guys enjoy it. Mmm breakfast. All right. Morning Defcon. Thanks for all coming. Thanks for having us. Uh this is Badge of Shame. Uh hey I'm uh Dan Pietro. I'm a senior security engineer at Bishop Fox. Uh before that was a long time pen tester here at Bishop Fox. Yeah hi everyone. I'm the uh new speaker here. My name's David Vargas. I'm a senior consultant with uh Red Team at Bishop Fox. Cool. And we're going to be talking about breaking into secure facilities. So uh this actually all came about as a part of a pen test um here at Bishop Fox. Breaking into secure facilities is easily one of the coolest things that we get to do. And uh if you're already familiar with uh like breaking into facilities there's like an ESP key. We'll kind of get into this a little bit more um as a tool and we tried using this on a pen test one time and it just like wasn't working and we were super like curious as to why. And it turned out that we had an OSDP installation. Uh we hadn't actually seen one in the wild at that point. And so like I've got a background in cryptographic protocols to figure why not take a look at this thing. And uh this presentation is the result of that. Cool. So uh let's get into it. So um one of the other things you should know about me is that I hate slides. Um but uh you can't just get away with not having slides. So we made some authentic bespoke one off slides. These slides are like organic. They are allowed to turn fully around in PowerPoint before being exported. So suppose you're trying to break into a secure facility right? Let's say some undisclosed location in Santa Fe, New Mexico. And you like really want to get into this room right? It's like very important to you personally. And this room like a lot of other rooms has an RFID badge reader that is protecting the entrance to it. Even if you're not familiar with physical security I'm sure you've seen these things right? You take a badge out, you just beep it to the little thing and it lets you into the room. Cool. So uh there's lots of ways of attacking these RFID badge reader systems. Um some of which we've actually pioneered here at Bishop Fox. Um this is the TASIC RFID thief. Uh this is a thing that uh my boss Fran made a while ago. It's basically a long range RFID reader. So it can like read badges from about like five, six feet away. Um we developed this cool little maneuver where you like uh put it into a briefcase and then walk up to somebody at Starbucks with like the wearing their badge. And you like set it down and then kind of like pull it up and then up onto your shoulder. Like the briefcase. And really what you're doing is you're scanning the person from like toe to head. Um like surrepetitiously. Um this was even featured on an episode of Mr. Robot. Actually two I think. Um and uh yeah that's cool. Um so uh the hacking tool my boss Fran made but the prop in the show I made. We knew the technical advisor for the show at the time. And so uh they just needed a little gizmo that says like no badges detected. Like when you press little buttons. It's just a raspberry pi inside of a plastic case. But that's kind of cool. So that's what we're talking about today. We're going to be going over uh let's talk a little bit about how RFID badge reader systems work in general because it's going to be pretty important. So on the outside you can see three things. Uh you can see a door, a lock, and a reader. So the uh reader you present with a badge. So the badge is uh at least for passive cards is just basically a number. It's got a number. Sometimes they're very short too. They're not like big 128 bit numbers or whatever right. You present the badge to the reader and you're basically just telling it this number. It says here's my badge number one two three four. Now importantly the reader does not perform authentication or authorization in this system. It's not the thing that lets you into the door. In order to do that it has to talk to a back end controller.  So the reader then forwards that badge number off to the controller. The controller then says yeah sure this person's allowed into this door and sends it a little like signal that says flash your green light that says that they're allowed in. Now importantly again the reader can't let you in. So it has to have a separate set of wires that is not the same set of wires that like physically unlocks the door because the reader can't control it. Cause obviously if the reader controlled whether you could get in you could just like hack the reader and let you in. It would be super easy. That is not how these things work. Cool. Alright so let's take a look at how everything actually works in the back end. So currently it uses something called weekend right? Everything's unencrypted. The card numbers or whatever data just happens to go across the wire. What that means is we can actually make a small device right now it's you know like an ESP key which you put into the reader. Now what happens is whenever somebody swipes a badge the ESP key can grab the plain text communication and then we can clone the card. Right? And now we can also replay it right? We can make our own cards. We can do all sorts of things to gain access to that facility. So that's a problem and so now comes OSDP. So what's OSDP? OSDP stands for the open supervised device protocol and it's meant to replace weekend. OSDP is built as an encrypted protocol, a secure protocol. It has a couple of other benefits over weekend like it's over RS485 which supports multiple readers on the same bus but we'll get to that a little later. Mainly the big thing was that it's supposed to be encrypted so the same attack we just talked about won't work theoretically. So we started reading about it right? We started looking into alright this sounds interesting what's up with it and we came across some very interesting claims mainly that it was unhackable as of 2020. And so you know that picked our interest so I was like let's take a look at this. So we did a couple of things. To start off we made our own version of an ESP key, a device we dubbed Mellon and so this device just like an ESP key plugs in between the reader and the controller. We also got our hands. David was allowed to call it Mellon as long as he said it like Gandalf at least one time. So Mellon. Alright and so we got the device and so we got a bunch of readers and we got an access A1000 on controller. Now everything that we have supports OSDP so the controller which Dan has over here supports OSDP. We got our eBay. We got some HID signal 20 readers. So what we expected to see was basically encrypted traffic going across the wire. Let's see what we actually saw. I think the name of the video kind of gives it away but yeah. Not encrypted. So what's going on? It's supposed to be encrypted. Everything supports OSDP. Let's see what happened. Well when we kept looking into it it turns out OSDP supports but doesn't actually require encryption. OSDP SC, a secure channel extension added to OSDP is what takes care of the encryption. So what does that mean? It actually means that OSDP devices that support OSDP both can choose to encrypt or not to encrypt traffic and this is going to come playing a role into this a little later on. Cool. So let's back up a minute and talk about protocol and RS485 that is underneath OSDP since this is going to be kind of important. So RS485 is the underlying like physical layer underneath OSDP. It's serial but it's not that serial. It's the other serial. In particular RS485 is multi-drop. So that means that you've got a controller and a reader and you want to hook up additional readers to this controller. You don't have to like have a separate line out to them. You can hook them all up in like succession like this. You can all sort of daisy chain the readers. And importantly in this scenario all messages are broadcast. So like this is a necessity because of just like not like the laws of OSDP but just the laws of physics like they're all connected with the same copper wires. And so necessarily if you're going to send a message to like any of the devices it's going to send them to all of them. So if reader A wants to send a message out to the controller it has to necessarily also send them out to readers B and C. So this is not necessarily vulnerability. It's just like kind of a nice to have. In fact this is really useful for installers since you don't need to have a separate wire out to every single reader in your entire building. You can kind of daisy chain them around. It reduces the wiring makes actually a lot nicer. This does have the consequence though that if suppose we're back in our undisclosed location in Santa Fe, New Mexico and there's like you know some guard out in front of a top secret door like this is the door we really want to get into right. And there's some guy with a beard and suspenders let's just call him George that's in front of this room that like is preventing us from getting in yelling something about Targaryens. There might be a second side door that is like not especially secret that like we wouldn't normally care about getting into. But now you might actually attack this door anyway because it could very well be on the same bus as the secret door. And so if you could listen and sniff badges on this one you might be sniffing badges to like the rest of the building or you know maybe just the door that you really care about. So that's kind of a nice little bonus there for attackers. So if our red teamers are trying to do this just find any door that it might be the one that you care about. Next is around the client server model of OSTP. This is just kind of a practical thing for the protocol which is that in OSTP there's clients and servers the controller is the client all the readers are servers so that means is that readers if you wanted to send a message you can't just asynchronously send a message. It would just get ignored at least according to the spec it should. And in order to send a message you have to reply to responses. So what this means is that controllers have to constantly pull the readers in practices