Welcome, everyone. I hope everyone is healthy and doing all right. Thank you to Future Tents for hosting us for this discussion today. Future Tents is a partnership of New America, Slate, and ASU. I'm thrilled to be joined today by Susan Thornton. Susan has a distinguished career as a diplomat, most recently as Deputy Assistant Secretary of State for East Asia. Now is at Yale Law School's Paltai China Center. For those of you who don't know me, I split my time between Yale where I'm a colleague of Susan's and as a cybersecurity policy fellow at New America. So I wanted to begin today for this discussion of how COVID will affect the U.S.-China relationship by rewinding to now what seems like another lifetime ago in January. The same week that we have the first official infection in the United States is also when the United States and China signed a trade agreement with China. And at the time, and we can debate whether or not this was substantive or not as far as agreements go, but at the time that trade agreement put a floor on what had been a deteriorating relationship for months and months. And now here we are over the weekend, Trump saying that China will have to pay the consequences if it's found to have deliberately spread the virus. So Susan, you've written recently in Barron's about this cycle of blame and mistrust, and you said that the level of suspicion and mistrust between China and the United States is currently so high that each side sees the others moves as deliberately aimed as undermining, damaging or usurping the others interests. Can you just tell us how did we get here and how is this level of mistrust manifesting in the current landscape today. Well hi Sam, it's great to see you over video again and great to be with all of you. This is a really obviously timely topic and it has been taking up a lot of airwaves and ink in recent weeks and I think what strikes me about US-China relations since the onset of this pandemic and what to me marks it as different than previous similar kinds of incidents in US-China relations is that it's the first time I've really seen something that can, I mean, let's be honest, we can consider this a natural disaster it's a disease outbreak we've been on the leading edge of disease outbreaks almost every year going back that I can remember, but it's the first time where the response to that kind of a crisis of a challenge has not really been met with a kind of humanitarian pouring on the part of certainly the United States toward China when this first happened but also I think on the part of the rest of the world that was very much kind of caught off guard and sort of ended up following I think a lot the of the United States. Normally when we have a pandemic outbreak or something like a natural disaster, you know, or even like the financial crisis in 2008-2009 the kind of automatic bodies, if you will, in the international community set forth and trying to come up with formulas for collaboration, lists of things to do, ways to, you know, help each other, phone calls to leaders, international organizations, etc. And I think it was probably a pretty big shock to Chinese, not only Chinese elites but also Chinese people to not feel at all a kind of outpouring of sort of helping hand sympathy, which they would have felt I think in previous outbreaks including in SARS in 2003. So you mentioned SARS in 2003 and you were actually in Chengdu living through that and working through that. Can you tell us what your observations were from being on the ground for SARS, both from the China side as in you know you've written about this that there were lessons learned China has improved and respond and its response reflects that in some ways. So from that vantage point, how does this compare to what you saw with SARS, both in China but also in terms of the US response and the channels between the US and China then and now. Yeah, well SARS was really the, the opening up of US China health cooperation so we had sort of normal channels of communication and cooperation through the WHO with China before SARS, but we didn't have big cooperative programs and this wasn't really something that the US CDC had a lot of around the world. But being in China for SARS, I have to say that the question surrounding what was going on really dragged on for months and months I mean, you know the timeline for discovery of the first outbreak was similar it was sometime around November in 2002 but but really there was no response no news no public response because the Chinese didn't probably know at first what was happening and then didn't and didn't actually let out any information for months and months so by the time in March when people started getting wind of something being wrong. And then the response on the part of official Americans to decide whether to evacuate, etc. This was all really drawn out compared to this time I mean the decisions on evacuating our consulate in Wuhan this time we're almost immediate. I have to say the Chinese response and this surveillance system that they set up in the wake of SARS obviously caught this much much much earlier than they did in 2003, but you also have to remember in 2003 we did not have the social media environment in China that you do now so there's just a lot more focus on everything that's happening. One of the most contested issues of course is the information availability of information and what was going on in the very early days of this crisis in China, and there are now these dueling narratives coming from the White House, coming from state media in China. Can you walk us through what are the different narratives of the origins. Does that even matter I mean when I look around the world at some of the countries that have had the most effective responses to the virus. They're not bogged down in in in this dueling narratives of where this originated right so I think that's a whole nother question that we need to get into but if we are to sort of look at. How do we know about what happened in the early days what's contested and how was that impacting where we are today in the pandemic response. Yeah I mean this is something that's very different about this pandemic outbreak from any other pandemic that we've experienced in my at least in my diplomatic career working on Ebola in Africa and MERS and Zika virus. People have not focused on, you know this extensive back and forth over how did it start where did it start and who's to blame.  