you've forgotten your password. So we could change the email address without authorization, trigger a password reset, receive the password reset, and take over the mobile app account. So we're now in quite a good place. We've now got all of the functionality of the alarm, which is nuts. You could just trigger it. They didn't authorize it correctly. Now, we thought it'd be really interesting. We wanted to see what else we could do. So we spent a lot of money on car alarms, and I had a very difficult conversation with a colleague of mine who owns a Range Rover and said, what we want to do is fit an alarm to your car that makes it easier to steal. Is that okay? Okay, that's fine. So we did that. That's his Range Rover. The API is screwed. You can enumerate the vehicle type through here. So if you want to steal all the Range Rovers, the Lamborghinis, the Ferrari's, you can just go and find them all. You can geolocate them in real time. So that's his car parked in our office. Got the map. So we know what the vehicle is we want to steal. And then you can unlock it. You can also track the driver in real time wherever they are. So you can see if you've been speeding. I think that's quite creepy, right? You can also do some other stuff. You can also stop it. You can stop the engine of the vehicle by enabling the immobilizer remotely. Now it won't cut the engine out immediately, but if soon as you come to a stop, if you turn the engine off, you're out. If you've got stop start, you pull up to the lights, you aren't going anywhere again. And this actually happened. So my colleague forgot to de-immobilize Mark's Range Rover one morning and he woke up at 5.30am to go to the airport to get his mother-in-law. His car wasn't going anywhere. Oops, that got fixed. So just to recap, it affected two million vehicles. You can geolocate any vehicle in real time. You can select the brands you want to go for and you can unlock it to order as well as immobilize it. We then started looking at the manual and something really freaky. We found, bottom right there, in the installer's guide is a microphone. We're thinking, okay, this is kind of interesting. Why is there a microphone? Turns out it's for the European Equal Directive. So if you have a high G impact, it can automatically dial the emergency services. What we found is you could remotely turn the microphone on on the vehicle through one of the insecure direct object references in the API. So you could listen to two million people's cars. I don't know about you. I say stuff in my car that I don't want anybody else to hear. But hey, this is fine. We can just listen to you. Next one. Anyone here heard of Viper? Big brand. Right. Guess what? IDOR! And we found a vulnerability in the API for Viper as well. It was very similar. We could change the user password directly. We could then hijack the account. So we're thinking, right, it's time to do responsible disclosure, isn't it? We've got three million vulnerable vehicles right now. And we thought that Viper, being a U.S. operation really cool, they actually thought we'd get there first. Pandora, Russian operation, thought they'd be difficult to work with. Viper, responsible disclosure, nearly a train wreck, but not quite. We didn't reply to any of our emails, but we found a VP of connected stuff on LinkedIn. I dropped him an intro line and he accepted straight away. And instantly we had a communication interface and they got it fixed in three days, which was, I thought, quite impressive actually, is I wish all vulnerability disclosure was like that. Pandora, I thought, were going to be a train wreck. We got no response to any of our disclosure attempts. I phoned up the U.K. agent and they didn't reply to return my call, but I did get a call back at the weekend. And to be honest, the guy was a bit pissy with me. So I thought we're about to see a real train wreck of disclosure again. But he phoned me back the next morning and said, yeah, we fixed it. Oh, wow. And they're all cool. And he said, hey, we'd like to really thank you for all the work you've done. We'd like to offer you a free alarm. It's okay. Don't worry. You can keep your alarm. That's fine. So let's move on to some new research. Who's had a low jack? Okay. I didn't realize it's actually an urban dictionary term as well. Being low jacked is also a term used for being ficked with a criminal ankle bracelet. I can tell you a story about the security of those as well, but we won't go there because I might get in trouble with the cops. Right. In the UK and Europe, low jack is a different brand name. It's the same operation, but it's called tracker. So I'm going to use the words low jack and tracker interchangeably. So bear with me if I get one wrong. The idea being is if your vehicle is stolen, you get an alert, you tell the contact center, and they set up a report with the cops, the cops have radio equipment and they will go and find your vehicle.  