like happens like something on the order of like a hundred curts is pretty typical where you see the controller say hey you got anything for me now. No. You got anything for me now. No. And that's how you like when you badge in it knows amounted immediately because it's like pulling constantly. So this brings us to protocol WTF number one. Something I like to call what are we paying by the bit now. So one of the core functions of a cryptographic protocol is to prevent against replay attacks. So even though it's encrypted what keeps an attacker from just taking the encrypted packet that has like our badge numbers when somebody badges in right and just replaying that packet just taking it and forwarding it off to the controller when we want to authenticate. So normally protocols will do this by having your data attaching a sequence number to it. So the sequence number makes sure that every packet is fresh. It's live. So it has to either just be monotonically increasing from the last one or it's like the number of data like TCP does this by having like the amount of data increasing the sequence number. There's lots of ways of doing this but basically the idea is that the receiver knows what the sequence number should be. It's going to be different every time. It keeps you from replaying things along with an H back that keeps the attacker from tampering with that data. Because obviously if the attacker could just like modify the sequence number to be the correct one then that kind of defeats the whole purpose. So we don't have time to get into like what an H mac is. It's a key hash. If you're not familiar with the way to look it up it's cool. So you might be wondering, all right this sequence number. How many bits does that need to be? Like maybe like 128 bits? Like that would be cryptographically strong right? You can't enumerate that. That would be really good. Maybe 64 bits? Like that's not bad. It's like the edge of enumeration. Like if you're trying to brute force something off the line 64 bits is usually the area where you're like I don't know if that's possible anymore. Like 32 bits? Like that's fine maybe I guess. That's not great. How about two bits? Now I know what you're thinking. Now what you're thinking. Two bits? Those are rookie numbers. We can get that down. How about one and a half bits? Because OSDP actually skips zero in their two bit sequence number scheme. So you start with zero but then everything going off there just goes one two three one two three. So this sequence number exists but for the purposes of security might as well not. In fact I question whether it's useful even for non-security purposes. So let's talk about this H mac. So OSDP has this system of IV chaining where the H mac of the previous packet is the IV of the current packet. By the way we're running in a CBC mode encryption. I can hear the collective groans of all the cryptographers in the room. We don't have time to go over it. It's the CBC mode don't question it. So the IV is just sort of chained down the line where every single H mac is just going to be the IV of the next packet. So this sort of has the effect of providing liveness because like the last packet is going to kind of mutate your current one and so that sort of prevents replay attacks in this kind of like a janky sort of setup. But like in practice it sort of kind of works. We're going to have to come back to that. The problem with the H mac however is that we just take most of it and throw it in the trash. So the first 32 bits of the H mac we keep. And then the last 96 bits we just throw away. The spec even says to reduce the message size and transmission time overhead. Only the first four bytes are sent. Like why would you do this? Like you can't just take like the bits and like reduce the overhead. You know like those are important bits. Like we needed those bits. You can't just do this. So if we do some back of the envelope math on like what this might look like. So imagine you're just sending a badge in attempts with like random Macs right. Like how long would this take us to enumerate in practice. So that's two to the thirty one attempts on average. Let's assume that we're running at like one one five two hundred bod. Which is around the top end of what you can see. I think in practice I'm technically RS forty five can run at ten megabits. In which case if you find some insulation that's running that fast then like fuck. But the this would be a success after like thirty five days. Which like is dangerous and sort of scary if you're a defender but I think as a red team we're unlikely to really exploit this. Like I imagine like sending David on a pen test or like okay. So we're gonna give you a sleeping bag.  On average. And at some point during that time you might be asleep. The door is gonna beep. And you gotta make a mad dash to it. Because it's gonna be open for like three seconds. We have a we have budgets and I don't think that's gonna be within ours. So I think in practice this is likely not a thing that you're gonna see a ton of. Unless the speed changes. Like if you're running this over a different underlying protocol for some reason that runs at like ten megabits or like if some reason you're RS forty five installation really is that fast. Then this could start getting really scary. Now there's a birthday attack in this. Some of you might have already noticed. So if you just ask the question. Like what are the chances that any of these IVs are the same. Right. On average with only a thirty two bit Mac. You're gonna get it at about seventy seven thousand packets on average. And what that means is that if the data is always the same. Like if we're in this like polling act loop. The data is always gonna be the same. So our data is just gonna loop back around. So like you can actually observe this happening in practice too. Which is just like bizarre and not a good look for a cryptographic protocol. This isn't a vulnerability as far as I can tell. Because anytime somebody does anything like if you badge in it'll perturb the loop and escape you out of the loop and get you into a new loop. But just like this is not a thing that a reasonable protocol should be doing. Where you're just like actually sending the same exact bits looping back around and reusing IVs is like a thing that has gotten other protocols into a lot of hot water. So like we should just not be doing this. Oh and then lastly around this is the key exchange. A key derivation for session keys. So we'll get a bit more into like a key hierarchy that OSDB defines. But the session keys. The thing that's like actually used to encrypt data. Only uses 48 bits of entropy from the back end server. So session keys are derived by having the controller send the reader a nonce. The controller then derives a session key by taking 48 bits of that nonce for reasons unknown. And then encrypting that with the base key, the higher level key. And that becomes the session key basically. And maybe somebody in the audience is clever than us and can figure out a way to actually brute force this offline because if it were 48 bits you could. But because it's encrypted by the base key which the attacker in this scenario presumably does not know. I don't, I couldn't figure out a good way to enumerate this offline. So. Cool. Alright so let's actually attack this thing. Alright we have some background. We know that OSDB supports both encrypted and unencrypted connections. So we can do something called a replay attack. Or sorry downgrade attack. Alright so let me pause it here. Explain what's going on. So on the right hand side we have our controller. So we can see that what it's seeing and we can see on the left hand side the communication going between the controller and the reader. So there's a secure channel setup. We can't see anything right. Everything's secure. We're going to swipe in. And there's absolutely nothing that we can see. Okay but let's remember that again it supports both right. So there's sure a way we can mess around with this. So we do it again. This time we try to carry out a downgrade attack. We try to downgrade. And then we swipe in again. And we can actually see the card data. Cool. Alright so let's see what we actually did there to make that happen. To decide if it can establish encryption or not. There's a couple things that happen first. So the controller first asks the reader what its capabilities are. And the reader replies its capabilities. The capabilities can be a number of very interesting things to us. So it can say maybe we're talking to a fingerprint reader or an iris scanner it supports biometrics. Maybe we're talking to a keypad as a keypad entry. So the capabilities are keypad. The one we're interested in here is communication security. So the communication security bit actually tells the controller whether or not the reader supports encryption. So let's insert our device in the middle here and let's wait for that capabilities request. And now when we actually reply we're going to switch that communication security bit from a 1 to a 0. And so the controller assumes that there's no encryption set up. It doesn't support encryption and we can carry on with everything unencrypted. Alright that brings us to protocol WTF number two. Stop making null ciphers.  