In this case, you know what is basically going on from what I can tell is that the origins of the virus and and the initial handling of the outbreak have become contested in both Chinese domestic politics and US domestic politics. I mean let's face it, the virus is not China's fault and it's not Trump's fault but in both countries. There are people that are trying to make it one or the other of those two. You know, kind of actors faults and I mean it's it's kind of a distracting thing to be talking about I personally have read an awful lot about these various dueling narratives and beat not being a, a virologist or an epidemiologist I mean or a lab worker and having absolutely no technical background at all in any of this. I mean I really would not venture to say, you know, what was the origin of this virus but I do think that you know people are going to be looking at that and it's going to take an awfully long time to figure out the answer. In the meantime, the most important thing we should be doing is focusing on, as we say flattening that curve and addressing all of the challenges that come with it and I do fear that like in the early days of the outbreak when I think we were focused exactly on the wrong thing which was what was happening in China and not on what we're doing to get ready for when it comes here. I think we're again focusing on the wrong thing which is where did it originate and instead of trying to figure out where we go from here we need to be looking at the future now and at the past. And I, it's, it's scary to me to see the politicization of the origins story. Are there things that if we look at and you know I know you said I'm and you're not an epidemiologist or not in a lab, but you know that hasn't stopped anyone else from commenting on these. I know a lot of armchair experts out there. And so, you know, are there, recognizing that if we look at China's response to the pandemic, are there lessons at this point that we can take away the, the good and the bad I mean one thing that comes to mind that I've been focusing on has been, how do we think about the use of digital technologies across all political systems. We've seen digital technologies used for contact tracing for a range of pandemic responses and of course, there are a number of tradeoffs with those. The Chinese government very swiftly and at an unprecedented scale was able to tap into the vast amounts of mobile data that the internet platforms had and and use that to identify and contain infections. Now there are a lot of problems that come along with that and I think now in the US we're beginning to have that debate with the Google and Apple solution set to roll out in May which would be a sort of privacy protective contact tracing app. But this is coming from the private sector, which is a very different approach from a sort of array of government apps at the municipal and the city level in China. So digital technologies is one. Are there other areas that you think there are lessons to be learned and vice versa and the reason I get at this and we can talk about it in a moment is so far in the conversation. We've talked a lot about the government level, but there's an enormous amount of activity at the sub state level, but going on right now where medical experts and others that are not representing governments on either side are collaborating and exchanging information. And so can you comment on the sort of civil society sub state level. Where do you think there is benefit in terms of learning lessons from what China went through where we are now. Wow, it's a very hard question and I'm really actually anxious to hear your answer to the question about the contact tracing with phone apps because I was reading that in a poll they did in the UK two thirds of British citizens polled in that case. Said they would willingly give up their privacy if it would get them out from under lockdown and quarantine so that was a startlingly high number I thought but it just goes to show you I mean I'm certain I'm right now located in the state of Maine, where we have a little bit of less It seems like we have less cases less hospitalizations and other places and people it feels to me are really anxious to get back to going about their business and probably would agree to quite a bit of privacy. You know seating in order to get out of this lockdown and quarantine so I you know it's interesting to see what China did they obviously used a massive you know the massive amounts of data collected by their private sector tele Technology companies and appropriated that unto the government for the purposes of the national emergency. I think there are some other countries that did similar things and I didn't hear much of an outcry about privacy at the time it happened that people are starting to look at that now and I just wonder if people are starting to have regrets about it after the fact because they realize now that all that data is sitting somewhere or Is this something that people have just become kind of enured to and used to in certain in certain societies and possibly even in our society I mean I have to say I've been surprised at the degree to which it doesn't seem people are they would be willing to make this trade off now. Yeah, I think the key is that the governance structures have to come along with the technologies and that the, it's one thing to come up with sort of a, you know, a MIT approach or a Google Apple approach but without the governance piece of it. You know whether it's making sure these are deployed in lockstep or we're having the proper we have the proper guardrails in place around those trade offs. And that's something that I think was missed in the conversation about China's digital response is that the cyberspace administration of China China's top cyber regulator issue to notice on how to protect personal information in the fight against the pandemic. And obviously there are a lot of problems with this but they also are grappling with it and New America we did a translation my colleagues Graham Webster and others translated the CAC notice. And it talked about making sure that data was only used for public health purposes that it was used by public health agencies and it even which is very surprising it said public security authorities will face severe consequences for excessive collection of that information. And I think that sometimes that's missed in the conversation here where we assume it's a sort of data free for all in China. Now obviously there are a host of problems I mean one of these is, is there an actual mechanism in China to contest the you know the algorithmic based decision that's coming out. We heard reports of people's the app which basically is your key to get back into life in places like Beijing right now if you have a green sign on the app, you can go back on to the soccer field and play with your friends, but we heard reports of the light flickering from green to red, sort of without explanation Yuan Yang at the FT did an excellent report on this very issue. So it's unclear we don't know the algorithms that went into these apps, it's unclear what data sets are being combined so yes there is tremendous opportunity for abuse. But these are also issues that I think every government is going to is going to struggle with as they're doing that. I want to get back to the sort of the question of civil what civil society is is doing here and we've had conversations with our colleagues at Yale for instance about some really incredible grassroots initiatives where you have hospitals so Yale School of Public Health, the medical school have had dialogues with doctors in China and they're talking about things like what's the burn rate on your PPE, what are you doing about vent, ventilator shortages. And this is this is a glimmer of hope, I think in a really bleak time. To what extent do you think that the animosity at the government level is going to be a block on how effective some of these more sort of civil society, you know, whether it's universities or whether it's, you know, local governors that are that where that channel is still very much alive and not broken. Does it matter that we're in such an acrimonious environment, you know, at the highest levels of our governments, even as we see these glimmers of hope where do you see sort of the interplay between the two. Yeah, I think that is a crucial question and it's got a complicated answer. So we are basically in a war against an unseen enemy and we have linkages between our civil societies and our peoples that have been forged over years I mean Yale School of Public Health has had and Yale University in general has had a relationship