That's great for the insurer. Although if I have my car stolen and someone's driven it hard, I don't know if I want it back or not. Thank you. But anyway, it reduces your insurance premium, certainly in Europe. They'll give you a discount if you have a tracker or low jack fitted because the losses to the insurer are fewer. The way it works is that a web app and mobile app, you set up a geofence. If the GPS on the vehicle, a little module that you fix, I've got one out there, if it senses it's gone outside the geofence, it alerts. You get an alert on your mobile app, you get an alert from the contact center, you get an automated call. And if you don't reply, it's fine. It's not been stolen. They'll inform the cops. But that's great because you get your car back. Guess what? We'll come to this. In the UK, we have a body called Faction Research, who are owned by a consortium of insurers, and they carry out some really good work. So they do crash testing. They certify vehicles for being safe and secure. And they have saved lives undoubtedly. Really good operation. They also look at the physical security of vehicles. So how easy is it to pick the lock? How is it to steal the vehicle? More recently, they started getting into key relay evaluations. And in the last few months, started doing vehicle cyber security evaluations. That includes certifying and accrediting vehicle tracking devices like Lojak and Tracker. They credit them. They credit them so the insurance industry can go, yeah, that's great. So we have a keyless entry problem. It's okay. The vehicle's still got a tracker fitted. We still get the car back. We're in a good place, right? They've also recently started doing vehicle security ratings in general. And so I'm sure many auto AMs would be very upset to receive a rating of poor security, although I'm sure Audi are pretty happy. Actually, I just ordered an Audi e-tron by complete coincidence. I really want to have a look at that. So they're putting, they're staking the reputations of many of our auto manufacturers on their security ratings. So you'd really want to know that their rating process, their accreditation process was really robust, right? You'd expect if they're going to say a vehicle is not secure, that it's poor security, that it's a really good accreditation process, right? That you can stand by and defend. So let's look at the accreditation process for the immobilizer. So it's an S5 accredited tracker. So Lojak and Tracker is S5 accredited. In some cases, it's actually mandatory. So your insurer will not ensure some vehicles unless you have a tracking device fitted. Why did I do this? Fundamentally, so I could steal a friend of mine's car. We'll come back to him in a bit. There are currently seven accredited tracking devices in the UK accredited by Fashom.  We've gone for three because I think they're quite representative. Tracker Lojak by far the best known brand. Trackstar, which is approved by several OEMs for fitting to their vehicles. So they're dealer fits. So you pay the dealer, they fit it. And also another one so called Smart Track, which is not dealer fit. But we looked at the API and code and thought, it looks a bit screwy. We need to have a bit of a play with this one. So so long didn't read summary. We could defeat the theft alerts. So we could make the stolen car appear like it wasn't stolen. We could remotely immobilize thousands and thousands of vehicles without authorization or authentication authentication. And our conclusion was is the accreditation process that we're having carried out on our vehicles and on our aftermarket products is not fit for purpose. Let's look at the detail. Let's start with a big brand. So how does it work? You have a mobile app. You have a web app. You have a geofence you set. So that's a geofence set around the vehicle at our office. The geofence is busted. You get a text or a call. In that case, it wasn't stolen. So we said, yes, all fine. No further action. We're good. Guess what? Founded in a skilled direct object reference. You could change that forgotten password email address just like you could with Viper. We looked into it, trying to work out why they had the same problem. Turns out the same firm, the same backend telematics operation, the business called Calamp, who provided the telematics platform into Viper, had exactly the same telematics platform for their own Lojak service. We reported the vulnerability in Viper. They unintentionally fixed the vulnerability in Lojak back in February. So they fixed the vulnerability they didn't know about by accident. That was kind of cool. But the EU infrastructure is on a separate environment. And so that didn't get fixed, which is why vulnerabilities for Tracker are across Europe. So we found exactly the same bug. Could take the control of the account. Except there were more. We found another one. You could delete the theft alerts. So your thief comes along, got a little bit of savvy. Before they steal the car, they delete the theft alert. So your car, hey, it's just fine, right? And we could also directly and indirectly delete the geofences around the vehicle.  Happy, hey? Great. You can just delete it. Let's look at Trackstar. That's one of the next biggest brands approved by several AMs fitting. And actually, they just had one IDOR. Wow, we should have none, but they just have one. And that's actually fitted to my car. That's my vehicle sat at my house. And yeah, you could compromise the accounts with one IDOR, take it over, delete the geofences, off you go. Great. Fantastic. Let's look at SmartTrack, because this is the fun one. So more IDORs. You could take control of the account in pretty much the same way as you could with the others. That's one of our vehicles at our office there. But then we discovered you didn't actually need to secure direct object references. We found a backup site that was published the internet and realized that it wasn't interpreting SQL requests correctly. They were going back completely unsanitized, the back-end database. Now, we didn't do this, but apostrophe all one equals one, we're pretty confident that would have worked. Oh, it's like 2003 all over again. Surely, we forgot about this. No, we didn't exploit it. As a result of that, we didn't even need the IDOR. They weren't actually correctly authorizing requests from the contact center to immobilize the vehicles. So when you report a theft, it's not you that's supposed to immobilize the vehicle or report it to the cops. It's supposed to be the contact center. And somehow, for some reason, they've made the