There's basically a four-step process in which the controller and the reader mutually authenticate to each other to make sure that they each have the same encryption key. Now as a result of this when everything works out there's four message types that can be sent. SES 15 and 17 which are command from the controller to the reader or reply 16 and 18 which are you know replies from from the reader to the controller. If you read the spec SES 15 and 16 say that even though there's a Mac applied the data is still unencrypted. Which is wild right? We're supposed to be having a secure channel set up with encryption but yet the data fields are unencrypted. So that means that in a fully secured session there is a possibility that the data is just going to go over the wire. Now it has a Mac applied to it so we can't just replay it but you know we can still just in the case of car data watch it clone it and just authenticate to the readers. Now to be fair the spec does say that those message types are not meant to be used with any sort of data but then why have them in the first place right? Alright this moves us to demo number three something we have to call the install mode attack. Hominess sounding. It's going to already play. Okay so what you're going to see here on the right is the controller that's going to be running in a terminal. This is an intentionally vulnerable controller software that we wrote. That's basically just the lib OSDP sample code basically actually. And on the left is an attack script that we're writing. We're going to be performing something we call the install mode attack. So we're going to run this with just an dash dash install flag, run up our server and this time we don't just capture a badge number we actually steal the encryption key right out from underneath the server. So how the heck does that work? Let's talk about it. So OSDP has something a bit like the SSH security model which is like a one time insecure setup. This is not by itself in a vacuum a bad thing. We don't care about SSH's security model so much. The problem is that this has to actually be a one time insecure setup. Like if somebody told you they found a way of hacking SSH and you just have to do is man in the middle of the initial connection and be like yeah like that's kind of built into the model of like that's not clever or anything. The problem is when this turns out to not be so one time. So controllers and readers in OSDP have this kind of quasi official install mode that is specified in the spec but it's exact semantics aren't exactly laid out like when you're supposed to do things and how are you supposed to behave. A lot of that is just sort of left up to the individual implementers. And so in this install mode as the name suggests this is not the exact packets but the reader is able to ask it like hey what's the encryption key because I'm just trying to get set up here and the reader just the controller goes here you go here's the key because like that's what the install mode is supposed to do. The problem happens when this install mode persists. If it happens to last more than just this like short ephemeral moment when you're initially installing a reader. So if you happen to have a controller that is just like hanging out in install mode persistently then an attacker can just show up on the bus ask the controller hey what's the encryption key I'm a reader and it'll just respond to you and say here's the key. And the keys in this case are unique per reader controller pair but that ID is just a public ID in fact it's usually written on the back of the reader itself so like you could just lie about your ID and get the key for any reader on the building. So this brings us to this point like where exactly do these vulnerabilities lie. So we've been kind of picking on the protocol and I think there's a fair number of things to pick about the protocol. But like there's lots of other places depending on how you want to kind of squint and look at it that the vulnerabilities could exist on. So you could think of this as a library book some of these like whatever the library does is probably what's going to be out there in practice right like who is going to grow out and roll their own library just for this. So like you could argue that like the behavior of the popular libraries is the thing that needs to change here that's where the fault really lies. You could argue that this is a configuration problem a lot of these vulnerabilities can be fixed in configurations like you should configure your controllers to not sit around persistently in install mode and maybe that's not crazy. You could argue that it's a documentation problem that like like the exact behaviors of how these things are supposed to work is like maybe not documented well or maybe it is but nobody knows where that's at and so like maybe better documentation could get out of this problem. You could argue that this is an implementation bug that the individual like implementers of the controller hardware are responsible for setting these things up properly and what admin is going to go out and tinker with the settings of the fine grain level like whatever is out there in implementation is probably what's going to be out there in practice. You could also argue that this is a marketing problem that a lot of devices such as our access a one thousand one just say that they support OSDP but that's not like a legally defensible like term whereas there's actually a OSDP verified like a program where you can put your hardware into the people that make the specification and they can like certify it as not like secure in some abstract sense but at least that it like does the protocol and does all of the protocol like the encryption parts where like you might just have an entire OSDP setup at home probably not at home at your office and think like I'm all secure like I bought all this stuff I spent a whole bunch of money upgrading it and you could very well go back to your office and discover that none of it's encrypted. It's all just plain text and that's not great and that's also partly a marketing problem. So it's pretty easy to see how these vulnerabilities could just pass by people because no matter who you are in this setup there's always somebody else you could possibly blame and think like well it's not really my problem it's whoever is going to configure the stupid thing. Okay let's stop it up a bit.  Oops. Okay so this is what we expected of message 17 and 18. We expected to see the header in plain text and then the command bytes and the data encrypted but this is what we actually see. So the only thing that's encrypted in a fully secure channel setup is the data. Now why does it matter? Why is the command byte important? Well the command byte is what tells us what the message type is. It tells us what the command was, what the reply is so we know what kind of data is in that packet. Some of the interesting ones we want to look at are the OSDP raw. This one contains raw car data so we see that going over the wire. We might want to look at that packet a little more. There's the FMT packet which has formatted car data. Keypad, self-explanatory. The bioreader, I keep going back to the bioreader ones because they're just very interesting to me. I haven't had a chance to poke at them but hoping that's the next step here. Okay and then there's the OSDP key set message. So the key set message is the command from the controller to the reader where the session base key is delivered and basically the encryption key for every message is derived from the session base key so we can get our hands on that base key and compromise the communications. Which brings us to the next demo. The weak keys attack. Cool. So once again we have the controller and our tax script here and we're testing for weak keys and we just found a weak key. So if we find the weak key we can decrypt the packets and we can reset that key set message. Cool. So what happened? First off before I dive in this is not a protocol specific issue. This is something of an implementation issue that we've observed with a lot of open source libraries. So again it doesn't have to do with OSDP but the people writing I guess a code for it. Okay. So there's a hierarchy of keys here. There's the master key which is the session base key which is the one we just spoke about. And then there's the encryption key for all the actual messages which is derived from the base key. Now in the newer implementations of OSDP the spec actually takes out the master key and it recommends eliminating it and instead somehow generating and delivering the session base key. Now it doesn't say how to do that. So we've seen things for the SCBK. And again, this isn't just one library we've seen a number of these. So what does that mean from our attacking perspective? Now we're not going to say we're going to brute force the whole 128-bit space that'd be silly, but what we can do is try say about a thousand-week keys, right? We can try repeating characters, we can try increasing and decreasing characters and so on. If we managed to actually find a reader that's using these hard coded keys for the encryption key and compromise that session. All right. This brings us to protocol WTF number four encryption is not magic fairy dust which was also the very nearly the title of this entire topic. Another possible alternate title was just because you did it on purpose doesn't mean it's not a vulnerability. So let's go back to this, some bold marketing claims about things being unhackable while we can all get a good laugh out of this. One thing that it said was true, which is that it does in fact use 128-bit AES encryption. That is in fact true, so good on them. The problem, however, is that we only use AES as in there's no asymmetric cryptography at all in the spec whatsoever. So naturally cryptographers amongst you are wondering, so how do we do key exchange exactly then, right? So there's no cryptography and then like how do the reader and the controller exchange keys? Ah, dear listener, this is maybe easier than you think. You just send the key. No, okay, okay, okay. We can't just send the key unencrypted, right? That would be insecure. So we encrypt the key. But cryptographers amongst you are scratching their heads right now. With what do we encrypt the key if we are trying to send the key? Ah, that's a good question. We use the SCBKD which is the secure channel base key default. Meaning that's it. That's the key. It's just the ASCII number 0 to F in hex. Like this is not how encryption works. Like you can't just like sprinkle some like crypto on something and say like we encrypted it boss. Like there's no point in this whatsoever. It's just like a really fancy encoding mechanism that only serves to give you a false sense of security and thinking like I don't know what it says it's encrypted right now and I can't read it