with with Changsha and Hunan going back, you know, decades and decades and they built up a lot of close connections and so what's happening, it's kind of like the fog of war. In the fog of war you sort of turn to whatever channel you can to get what you need and that's what's happening people are calling their connections they're calling people they know they're setting up video chats with doctors and hospitals that they're connected to researchers that they've known. They're getting lots of information on patient treatment but there's also a lot of connections between business organizations trying to figure out how to manufacture more PPE and get it over here, people trying to ship things. And it's it's happening at a very sort of grassroots localized level that may not be the most efficient way for it to happen, but with the rush onset of a pandemic like this it's pretty natural. I do think that the acrimony at the national level is not helpful to try to facilitate and make this more efficient this kind of cooperation. And I think it's one of the lingering questions that has not really been satisfactorily in my view anyway addressed by all of the policy conversations about strategic competition with China, which is how do you have strategic competition with China and still leave space for cooperation and what you've seen is really the, the rhetoric of strategic competition leaves very little space actually for the goodwill of cooperation when when you need it and that was probably something that was, you know, kind of baked in an inevitable but a lot of people have not really thought it through sort of how, how do you preserve space for cooperation amid the animosity of strategic competition and I think we still haven't really gotten that figured out but you know I hope that we can through this crisis and one of the things I keep saying to people is, you know, a crisis like this. I think it was Winston Churchill that said never waste the opportunity of a good crisis because coming out of a crisis it's an opportunity to change a lot of things and make hard reforms because you know people have to do a lot of things in a crisis that they wouldn't normally maybe be able to push through a parliamentary body or something so you know we should be trying to use this opportunity to do some smart things in our diplomacy and also in our sort of structuring of society and I think this question is about data, just to make the linkage back to that I mean maybe we've been delaying on a discussion about what to do about a lot of these data questions it seems to me, we're pretty far behind other countries and you know maybe it could take something like this to move us forward I don't know what you think about that but I've been sort of looking and thinking about how all the ways in which this crisis is going to is going to bring about changes that we're not focusing on right now just because of the speed and enormity of the crisis. One of the things that commentators have been saying is that an effect of COVID is going to be accelerating the decline of US power and the rise of Chinese power in the international order. Do you buy that you know the I think there was a foreign affairs piece and it said it you know the current Campbell and Rush Doshi that international orders are declined gradually and then all at once and COVID is our sort of all at once moment. And you have Jack Moss sweeping in with millions of mass donations while doctors here are going to hardware stores and making their own. What what do you what do you make of this sort of ushering in a new international order argument. Yeah well I mean you know it's a natural thing for us to have a conversation about and I do understand why Kurt Campbell and Rush Doshi wrote their piece you can sort of see because I think we are in a moment of sort of transition in the international system so you can you can understand where they're coming from but I think that it's being overplayed and I mostly am saying that. I think they were speaking more from the position of what's going on in the US what I was sort of trying to hit at more directly was, you know from the standpoint of what China is doing I don't think it's that saleable and there's really two parts of that answer. The first is, you know what China is facing internally is in terms of sort of, you know, brittleness fragility and challenges that it's going to have going forward and if you you know just pay attention to what's going on in the sort of economic news these days I mean China's economy even though they were the, you know the first the first to come through the pandemic and the first to get their economy back open. They don't have any orders for a lot of those factories so guess what it turns out that they can try to go it alone and come out first and take a major first mover advantage but you know they really do depend on the rest of the world and that integration I mean globalization. No matter what people say is is here to stay and it still exists and so I think you know they have a lot of things that they're going to be facing coming out of the pandemic that's number one. And the second thing is China on the external state you know sort of the global stage. You know I think China has been trying to up its game in public diplomacy and outreach to other countries, trying to expand its influence, but you know so far these efforts have been pretty mixed in in this far as countries receptivity to their investors. And I think that is because a lot of countries see China's, you know, extensions of offers of investment or other things as pretty self interested. I see that China's sort of win win game that they talk about is really kind of win for China but it's not so clear that it's a win for the for the local country and it's a mixed picture for sure I mean some of what they're doing has been well saved and some of it less so but but I think they just don't have that soft power advantage that sort of they haven't learned enough yet about how to be a global power and I'm not sure that they're really ready for that yet. I want to remind our audience that you can submit questions, and we'll get to your questions in about 10 more minutes. Susan on this point about the soft power. You wrote in your Baron's piece about some of the lessons that China has learned and in particular looking at comments that have come out from former and existing Chinese officials, kind of evaluating their response. Can you can you tell us a bit about what you've what you concluded on that and sort of what you've seen the learning on the public diplomacy and use of social media side. Yeah, I mean I think what I was trying to say in the Baron's piece is that you know China is not is not probably going to be able to make as Kurt and Rush were saying this kind of sudden shift in the international order. But they do adapt and learn over time and we have to. We have to be sufficiently humble about about looking at what they're doing. You know we shouldn't be fearful of what that there's going to be some sudden takeover I don't think that that's what's going to happen but I think, you know, we should see that China learns and where it learns and we should make sure that we're doing our own learning so for example on this issue of soft power and public diplomacy. You know, I think that in general China's public diplomacy efforts, like I say have have been mixed and but they are, you know, and I know a lot of people who study this in great detail and it was a big focus in the State Department, looking at a lot of public diplomacy