API request, sorry, the request from the contact center to the report is stolen, world readable, which was a really weird thing to do. They didn't check authorization correctly. So you could now instantly immobilize every single one of their vehicles. We had a bit of fun. So this is my colleague, Phil, who I don't think's here. And we fitted the smart track to his vehicle. And he went on holiday, but I went around to his house because he was going to a wedding and we had one hour to complete this piece of research to prove whether it works or not. And what we showed, in less than a second, though his engine's going, he switches it off, he switches it back on again, and his car's now immobilized. It took less than a second to immobilize potentially 25,000 vehicles. I loved his hamming up there. That was great. That's crazy. Poor Phil. We got it going again, but everything was fine. I want to tell the story of disclosure net because I think it's okay to have vulnerabilities. That's fine. I think the bit that sets one firm away from another is how you handle a disclosure. Do you embrace, respond, take action? Or do you threaten the researcher with legal action? Cease and desist? Yeah, it's a badge of honor, right? So we thought people would respond. So track star, we're actually really good. They didn't reply to any of our emails. In the end, after trying their call center and failing to get through, I tweeted them publicly. And yeah, we'll talk about that in a minute. But when they made in connection with us, they fixed that API in 30 minutes. And I think that was phenomenal. That was really, really impressive, right? Lowjack and Tracker, I thought, given that we disclosed stuff to CalAMP before, I thought we'd have a really seamless, straight, get it fixed straight away. And they didn't actually, it took a bit of time. And I finally managed to get hold of the UK office. And whilst they were a bit slow to get fixed, they actually fixed it two days ago. So that's cool. Once we got through to the right person, they took action fast. SmartTrack were interesting, actually. The customer services, they took my email and said that they passed it on to the right team, and they made contact with me if they were interested. Okay, that's fine. So I tweeted them publicly on social media as well. And actually, in fairness, they fixed all the SQL injection and all the IDOLs across an entire application in 48 hours. So actually, I thought they did quite a good job, really. I think Trackstar best, Lowjack second, SmartTrack third, but they recovered it well. But this is what I find really frustrating, is why do I have to tweet someone publicly to ask where I brought a vulnerability to? It shouldn't have to result in this, because the problem is, is that I don't know about you, but when I tweet something like this, people start paying attention. A lot of infosex cyber journalists follow me, and stuff goes long, and I don't want that to happen. I just want them to talk to me so I can tell them about the vulnerability. And same with SmartTrack. I took it to them. Why did it have to happen like that? Why couldn't it just be a straightforward, quick engagement? Here's the vulnerability, get it fixed. Thanks, guys. Here's a little credit for it. Cool. Yeah, wouldn't that be great? However, that's not my story. Those are vulnerabilities. The problem I have, the thing I really, really bothers about me, is Thatcham. The guys who are putting the badge of approval on these products so that we as consumers buy them confidently thinking they impede the security of our car. Now, I went to Thatcham and I got hold of their press office and said, guys, we found some vulnerabilities in products that you've accredited. Tell me about your accreditation process. So I want to understand it because I want to make sure I'm being fair with you. And they said, fundamentally, they check that it works. So we're buying a product with a stamp of approval on it that fundamentally works. They also said they checked that physically it was secure. It had to resist an attack for up to two minutes. A physical going for the wiring attack. I don't think that's good enough. I really don't. I then started digging deeper and I found their detail. And this I found really shocking is that they used to take six to eight weeks to accredit these devices, which suggests to me they were doing more, right? But they cut their cost and they cut their certification process to down to as little as one week. And I think that's unacceptable. I really do. Remember, this is an operation that's accessing the security of our vehicles. They've moved into assessing the cyber security of our vehicles as well. This really worries me. Who do we put faith in if the organizations we rely on to give us confidence aren't fit for purpose? That bothers me intensely. So that's kind of the end of my talk. There are some more things we're working on right now. We're also looking at the integration of the alarms and immobilizers directly onto the can. In order to immobilize that vehicle, it has can wiring. In order to speed the installation process for that alarm, it has can wiring so it can detect the can type it's working and customize itself so it can get the right messages. Some of those vulnerabilities that I've showed you, we believe there's exploitation direct onto the can via the vulnerable APIs. And that bit is quite scary. So I think what we concluded from this talk was that we found a whole new way of injecting can data remotely over the public internet. So that's us. There's a whole load of research on there. It tells you all about what we do. A lot of other cars, security testing and advice, but with a complete write up of everything I've shown you here. Thanks very much.