so I guess it's good, right? Like this is not the airbud rules of cryptography. We're like you can't just like very nothing rules that says a default key can't be an encryption key. Cool. Okay, so this brings us to our final demo and actually my favorite one because just what it actually means. Cool. So again, we're attacking the controller and we managed to capture the key. So how do we capture the key? Up to this point a lot of what we've discussed can be attributed to misconfigurations, right? Not so much like other than the WTFs. A lot of it is the reader being left in install mode or supporting both secure channel and unencrypted traffic. So what happens if best practice are followed? Well first of all I think a lot of us know that best practices usually aren't followed. But let me walk you through a scenario how we would attack a completely secure setup. Number one, we insert our listening device. Number two, we need to break a reader. Number three, we need to wait for IT to replace that reader. And number four, we capture the key set command. So this is how it actually works. So let's say we show up on a site where we want to break in, right? We have the top secret door we want to gain access to and we have maybe a side door that's not so well guarded. We have no possibility of a downgrade attack. Everything is encrypted with a session base key. Well, we start going to go and insert our listening device behind the not so very secret door. Again, let's remember that OSDP on RS485 supports multiple readers. So that's kind of a that's what's going to make the attack practical for us. I'm going to go ahead and insert it on that same bus somewhere where that's not well guarded. Now we need to break the reader we're interested in. How we do that, it's up to you. So you can either use an NFC up on your phone, go up to the reader and mess around with its settings which is actually something you can do with a lot of readers we tested or you can literally go up and rip the reader up the wall. Doesn't matter how you do it you just need to break it. Now what's going to happen? Well, they're going to need to replace that reader or they're going to need to repair it. And so they need to deliver the key to that reader to set up to secure channel encryption. Well, if we're on the bus listening to everything, we know that that key set message is going to be delivered with the default base key which means we're going to be in a position where we can capture it when the reader is being set up. Which means after everything is set up we now have the session base key and we can decrypt all the traffic going to the top secret door. Cool. Alright, so what do we do? How do I defend? Let's look at what we can do from the blue team side. First, check your configuration. So we need to make sure that encryption is actually enforced. We need to make sure that there is no possibility that we can downgrade that. So the readers that support encryption usually have an option that just does not allow it to be for communications to carry on unencrypted. And disable the install mode. Now, something that Dan Felt mentioned is when we were doing the testing for this we actually tested this on a production site where the install mode was and left on. So it's not a theoretical misconfiguration, we've actually seen that in production. So whenever it's set up make sure to disable the install mode. So this is a recommendation that I'm going to give to you that you are definitely not going to do. But I'm going to say it anyway. Never configure a reader in production.  So rather than ever using the production wires as in the reader on the wall using the wires that are in your building. Since the entire point of putting encryption on this thing is assuming that those wires are compromised, that there could be somebody listening that doing an insecure key exchange over that mechanism is just hazardous. So what you could do is if you need to install a reader to take the reader off the wall walk it over to the controller with your feet. Plug it into the controller with like a two-foot wire that you're reasonably sure has no listening device on it. Do the configuration there. Do the key exchange there.  You have to do this every single time a reader or needs to be reconfigured or replaced. For a significantly large building this is going to be utterly untenable, but none the less this is a thing you could do. That way anytime the key exchange happens it's never done over the production wires where somebody is actually listening.  It sort of defeats the purpose of like having this whole system but that's a thing that you could do. Never ignore tamper alarms. Modern readers have a little button on the back of them that is like a tamper alarm. And in practice when you are a red teamer and you're going to be performing this attack you're likely to trip that tamper alarm. It's literally just like a button that when you have the reader against the wall it's pressed in and then when you like unscrew it with a Phillips head screwdriver to access the wires behind it it unpresses that button and then sends a little signal out to the controller that says I've been tampered with. And what happens on the controller is kind of up to you as a blue team. Maybe that just goes and gets into a log somewhere that somebody will notice in several months. Don't let that happen. There's often other mitigating physical controls around these sorts of doors especially in physical security systems for high secure facilities. So maybe take a tamper alarm and start recording with the camera when that happens or something if there's a camera there. Whatever you do don't ignore these things if you're being attacked for real you're likely to get one of these things. It is probably possible to like the tamper to get access to the wires behind a reader without triggering a tamper alarm but that's like a whole separate thing that we didn't bother getting into because it's sort of its own rabbit hole. Maybe there's a clever little device you could use to like insert behind it and press the button in and then pull it out. I don't know. That's not me. Buy OSDB verified devices.  Don't just buy some random box off the internet that says it supports OSDP because it might just like not even support encryption. Like we literally bought a device on eBay for like $300 because we wanted to test OSDP encryption and it turned out to not support encryption. So I made that mistake and I bet you could too. And then lastly, don't trust things just because it's encrypted. Cryptographic protocols are really hard and security is hard. And just because it has encryption on it doesn't make it like secure magically. And then that is all. Thanks a lot. I think that we have time for some questions. There is a microphone right in the middle here. If you'd like to ask a question you can go up to the microphone there alternatively. You can just shout really loud and I could probably hear you if you do that. If not then we'll just be kind of milling about here and then... How am I splicing 485s here? Oh yeah, you can basically just punch into it. So it's a differential. I'll repeat the question. How are we interfacing with the RS45 from a physical perspective? And you can just tap into it basically so it's a differential signal. And because it's multi-drop it's like meant to be used in that kind of configuration basically. So yeah, you can just kind of like tap into it. And also for our device I'm tapping into the power line as well just to get power from it. So you get the data lines it's a differential signal so you get like power in power data and then negative data. And then you'll also have power lines. In theory you could use a battery but we figured it was just going to be easier to tap into the power lines as well. So yeah. Yes, Oliver the tools are GitHub. It's github.com. You'll find all the code there. We have the hardware schematics for the hardware itself as well as some code.  We have 100 like Melon PCBs if you want to nag one. It doesn't have the rest of the components on them so you have to do some soldering. But yeah, we've got some PCBs if you want to get one. You have to bug this guy. People are going for the shouting option more than I thought they were going to. You have to shout. Yes, so the spec is open. In fact it's so open that anyone can purchase it for $200 online. That is the only official way of getting access to it. Yeah. Yeah. The question for those listening is like in one of the attacks the downgrade attack we're going to modify the capabilities packet. Like how are we doing that if we're just passively tapping? We have two versions of the code. There's one that's Python that's meant to run on a laptop with big RS-45 adapters where you're in the middle. And then for the initial version of our hardware device that's miniaturized down into a one inch by one inch thing we decided to just make it a passive tap so we're not doing the man in the middle attacks. And that would be one of them. So yeah, that one, the install mode attack is not part of the hardware one at this point. Maybe we'll make a separate one that has a proper man in the middle and then get it in the middle and then like, I don't know, that seems like a lot for red teaming. So we just avoided it. Yeah.