efforts in their effectiveness and the Chinese are getting better at this. You know we can make fun still of some of the more ham handed aspects of their propaganda or other things that they do that are not well received obviously counterproductive, but I do think that and based on you know this is a very incipient kind of commentary coming out from some of their diplomats talking about things that they need to do better, but just the fact that in the Chinese we now have people coming out and being able to say things like you know, while we maybe made some mistakes about the pandemic outbreak and and maybe we need to correct some aspects of our public diplomacy strategy and maybe we need to speak more authentically maybe we need to, you know, do a better job showing people what deeds we're performing as opposed to just using you know rhetoric, that kind of thing I mean I, I don't think it's there yet but it's moving in a direction that we should be mindful of is all I'm saying. And then how does the election in the US factor into all of this means we talked a lot about what's happening internally on the China side, I think there's also a lot of push and pull in Washington about how what this what this means going forward, and I didn't had a tweet earlier this week, where he said he sort of contested the narrative as put forward by the Trump administration, and sort of said, look, I if we look at statements coming back for the last few weeks when in the middle of touting the trade deal with China, I was being firm and I was saying we need transparency. Now is the time to sort of hold Beijing to account and what came to me reading that tweet was, as we head further into the election season we're going to see a sort of race to the bottom, in terms of who can be the toughest on China. Is that going to be enough. Does Biden have to do that, even if he thinks that a more constructive relationship with China might be. It might be something worth considering does he have to get into this race to the bottom on toughness element right now to win an election. I mean, I think, you know bashing China is always good politics in the US and clearly they've probably done some focus groups and maybe this played well I mean, I personally think that the average American really wants to hear that elections are not going to be one and lost on foreign policy in this country. I mean it's very very rare that a foreign policy issue is in any way salient in an election here. But I think on foreign policy what most Americans. They don't even know this is what they care about but I think this is what they care about they want to know what our national purposes in the world they want to know what the role is that the United States is supposed to play, and how the president that they're going to vote for is going to pursue getting that role for the United States and I think that's really the big question mark it really hasn't been resolved since the end of the cold war and the collapse of the Soviet Union we've kind of been struggling with it for the last several decades I think and the American people are just pretty unsatisfied with the answers that they've been given so far I think and so for right now I mean the purpose of the United States in the world according to the two seems to be to confront China every turn and make sure that we, you know, can compete with China, and, you know, for whatever efforts people think there may be for China to become a dominant force in the world. I don't know if the average American thinks that that's what our purpose should be in the world but it doesn't sound like a very compelling purpose to me and the argument that I've made is that basically and this is basically, you know, kind of demonstrated by this pandemic outbreak is that all of the big challenges facing our country in the future are not going to come from a single nation state no matter how large it is and how dynamic it is and how aggressive it is it's going to come from these kind of formidable transnational challenges and that we're going to need to band together with other countries, maybe China maybe not China but at least other countries to to confront these challenges. So I hope I hope that they would turn to that but so far it hasn't happened Sam so I'm waiting. The thing that's been really troubling to me and I've talked with a lot of colleagues about is the idea that the Communist Party of China poses this existential threat. And yet, where's climate change in that conversation. Right, and I'm not an expert on climate change I don't want to get too much into that in fact if you want to learn more about China and climate change and the US I want to make a plug for tomorrow New America is holding another event from 330 to 5pm, called COVID climate and China, and it's going to be actually a launch for what's a two year in the making report so please tune into that great event by my colleagues, because this question of transnational threats things that don't map onto political borders when we talked about data and technologies again border agnostic viruses climate change I think these are much bigger than the current moment. I want to open it up to some questions from the audience now. The first question is about the tariffs. The second question is, did the tariff war give China less of an incentive to cooperate with the United States on coven. Well, the short answer to that question I think would have to be yes. This is basically the tariff war was the beginning of the real downward spiral in the US China relationship remember when President Trump first came into office off his very heavy handed negative China campaign during the presidential election campaign. He actually turned to China to try to help solve the North Korea problem. And he worked on that problem with China in quite a cooperative forward leaning way for the first probably year of his administration. Only in the spring of 2018 did he decide to then lower the boom on China on tariffs and I think it's really since you know that time that US China relations have gotten progressively worse. We did you mentioned have the trade agreement the phase one trade agreement in January which I think most people thought was going to give us a pause in that downward spiral. We may well have if we would have been able to not have this pandemic follow right immediately on the heels of it. But I think, certainly the tariff war was to be it wasn't just the tariff war because there are a lot of other areas in which the US and China have had the serious kind of cascade of frictions added on to the tariff war. So, but the tariff war and the, and many of the sort of associated economic actions have really done a number on the atmosphere between the two countries which I don't think we can say it's completely stopped cooperation on coven but certainly makes the Chinese much less inclined to put the US first in line for cooperative efforts on the pandemic. There's certain medical items that are still that still have tariffs on them. Yes, many. Is there any movement to lift those tariffs right now. I think people have been calling for it people on the outside but I understand the president has declared that he is not intending to lift those tariffs. I'm not, I'm not sure what the rationale is there. It could be. I mean, there are a lot of calls now for bringing supply chains for medical equipment medical supplies back to the US so I have a feeling it's been kind of lumped in with those conversations as well. And also I understand that president noted how much money we're making off the tariffs. He doesn't want to give that up so I'm not sure you know I know that some PPE items even still have tariffs on. Second question. How does the pandemic crisis effect effect the Shanghai cooperation organization and the one belt one road initiative. Oh, great question. Well the Shanghai cooperation organization will probably not be that much effective because it's a fairly you know security focused and very high level kind of loose grouping of countries it's a more ceremonial I think type of organization that doesn't have a lot of you know day to day impact but the belt and road initiative I think probably will be affected by the pandemic it's very hard to see at this point, exactly how it will be affected. Because we don't really know the extent of how the pandemic is going to hit develop the developing worlds yet. I think we're at the leading edge of that possibly and people are quite worried about what might happen in the developing world. And a lot of those countries are areas where China has made big investments under the belt and road initiative but also just under its overarching development aid and lending programs. So I think probably with the economic struggles that are going to be coming. China is going to have to I think they made an announcement last week that they would suspend payments on certain bilateral debts for this year. Those are probably going to have to be extended into next year. China is going to have less money to spend on some of this it's Belt and Road investments. China was planning already I think to sort of recalibrate the Belt and Road and probably, I mean they talked a lot about going for more quality projects which is an indicator that they were going to be scaling back. So I think, you know, we can look at the Belt and Road is coming under some physical pressures for sure in the coming years and then how the developing country targets will deal with that is going to be an open question I think. So the next question is about Taiwan. Are we going to see heightened tensions in the Taiwan Straits is the divisiveness of the moment going to increase the chances of some kind of crisis there. Well I certainly hope not and I do think that there are tensions across the Taiwan Strait right now there have been tensions. But I hope that right now everyone's focus is on fighting this pandemic and also on resuscitating our economies so we really don't need to have another crisis on top of those two very huge global crises. So I do regret the lack of communication across the straight there's almost no official communication. It should be the case that this pandemic provides an opportunity for some more communication across the straight actually and maybe some trust building even. And I don't, I think there have been some slight indicators of that there were some humanitarian charter flights back and forth from the mainland to Taiwan that necessitated some official coordination which is a good sign. You know there's been some Taiwan participation in some health colloquia related to the pandemic. But probably will not result in Taiwan's being able to participate in the World Health Assembly in May, which is something that I think a lot of people think would be a good thing if it happened. So there have been a lot more military activities. You know around the island and I definitely think that those should be very much rained in and constrained especially during this period of crisis where everyone's trying to focus on, you know just getting things back into into the normal swing of things but I am watching it very carefully. So this next question gets us back to trying to trace what actually happened in those crucial early days, and I think this will help you with this one right Sam. Exactly. And, but I think it's important because it gets at the public health relationship between the US and China. The question is, according to media reports, China's CDC informed the US in early January that there's a novel virus spreading in Wuhan. The director of China CDC called the US CDC several times to share the information from January to February. Why did China turn down the request from the US CDC sending American experts to Wuhan. So it used to be the case that we had about 45 American and local Chinese staff paid for by the CDC working with the Chinese CDC. And that started, like I said, after the 2003 SARS outbreak and we had American CDC staff working in the Chinese CDC offices in their building with them right alongside. The relationships that you can build up through that kind of day in day out cooperation examining sort of virus samples, talking about installing and setting up a surveillance network is is pretty I mean those are very close relationships and so you know that really stood us in good stead for a good number of years. Unfortunately that cooperation was all wound down starting in 2016 and up through 2018 basically was all rolled back or eliminated the MOU for cooperation between the CDC's was not renewed in 2018. So basically we went down to kind of a skeleton crew. I'm not sure you know how the communications were made with the Chinese CDC about all of that draw down, but you know it's not a it's not a warm fuzzy signal that you're sending if you're just basically curtailing cooperation. So I can imagine that you know there may have been some hard feelings I don't know that for a fact, but it wasn't obviously enough of a rupture or problem to prevent the head of the CDC from calling our head of the CDC on his vacation, you know, New Year's a couple days after New Year's to tell them about their concerns. I think that what you have to understand about hosting a visit of foreigners to Wuhan in the middle of a crisis is that the request to have a US delegation was probably not it wasn't on the high priority of the Chinese who were trying to deal with the epidemic at the time. It's a it's a big investment of resources to deal with a delegation like that and they probably to some extent felt they did not have the resources to deal with it. They also probably were not particularly friendly to an US only delegation at that point is what I imagine. And I think that's probably what happened the US did get team members on to the WHO team, which went in mid January so we did have representation on the WA the first WHO team that got in maybe it was in early February. But, but so it wasn't that they weren't, you know, accepting American help or American input or American representatives but they weren't going to go out of their way, I think to help us. This is another Taiwan question. The numbers coming out of Taiwan are phenomenal, even baseball going forward safely. Any particular aspects of Taiwan's response that you to think other countries should heed regarding information transparency open data civil society government collaboration, etc. Yeah, again, I'm not I'm not on the medical side so it's very hard for me to judge what anyone else from pontificate right and what everyone thought that Singapore did a brilliant job and now I understand they're having a very tough time of it again so it's it's very hard for I don't understand this disease I don't understand how half the people can have no symptoms there's so many things I don't understand and I think so far nobody has really understood or at least in a way that could be explained to me so I do think obviously Taiwan's done a great job so far. One, a couple things that I would note with respect to Taiwan's maybe unique positioning in this crisis. Taiwan knows very well. The Chinese sort of systems. I mean