Helen made me care about the people in this book and I wanted to know more about them their future and their families and That gets us right into this that you interviewed more than a hundred people For this how did you finally decide to focus on these four? Oh boy well first can I just say thank you to the San Francisco Public Library and all of you for coming out here tonight on such a beautiful evening and to sherry who for Being such a dear friend and and being willing to do this with me and also to the 1990 Institute and Corey Yang for for organizing this event. So thanks to all of you and and You know for an author, especially when you do spend 12 years working on at home You never know how it's going to come out how it's going to be received and so it's just so amazing to to see all of you and and to Feel like I've touched people like sherry and and a number of dear friends and readers here And as sherry pointed out, I actually started this book I Had it on my mind for more than 12 years It was something I had thought about for a long time because what I wrote about was And a forgotten exodus a story that I had heard from the time that I was a child and The more I wanted to know about it the the more I found out that there was nothing There is not a single book in the English language Not a single dissertation or a master's thesis about this particular exodus in English in Chinese there are about three books all in Taiwan about the exodus to Taiwan so my wanting to know about it was something that There was nothing for me to find just tidbits and that's why I undertook Interviewing people and actually I interviewed more than a hundred Survivors of this I call them survivors people who live through this exodus and I know some of you are here this evening this is a World War two generation and I interviewed well over a hundred other people experts professors folks who specialize in China before World War two World War two after World War two and Shanghai in particular which you see Berkeley Actually is quite noted for its Shanghai scholars, but these four in particular their stories were so compelling That it that it was just stunning and and such rich detail. I mean so out of the hundred You narrowed it down to four Was there a reason? There is a reason I have to say that telling a the story of more than hundred people is very difficult to do even more than More than four people. It's really hard for a reader to track those stories But there's a reason that I undertook this and if you'll bear with me I did want to to share a personal piece of why I ended up doing this book because I'm in ABC and for the Chinese Americans in the room You'll know that means I'm an American born Chinese when I was a child In growing born and raised in New Jersey by the way anybody else here from New Jersey. Oh My brother Hoyt. He's also first you count and he's also not ashamed to admit that he's from New Jersey the rest of you I know you're out here, but but our father said to my mother when she was When we were in diapers, he said don't speak Chinese to the children Why because that was the height of the McCarthy period. It was a time that my father knew that Chinese were Being looked at as potential spies as a fifth column in the US And so he thought that as children we would be discriminated against if we spoke Chinese now as an adult I know that that wasn't going to happen and I regret that he had said that to my mother But I never thought that I was the right person to do this research Even though I felt like there was a story that needed to be told because I don't speak Chinese I don't read Chinese and I you know in my mind. I really thought this should be done by somebody who is not only fluent in Mandarin also fluent in Shanghainese and Fluent in old Shanghainese which was spoken in the 1930s and 1940s and who could read both simplified and traditional Chinese Texts, but there was an even better reason why you were the most qualified well to write this book So so if you don't if you'll bear with me, I'm going to read a short passage, which is why I took this up and One of the four characters that sherry mentions All of the four began I start in 1937 when they were children and so this is a story of one of the characters who was at six years old in 1936 and She was about to go on a trip with her father And was very excited about doing that this six-year-old who was only known as a little sister at the time Baba her father Baba announced that he would take little sister on a train ride to Suzhou 60 miles away toward Shanghai She remembered every moment of that journey for she had been giddy that Baba had chosen her Not one of her brothers. She sat on her father's lap Her eyes glued to the window mesmerized by the neat rice fields and towns just like hers Sweeping by in a blur When they arrived in Suzhou, she saw men and women dressed in fine silk fabrics and even in foreign outfits Unlike her mother and father who wore roughly woven traditional dress Big posters showed pretty ladies with curly black hair wearing tight cheap house Promoting cigarettes mosquito coils and rat poison When they reached the station Baba flagged down the driver of a wooden moon wheeled cart After a twisty bumpy ride over archstone bridges and canals lined by weeping willows They finally came to a stop at a small store Inside her father spoke to the shopkeepers in a low voice while she stood waiting by the door Looking out at the parade of vendors and hawkers on the street Soon Baba called for her and told her to stand still by him the shopkeepers looked into her mouth and Squeezed her thin arms when they were finished poking and prodding her one of them took her hand and led her to another room As she turned to look for her father. She saw his back as he headed out the door Baba Baba she had shouted after him. He didn't turn around Baba come back. She cried. How could he leave without her? the stranger gently pushed her into a small dark storeroom and locked the door Alone and terrified of what might lurk in the darkness at first she could only whimper Then she steeled herself and called for her father as hard as she could until she grew horse and couldn't shout anymore Exhausted she sobbed herself to sleep When the little girl awakened on the musty Excuse me on the musty dirt floor. She thought she had had a terrible nightmare But when she tried to open the door it wouldn't budge She could see the glare of daylight around the cracks Once again, she screamed for her father Baba never came And so I heard this story About 15 16 years ago, and it was told to me by my mother and she was the little girl And she was already well into her 70s, and she had never told anyone I had never heard this before I had grown up wondering about What life was like in China because in New Jersey people would always say go back where you came from and when I said New Jersey I'm here They meant China, so I would ask my mother What was life like for you as a little girl growing up in China and my mother always said That was wartime a bad memory and that was all she would ever say So I never knew anything until this moment when I was having dinner with my mother actually in Rossmore and Walnut Creek and that childhood mantra just sort of popped into my mouth when I was You know just trying to make conversation with my mom and I said gee mom too bad You can't tell me about your childhood when you were a little girl in China You know something that an adult child would stupidly say and she looked at me that evening And she said all right you want to know I'll tell you and So this was the first story she told me and I was in total shock I hadn't never known this and of course even as adults, you know from the time where children we have a family narrative a story that our parents tell us about You know our story our families our history that they hope will make us stronger people and That's why they don't tell us stories like these and and so What happened after? She finally released and told you this story Was it part of a healing process for her and and and you and Hoyt and the other siblings Must have been oh we were in total we couldn't believe it I mean my mother when she told me the story it first said I'll tell you but you can't tell anybody else And I said oh okay mom and isn't a book now right right now. It's now. It's in the book By the end of the story and this was just the beginning. I mean you can imagine she had been given away just as the invasion by Japan and the full-blown World War two is going to begin and And so just Her life her very circuitous Life from then on I mean she began to tell me and so and I began to ask lots of questions But by the end of this evening I said is It all right if I tell my siblings your other children and she paused to think about it and she said yeah, okay so I got on the phone that night and and and Called every one of my siblings, you know, there were six of us so and we were all in a state of shock We had no idea when I told my sister she started crying You know just knowing that this had been my mother's life and her early beginnings but what was so shocking was that she had kept the story a secret all her life and it wasn't until she was in her 1970s and I imagine that if I had not just blurted that question out that night she might never have told me because What happened was after a few years went by and I mean every time I saw my mother after that I would just be asking her another question another question tell me more and then what happened and what did you say to this person and Why do you think this happened and why are you telling this now and she would say My father gave me away because I was a girl number one and And When I said to her mom your memory is so good like what another smart thing to say she said I Was six years old. I remember every detail because that was the worst day of my life and so she was very clear with all of these details and her memory was remarkable but as I heard the Details I was like you would remember everyone here would remember these things that happened to them Well, as she told them I could feel she grew lighter. I mean I told my siblings. So then they would ask her questions I have two nephews here Rory and Mitchell and when they would ask their grandmother questions She was so happy actually to be telling her Grandchildren these stories who did reports about their grandmother and you could feel that every time she told it was Kind of a release of that Shame that she held because there was so so much stigma, especially of that generation of having been abandoned Of then being adopted later and all of those things Then when did you decide to tell her you were going to write a book about this? Well Not long after that. I mean I did ask my mother I mean, you know she knew I was asking her a lot of questions and by then I had already written