they speak the same language, they, they, they communicate, you know, and follow each other's news feeds, etc, and the Taiwan's got wind very early that something was going on in Wuhan and probably picked up on it more astutely than others did. And probably, you know, remembering the experience with SARS because they were very involved with that, and other disease outbreaks, you know, got themselves into gear very early and very efficiently and I think that that probably helped them but I again I don't really know. I do remember from my last trip to Taiwan. This was during, was it MERS or what no this was the swine flu the African swine flu that was that was making the rounds last year. So Taiwan has a very effective screening system set up at their airport where they screen everybody coming into the country for at that time it was African swine flu. And they, and so they seem to have a kind of a systemic setup for dealing with this screening incoming passengers for various potential problems. And, and I think that probably also helped them because it seemed like it was kind of a permanent installation there at the airport. So without getting too bogged down in this, I just think it's worth talking about the story that's going around about the Wuhan lab. And the idea that this may have come from that lab, because there is now I think on sort of not just from the Trump White House but we're starting to see other experts sort of ask, is it possible that it came from that lab. And then on the other side, we have a question from one of our audience members specifically about the Chinese Foreign Ministry claim that the US Army brought COVID and the disinformation campaign around that. I know that one of the things that in in the in Josh Rogan's piece for example in the Washington Post which sort of lays out this argument for the virus coming from the Wuhan lab. One of the things he talks about is that he's reviewed these secret cables and that you had years prior cables talking about security problems at the lab. Now, as I feel like we're so lucky to have you here because you've been involved on the inside of some of these things. Can you give us your perspective on that narrative, given the fact that none of us have been able to review these cables. But what's what is your take on that on that narrative. Red herring. Um, so, you know, it's, it's really unfortunate this whole thing and I just think we're using up so many resources and so much brainpower on talking about something that is literally I mean it's it's not important at all in the context of what we're facing right now and we should move on to other things but I'll address the issue about the cable because I mean we had and have extensive amounts of medical research collaborations with institutions in China. And we want to have those because China is the basic Petri dish of the world, a lot of diseases emanate from China and so we want people to be studying these, you know, all kinds of different medical aspects, you know cancer I mean we want to get their data, the China study was one of the foundational things for health in this country so I mean this is a good thing that China is doing cutting edge health research. So when there's a collaboration people from the embassy if institution is getting us funding, you know, we have a science team at the embassy, one of the things they do is they go around and visit places where we have collaboration so they would have made a trip it's a very routine thing to go to this lab be shown around by people talk about what they're doing, make an evaluation of you know what they're doing with the money and then recommend whether or not they should get more money you know less money or how it's going. So it's a very it's not a see I'm sure the cable was unclassified. I haven't seen it. So I don't know but I, these kinds of reports on these kinds of visits would normally not be classified or secret. I don't know where Josh Rogan got it from, but I can imagine that someone found it. And, you know, it was mentioning this lab so it seemed germane but but this kind of report is very routine I don't know what kind of safety things they would have identified but you can imagine that a lab that's being constructed, and that is a level more bio lab like this one was that there's a lot of safety protocols that need to be put in place and they need funding for that and so they thought this would be a good idea to fund additional safety. It sounded to me like a pretty routine kind of visit to a to a lab. So I'm not sure that it implicates or has any implications for the current discussion. I mean I just think that the overwhelming conclusions of many scientists has been that it's much more likely that it's just a naturally occurring phenomenon as most of these questions are and why we would be chasing this theory in the absence of any evidence that this might be the possible origin. You know it's kind of distracting and not a good use of our energy right now, we should be sewing masks instead. Next question talks about the proposed legislation to allow Americans and local governments to sue China. What do you think this is about what's your take on this does this have legs. Well, I mean as a foreign service officer I am I am adamantly opposed to legislation that that lifts, you know, the foreign sovereign immunity of foreign states, I mean, and I was opposed to the Saudi legislation as well, because I mean this is the basis of the entire international system that states have sovereignty that they governments in states act on those states behalf. You know the idea that that you can blame the Chinese government for the death of a loved one that died of a disease in a hospital in the United States, and then through a series of actions in courts in the United States, end up being able to use Chinese government assets in the United States which is what can end up happening in these cases. It kind of just, it will start a domino effect around the world that I don't think anyone wants to really see and it's going to be very destabilizing to the to the entire sort of international legal system and international economic system for that matter so I really don't think it's a good idea. I understand that people who lose loved ones are are grieving and they would like to blame someone and we live in a very litigious society and you know I wish that there was, you know, a better a better outcome for them but I don't think, you know, passing a law that has to attach state assets for lawsuits over things that you know in this case I mean I don't think you can make the case that the Chinese government and you know was knowingly complicit in anything having to do with this outbreak. Time is almost up. Thank you so much Susan your perspective working on these issues on the ground for many years and China has been invaluable. And I hope for the sake of humanity that we can move past this current time. We keep focusing on the fact that we have networks of ER doctors in the US. We chat group with counterparts doctors in China talking on a very tactical level about how to get through this so in these dark times I'm focusing on that right now. Yes, the people to people video connection is key and I'm glad to have all of you with us today and to be able to connect at least in this way if we can't connect that side of our houses so it's great to see you Sam and everyone else who's with us and I hope they find it useful and if anyone has questions I hope they'll find a way to to get them through. Thanks very much for joining us everyone.