two books probably guess knowing you and and she it was I could feel Liberating for her to be able to tell these stories stories that she had locked away for so long and never told anybody and she had so much knowledge about the time and the history and what was going on in China and Shanghai and So at some point at some point, I guess You know being the daughter who was also the writer and the journalist. I I really wanted to know more I wanted to know the context of what had happened to my mother was how how unique was this for her But what was also going on with other children of that time and other people in that time in Shanghai because as I said there was really nothing for me to look up about it nothing to read and so I Began to do to find people I mean that was that was a challenge in itself because you know there aren't any lists to go for and I Just began asking everybody. I knew do you know anybody who might have come from this time period in China who left as part of this exodus who might have Lived in Shanghai or passed through Shanghai or have some knowledge of this time What's so fascinating though is that the details are so specific in each of the stories for ho for Benny for and while I mean I can understand the trauma and and a child remembering that but I mean there There are really some horrifying specific details watching watching war and seeing bodies in the street I think that was Benny's story Every every everybody who was a child in Shanghai saw bodies Even your mother's story is she was racing to get to the ship to escape in that last ship That's right that someone in a penny cab almost hit her Did people remember all every single little detail that's in here? I mean seriously it is rich with detail once you read or if you have read you will understand This was such a tumultuous time in China It was a time of you know world war occupation by a terrible cruel invader Enemy for eight years eight long years. I mean China fought World War two largely alone and For longer than any other country and so the children the young people Well, not just the young people, but the people I was able to interview were young people at that time the generation of their parents had already passed away and but those were times that nobody would forget and so Literally everybody I interviewed had the most incredible heartbreaking but inspiring stories of things that they had witnessed and Truly every everyone growing up as a child in most of China at in those years grew up seeing dead bodies knowing people who had been killed or bayoneted or Terrible things and the children in Shanghai. There were so many beggars on the street that if a cold snap happened the next day there would be people who didn't make it and These kids would be told if you see a dead body on the street on your way to school Look the other way or walk the other way and so everybody all of these more than hundred people Had stories about that and you know much more than that but Then why the other three? What what brought you to finally say here? These are the ones whose stories will be immortalized in this book so Everybody had stories, but some had more than others. Some had amazing memories about The trajectory of their lives and so as I began to think about a book describing this this exodus Really, you know, we're talking about It's you know the 1949 revolution the liberation or the takeover of Shanghai However, you look at it and of China But really that's the story of modern China and so I actually start the book in 1937 and if I had had my way with my editor, which I would have started it in 1911 and 1912 Which was the fall of the Qing dynasty and the beginning of the Republic of China and But that was too much history for my editor a researcher Yeah, and and so I was looking for people I actually for the four people that I I did use I know their stories. I know their parents stories and I would have Started with their parents, but because that would have been a 800 page book We started in 1937 instead the the beginning of the Sino-Japan second Sino-Japanese war and World War II that Was the basis that led the collapse of the Republic of China was what led To the revolution that was why this exodus took place, but so I needed People who could carry, you know, tell me enough of their story that would carry me through now That we're talking about ten years there and then I also Didn't want to just stop there I wanted to talk about what happened to them because this was a an exodus and a diaspora people ended up going places and what happened to them when they left and so So that narrowed down the field quite a bit because not everybody had stories that could really carry me through there and And then also, you know the average age of the people I interviewed at the time that I was interviewing them was probably very late 70s or early 80s and that would have made them around 20 In their young 20s at the time of the revolution I interviewed people who were younger than that, but they had childhood memories and so that would be different you know the experience of a ten-year-old is different from the memory and the Reflections of an adult and I wish that the Somebody researchers had begun interviewing 20 30 years earlier than that But so so these four were people who Had incredible memories. I mean they had all of those details They could they could draw me a picture of the diagram of where they lived as a child and then the success of places They could tell me in great detail what happened to them and give me their emotional content, too I mean that's part of it. You know you're living through war. You're seeing terrible things Benny one of one of the four his father was a collaborator with the Japanese He was with the losing side his family and so you can imagine in Shanghai They lived that you know the they were part of the elite of Shanghai Society. They had every caviar age scotch, you know cigars Porcelains everything that could be looted from you know the Nationalists who fled they had and of course we know how that war ended and His father was on the losing side Benny's family ends up getting booted out his father ends up in prison and I at some point have to ask Benny What was it like visiting your father in prison a traitor to you know your country and And Benny well, he didn't tell me on my first visit with him He didn't tell me on my second third or fourth interview with him It was probably my fifth year of interviewing him and and that was another thing. They had to be patient with me They had to tolerate, you know and being be willing to share these things, but he told me I said, you know at some point. How did you feel about your father and he said he was my father? I loved my father, but I hated him too. I hated him for what he chose that destroyed our family and also was so harmful to China and so these were people who had those reflections I wanted to also have a range of people's experiences so So I had two boys and two girls because of course gender and living through war and revolution and fleeing is different from a you know a Female point of view and a male point of view that you know They all went through incredible hardship, but it's still a different perspective and different things happen to them I want you you brought up an interesting point that you talked about how Benny had lived with caviar and the life of of wealth and Privilege do you think or did it cross your mind as you were writing this book that you might receive criticism because you're profiling the stories of people who Who are in were considered or portrayed as an elite class of people and why would anyone care as part of history? I think there was even something that you said yourself in one passage about The young girls who left for Hong Kong to escape that they were there as pampered Shanghai princesses That's some some work right, but did you feel that there might be well? So of the four I really wanted to get a diversity of backgrounds to in terms of wealth and privilege So Benny was the privileged one his family My mother was an abandoned girl. She had nothing and the other two were somewhere in between Anwa whose family whose father was a nationalist Official he was a fighter for the Chinese resistance against Japan. He ended up They had almost no money when she was growing up too because they were always on the run hiding from the Japanese as well as that the Chinese collaborators like Benny's father and Ho was a family on the run from the countryside his family owned land They were a landlord family, but when they were in Shanghai, they also were part of the you know the people living under siege So it was a range and I really tried to find out How many people we were talking about because here you know this was an exodus at a time of revolution So it's not like there were a lot of records Shanghai was a city of six million people and so you know at that time It was only fewer the population was only less than New York City at the time and and of world cities It was one of the metropolises of the world It was it was an international city ranking with New York London Paris and Berlin and Shanghai and if you were an intellectual an adventurer You know a bon vivant of the world somebody like Albert Einstein or Charlie Chaplin or George Bernard Shaw You went to Shanghai if you wanted to know something about Asia It was the Paris of the Orient and so it had an extreme of wealth But it also had great poverty. I mean the vast majority of people in Shanghai were incredibly poor. It was also the the Industrial, you know city of China So there was a large working class to people who worked in the factories And so I tried to get a gauge of that but there was probably about 25 percent of the population of Shanghai Which would be about a million and a half people were either middle-class, you know teachers Entrepreneurs writers journalists so they weren't wealthy at the end, you know of that 25 percent the bulk were middle-class and there was a You know a thin layer of wealthy people But so I wanted to have a range and I did not want them to be you know the the Stereotypical way that people think about Shanghai people those rich Shanghai knees which is almost what the way people look at Shanghai people today Well part of the tragedy of this story too is that once the exodus occurred when they landed in strange places Different places with new cultures new languages new cities that they faced discrimination Because they were outsiders which I think you make the point then assimilation then into this new country is difficult for all immigrants they suddenly They're they're a lot in life no matter what it was changed again drastically and they were starting from the bottom Completely, I mean this is the thing about exodus exile refugees today we have a global refugee crisis, you know and and the The migrants who come to the border You know Walking a thousand miles with their babies in arms, you know are painted as though These are the lowest of the low the criminals who are coming to infect America. Well, you know what that was the way these Shanghai Exiles were viewed as well, you know and the whole thing about history is that migrants and refugees and immigrants at any time in any place are generally not welcome and The idea that they're all the lowest of the low the dregs of society Well, one of the things of my book is to is to track just how difficult the decision was how agonizing it was for Every one of these individuals families every one of the hundred plus people I interviewed this was not Like let's travel, you know in a fishing boat and maybe die along the way with our babies And let's just go and do it and then walk to Disneyland that some people today say right It wasn't like that at all and for the migrants today or anytime. It's a debate.  What will we do? How will we make a living if we only have enough money for four tickets and our family our extended family has dozens of people who goes and having to make that decision Was something that every one of the people I talked to had to decide Some of them they took their children and they said they sent them to four different countries We're talking earlier about that other people have had that experience to four different countries Why because one of them might survive and that's the same thing today at the southern border people don't go and carry their babies a thousand miles Unless they think if they stay their children will not survive childhood if they leave they might not either But they might have a chance and that's the chance that these Shanghai You know these were many of them were middle-class. They had careers. They had jobs. They had shops. They had Law practices some of them were presidents of universities others were Foot soldiers with the losing side and they all realized or feared that they would not survive And that their families would not and that's what drove them to to leave your book is Categorized as history of China, but it really sounds like you're saying that this could be a Lesson for us in modern day that you could be writing about Refugees from Syria or from Central America in this book. They could be the same characters What is what is the takeaway that you wanted people to look at here? Well, there are a few things one is that You know what if we don't learn from history We are doomed to repeat it and we are going through a time of crisis that actually, you know this period of time mid-century 20th century was one of the most tumultuous periods of modern day and You know there were refugees not only from China, but also all over, you know from all over the world and And since then, you know, this could have been there are there are books, you know Like the last helicopter out of Saigon or the last raft, you know Which there is no last raft now. They're still fleeing across the Mediterranean The last boat to leave You know Nazi Germany with with Jewish Holocaust, you know a people fleeing the Holocaust I mean the experience of people fleeing a Terrible You know a Terrible nightmare is similar in so many ways And so I tell the story through four people and their families And I hope that there will be a connection a human connection because we really are talking about well What would you do, you know if this was your family and we're here in San Francisco or the Bay Area And we have a life what would it take to make us get up and run with only What we could carry and not too much money because you weren't allowed to take that or people would stop you or what if the currency had no value and And all of those things what would it take for every one of us to do that? Well, so I try to show this issue for you know On a human level for every one of the people in my book so that you know, we might ask what what would we do and and from there Maybe to make a connection to the other people fleeing other other dangers today Is this the first book that's been written here in America in English on This chapter in history in China This is the only book in English anywhere not just in the US. Yeah Why has that been is it suppression from the Chinese government? Well, it's really the reluctance of as you said the people who survived all this to talk and to relive those memories I think it's a combination of many things first that People who survive terrible terrible times. They're not so anxious to share that right away and certainly not with their children I mean it is the experience for example of Holocaust survivors or or Families that experienced the incarceration of Japanese Americans during World War two that it might skip a generation before People are willing to talk about it. I mean my mother was in her 70s before I think she felt strong enough that she could actually Say and face possible judgment by other people She had no idea how I was gonna react by telling me or other people how they would react and and I think that's true for Any anybody who experiences such trauma and I actually think that The World War two generation really, you know, we should look at them and say, you know That was a generation that was the all Experiencing PTSD now we have a name for it, but you know Is it any wonder then I mean his now I think looking at the 1950s and you know, we say oh the 1950s We're such a a sort of quiet assimilationist kind of time for Everybody everybody just want to you know go to the suburbs if you can and just enjoy, you know hot dogs and Chevrolet and Baseball well, they had lived through a terrible time every one of them has bad memories of that And so one reason I think it took a long time is because people weren't so willing to just talk about this Right away of the hundreds of people I interviewed many of them were telling me a stranger What had happened to them for the first time ever and I would be listening to these stories and I'd say at some point that's Incredible do your children they're grown children. Do they know does your family know that this had happened and many times I like your mother exactly like my mother and many times some of them would just say No, I don't think they're so interested and I would say no, I think they'd be very interesting I hope you tell your children and I think it would have been that might have been my mother's reaction had I not asked her and and I think that's one lesson of this whole thing is You know if you got a response like my mother gave me keep asking, you know at some point They might be ready to tell the story, but so that was one thing another is that This is a pretty big exodus I mean, we don't know exactly how many people came from Shanghai But I'm guessing it was in the hundreds of thousands or even if you count those who passed through Shanghai as well In the millions if you look at the people who fled China overall, it was definitely in the many millions and So when I spoke to somebody in Hong Kong and I was telling them, you know, this is what I'm researching his reaction was like, oh The people who fled Shanghai with the revolution That's such a common story now Come comment because Hong Kong was one of the easiest places to get to relatively speaking The border was wide open up until 1949 Anybody who was Chinese could pass through Hong Kong without question after 1949 the British colonial government started imposing Ways of stopping people but up until that so a lot of people fled and and they could swim You know many swam across, you know to get to Hong Kong even if the British colonial government stopped them And so for people in Hong Kong and also Taiwan, it was like really what what's the big deal about this? Everybody knows people who had fled so that was another thing I mean in a way It was such a common story that people didn't think it needed to be recorded and then another thing I'll just say this is you talked about the Shanghai people You know some of you here, how many of you have a Shanghai background? Can I see oh a number of hands? Well, you'll know that people from Shanghai have a certain reputation Among Chinese and Chinese Americans, right? It's like.  