Russia lost Murom, surveillance complex, two radar stations in southern Ukraine. The Defence Forces of Ukraine destroyed a Russian Murom-M video surveillance complex and two Aistionuk radar stations in southern Ukraine. The Defence Force of Ukraine's South reported this on Telegram. In the past day, the enemy suffered the following losses. 15 occupants, one cannon, one mortar, two Aistionuk radar stations, one vehicle, the post says. An enemy Murom-M video surveillance complex was also destroyed. According to the military, the system can see a person at 10km with a camera and at 4km with a thermal imager. The complex is supplied by the Russian Steelsoft developer and manufacturer of integrated security systems, special equipment and unmanned aerial vehicles. The Murom-P Autonomous Mobile Surveillance System is deploying rapidly. It is designed for round-the-clock remote video surveillance, monitoring and protecting of open areas, approaches, perimeters and routes to objects. The mobility of the system is ensured by the fast-mounting, collapsible design of the components of the product. The system can be deployed on-site in two hours with a crew of three people. Special cases are used to pack and transport the components of the system.


Photofrin is a sensitizer used in photodynamic therapy, PDT, to treat cancer and skin diseases. Since its approval in the 1990s, various dye sensitizers have been developed, with porphyrinid derivatives being the most successful in producing requisite singlet oxygen. Other porphyrinid compounds approved by US FDA include benzo-porphyrin derivative monoacid ring A, BPDMA, metatetra, hydroxyphenol, chlorine, and THPC, enospartylchlorine E6, and PE6, and precursors to endogenous protoporphyrin 9, PPIX1, 5-aminolevelynic acid, ALA, methylamenolevelynate, ML, hexamenolevelynate, HAL. While no non-porphyrin sensitizer has been approved for PDT applications, entroquinone, phenothizine, xanthine, cyanine, and curcuminid sensitizers are under consideration and some are being evaluated in clinical trials. This article was authored by Harold S. Freeman and Alexander B. Ormond. We are article.tv, links in the description below.


Okay, so today we've got Christopher Wade presenting on Beyond Root, custom firmware for embedded mobile chipsets, so thank you for joining us, Christopher, and I'll let you do any opening remarks and then we'll go right into the questions. Excellent. Hello Ron, thank you for coming to my talk. Yeah, that's pretty much all I can say, thank you very much. Could you tell us a little bit about yourself and just like a quick intro summary for your talk? Yep, so quick introduction. This talk is mainly about custom firmware for embedded mobile chipsets. This is essentially me hacking chips inside my phone which aren't the core ARM chip used to run the thing in order to make it do different things from hardware. In particular for this talk it's going to be NFC chips. So I reverse engineer the firmware of an NFC chip, break the signature checking, and then implement my own firmware on to it. Excellent. Great. So we have one question already queued up. So how did Samsung react to the disclosure of vulnerabilities? Yeah, so Samsung reacted very positively, so I submitted it to their mobile security team initially, and they accepted it even though it was technically part of their Samsung semiconductor team. So I sent them the disclosure and they glazed with their, you know, interdepartmental systems or whichever. And initially, because I submitted the Samsung S6 when I brought it here, they said that this wasn't really something they were going to remediate just because it was out of scope. The Samsung S6 is no longer supported. But when I submitted the Samsung S9, they happily took it and signed their remediation process, which was pretty good. And chips that have been manufactured, I believe you said, after April aren't vulnerable to this? Yes. So what they've done is essentially, while they can't really patch the bootloaders of existing chips once they've already been manufactured as outlined in the talk, what I have done is discuss with them about how they're going to remediate this. And what they said was they're going to remediate all of the chips of the current versions in the manufacturing line. So all of the bootloaders are going to be patched as chips go out from now onwards. However, all historical chips will still be affected. So that's why I decided to make the custom firmware for them. They'll still have the vulnerable bootloader. Yes, exactly. Which is very useful. So near the end of the talk, there was a problem with a parity bit. Did you ever get that worked out? Yes, so the parity bit was an interesting one. What they tended to do in the initial firmware or the firmware of reverse engineering is load all their 8-bit buffers as they should into the 8-bit buffer and hardware registers. This is done because that way the hardware itself can pick up the stack with the set and the set bits which are done to calculate parity between each set of bytes to the send. What I did was find a very specific hardware address and a very specific bit in that hardware address to set which let me essentially control that parity bit. What this meant was I set up 9-bit values so that includes the 8 bits of the byte followed by the 1-bit parity bit which you've been encrypted and that starts the process. And that sort of like bitshift everything around by one on each part because the buffer was 8 bits. But I had 9-bit space to check and so essentially I just had the bitshift around which was a bit strange for teamwork. Did you get like an NFC tag cloning working? Yes, so what I ended up doing in the end was literally being able to read an NFC tag using the standard reader applications that existed and use my tool to upload binary data through the IDC interface I had. So I could set each block of the data of the NFC tag as I wanted to, including the UID, the write and read bits, etc. All