They're perfectly capable of telling their own stories whether you want to hear it or not And so I think that was a reaction and and so, you know we're here in San Francisco with one of the oldest and most notable China towns in America and you know, of course, this was the guandong run the people from southern China You know from Hong Kong and and southern China who who first? you know settled made homes Carved out paved the way for other Chinese who followed and so among the The Cantonese people the guandong run they definitely have you know a very different culture than the Shanghai people and so when I interviewed people from Hong Kong about the Shanghai knees one of the things they would say is I like oh those Shanghai knees they take credit for everything and And and I'd ask them to explain a little more and they'd say well You know the thing is this a Shanghai person with one dollar acts as though they have a hundred dollars a guandong run a Hong Kong or with a hundred dollars acts like they have one dollar and so right there very very different attitude and So so when I wrote about the people who fled to Hong Kong There was such a culture clash and and also the Shanghai knees who ended up in China towns like San Francisco In in the United States there was also you know major culture clashes And there were marriages that came out of that too, but you know a lot of let's say a lot of sparks as well I have one other question, but Because the library is gonna close and we want time for people to say hello to you and to sign your books Um, how about a couple of questions? Do we have any otherwise? We could go on forever. Yeah Maureen There's a there's a mic coming your way. Hi, I'm Maureen I'm just wondering how did you decide what to leave out you referred to starting earlier your editor said no But but what else I don't mean people but subjects topics part of the journey. How did you choose? Well Maureen, thank you Maureen is a very dear friend and a noted journalist and she is writing a book herself a family story about Related to Shanghai and this time of as well So that's part of the painful part for writer right you can't make it a thousand page book and so Some of it is how you structure the story You know, I knew I wanted to start it at a certain point So finding the common points for the character So one reason I started it on August 13th 1937 was that was the day the Battle of Shanghai began And it began the next day with the bombing of the international settlement and the Bund How many of you have been to Shanghai and are familiar with the very famous Bund right the Waterfront buildings that look like they're a postcard from Europe and not from Shanghai. So this is a this was a common experience all of them And for those of you who have been to Shanghai the peace hotel and right there bombs Hit the top of the peace hotel then the Fairmont Hotel today and many many people died and by the racetrack Which is now people's park another series of bombs fell and 2,000 people died with that and so it was a watershed part point and so Part of it was just figuring out how to tell the story that would also bring in as many of the Individual stories that you know that could kind of carry the the story and I have Files and files of things like you know cut missing, you know You know the the cutting room floor just stories of people there were so many great stories And and one of my biggest regrets is that there were I Couldn't have everybody's stories in there and I tried but that was that was really part Deciding what the story arc was going to be and what fit in it and what didn't and it was hard. It was very hard Another question Did you find as the author that you needed to kind of fill in the blanks to keep the narrative moving? So Filling in the blanks was there were two parts to this book one was the individual stories of the of the the four main I call them characters, but they're real people The four main characters, but I also had a lot of I guess I would say cameos You know anecdotes from a lot of other people that helped move it forward But the other part that kept the story going was the history itself And so the filling in the blank I would say is describing what you know We all know December 7th Pearl Harbor Day as Americans, you know That stands out what that what happened in Honolulu, but in Asia across the international dateline It was December 8th. There were a multiple bombings that took place Throughout Asia including Hong Kong Shanghai, you know, many other cities Singapore that took place, you know, almost at the same time and so Being able to make those connections was really, you know The history was in many ways the glue that that you know between the two of them. There was no lack of ways I didn't feel that I had to be creative to fill in the blank because the Challenge was having too much to fill and and how to keep it compact so that it wouldn't bog down the readers. I Actually, may I may I just ask one other question just as a follow-up You mentioned you were in Hong Kong, and I know that you also recently went since the book was published to Shanghai and Beijing. Is your book even being sold there? And what was the reaction from people when you showed up? So kicked out obviously. No, I was a little worried Because You know the book's title is the last boat out of Shanghai the epic story of the Chinese who fled Mao's revolution Now when we came up with this title almost two years ago now You know US-China relations were in a different place than they are today and it really just to me was a description I think that was a little naive of me because Mao's revolution in China they perceive that as an American way of being you know criticizing China Mao's revolution You know that bad Mao well, you know I if they read my book they'll they'll know that you know This was actually much more of a criticism of the Guomandang the nationalists than of the the communists, but in any case I Did a book tour starting here in San Francisco went around to different studies in the in the different cities in the US But the book is about China so there were some book festivals literary festivals one was in Shanghai one in in Beijing and I thought well, I have to take it to China and so I got invited to you know Do book talks in Beijing? Shanghai and also Hong Kong and Then I found out that the Chinese government was not going to allow my book to be distributed in China which of course Creates a little problem right it's like oh I'm gonna get there and talk about my book and people aren't even gonna be able to Get it well weirdly and so I'll just let me just say that Leah my my spouse right here who was yeah, can you stand up Leah? Okay, she's frowning but But authors don't write books by themselves. They really need you know the support and Knowing that they have a home to go to you know after 12 years and things like that But so Leah and I went to to China with Creatively with more luggage than we normally would take let me just put it that way And because officially it was not a supposed to be and we weren't sure whether you know we get stopped at the immigration and customs, but we weren't and Anyway Two bookstores one in Beijing and one in Shanghai actually carried and sold the book They too Had creative means of getting it Anybody who has access to Amazon or some other online bookseller can get the e-book in China They haven't blocked that and they're perfectly capable of blocking it And so so the book was getting distributed and it and it still is but that was the reception and In Shanghai which was the place where the cultural revolution was the harshest I guess or Some might disagree with that but in any case in Shanghai They were the most nervous about my talking about this book And so one of the places they actually advertised it, but they changed the title to For young Shanghai people leave and go to America and so that became the title and You know other people said We'd like you to come and talk but could you talk about your first book about Asian-American dreams and not this book? So there's a little nervousness. I mean, it's a it's an anxious time in America But it's also an anxious time in places like China too and the the openness that once existed You can really feel is getting much narrower. And so that was true for my book and mine's not the only one May we conclude by having you just give us a quick list of some of the children of the Shanghai Immigrants because that's in your book, but I think it's a fascinating list. Oh So I took a stab at just Almost a random list of who I could think of but Amy Tan Maya Lin David Henry Huang Elaine Chao Who by the way sent me who is it? Secretary of transportation who sent me a note saying, you know that her family was part of this Shanghai diaspora and That's wonderful because I hope she can carry on the message where she is to say that You know what not all migrants are bad and Exiles and refugees should be welcomed that the way her family was I Steven Chu who was a secretary of energy under Barack Obama and a Nobel Prize winner a number of Nobelist scientists engineers financiers Philanthropists the list goes on and on and and that was just kind of a random list that I put together Chancellor Chang Lin Chen of UC Berkeley and You know so the thing about it is of this forgotten exodus and I guess I want to say that's another one of the takeaways from I Hope that comes out of this book It's not that they were the children of Shanghai exiles in particular why they were so notable Cory Yang For example as a child of this exodus and a number of other people here But it's not that it's the Shanghai connection or even the Chinese connection Which sometimes with this whole model minority thing people think oh, it's because they're Asian They're so such high achievers. No, it's because and study after study shows it's because they are the children of immigrants migrants and refugees who see what Sacrifices were made on behalf of you know, what they're what their parents went through so that they could have a safe harbor and so You know, whether it's Colin Powell or you know, Edwidge dandy kit or any number of other Carlos Santana, you know of of children of migrants from anywhere in the world That's where the achieve Achievement gene or pressure or whatever we call it comes from and so so we have a lot of Shanghai Achievers, you know people we can point to who are contributing to this American democracy But that's because they were given the opportunity to be here and to be able to raise their families Thank you, Helen Thanks to all of you. Thank you so much And I'm happy to say that Helen will be available at the table outside to sign your books Answer any questions and to thank you herself for coming But we are so happy that you all are able to join us tonight and thank you Helen and Sherry for being here Well, thanks to all of you. Thank you Sherry and thank you for and thank you library So and thank you all I am gonna be sitting out there You know if you brought books or you bought bought books either way I'm happy to sign them and and continue the conversation out there. So thank you so much