parts that I could upload and download as needed. And I also hooked into the IDC interface so that every time some reader wrote to the tag as well and authenticated properly, it would then also write that binary IDC so I could modify the binary file I had. This was meaning things like access control systems and things. I would be able to keep a check of what was going on. So some access control systems had a lot to do with how many things had been read and some other parameter information to make sure that no tags had been cloned or reused. And yeah, I basically did that so that I could clone the tags while also allowing the data to be modified persistently even if I stopped going to be faster. And this was quite useful in the end. That's great. Did I get any questions? Yeah, so I'm not on the track yet, but I did notice that your talk was mostly a tutorial on reverse engineering. I think it seemed like you were starting out because you were curious about the NFS MFC firmware and wanted to take a whack at customizing it. Am I catching your motive correctly? Yeah, so that is essentially how I started to know what really started this off for. So I had an old something that we started at the talk which I was essentially using to just mess around with different custom runs on. One of the things I did was walk Debian into this. So I scraped a pool of the Android operating system and shoved the end Debian root file system into place. So instead of having it as a true design line at the talk, it was more of a full operating system on the device. Now this afforded quite a lot of functionality but it also meant that the screen didn't work so well. I quite enjoyed this so I was going to have some sort of hacking tools, modifying USB and things so that I could use gadgets, FSS, etc. But I thought it would be interesting to see where I could push things like the NFC side. So I redeployed LinearJOS to something at Sixphone which is a very standard custom ROM root set and then started looking at the NFC chip and that sort of weather project sprung up from there. So it started off as more of a standard custom ROM project than it started off as a standard reverse engineering project because I like reverse engineering. It sort of went on from there. It sort of slid into it. Yeah, that happens. So have you looked at any other chips inside of phones? This seems like a really deep and hyper-specific like long chain that you went through to patch in this functionality. Yes, unfortunately due to a responsible disclosure, I can't discuss those at the moment. Fair enough. I'm very sorry about that. So maybe I'll sort of ask around this. The first one and like you've just been able to successfully responsible disclose this one or like what has your experience in the past led you that brought you to like this kind of point? Yeah, so this is definitely the first one. So I like my supposed to be have a habit of rooting our last phone that we're using, not our current phone because walking around with the rooted phone is not the best idea. So I had a lot of older phones and then I'd got something at Six for a few years and then replaced it with a new phone and just had it lying around. So the first thing that was rooted and then start looking at seeing what I'm doing. I also looked at a few older phones at the same time. So for instance, I had a very old Samsung Galaxy Mini which has FM radio capabilities based on a Broadcom chip set. Now that was very interesting. I was looking at that a bit because it didn't seem to have any code signing with some of the binary files on there. It looked like it wasn't just an FM radio receiver but also a transceiver. So I wanted to see if I could push it into doing FM transceiving. Sadly, that didn't really go anywhere because quite frankly, working on old Android versions like that is incredibly tedious. They don't always use device file appropriately and they often route their circuitry around in ways that just, it doesn't work very well by comparison to more modern phones where everything's laid out, everything's documented, everything's open source in really nice ways. That's super unfortunate. I do remember some like really old like phone hacks that like they were, I think they were actually MP3 player hacks that you could turn them into FM transmitters. Yeah, that would be cool to get your phone to do it too. Sadly, I'm stuck to the Raspberry Pi with a wire sticking out of one of the pins at the moment which is fair enough. Is there any other active products that you're working on that you can talk about? Yeah, so I'm still looking at different phone chips. I've been looking around to see other NFC chips that I use. There's only a handful of manufacturers and that's something I'm looking into but the big problem there is obviously price point because phones are expensive things and it's not something you want to buy randomly. The key thing I've been looking at is downloading custom ROMs for random phones that I thought would be interesting not just for NFC chips but other firmware binaries because if you download the ROMs and unpack them then you can find quite a lot of information about the hardware that you wouldn't be able to get just from a tear down, for instance, if you go in the vendor partition there's all sorts of firmware blobs for things like Wi-Fi chips, et cetera and that's where it led me to things like so I've got a Xiaomi Mi Note 3 which is an old phone and while this isn't necessarily a firmware hack being able to echo a single number into the SIS files and turn that into a monitor mode phone is very powerful like full-on passive monitor mode no injection but still full-on monochrome that works really effectively. Things like that is just something I keep looking through and looking through as much as I can because it's quite fun to mess around with phones in that way. That's awesome. So part of your project you used I believe it was called the Unicorn Engine for hardware emulation like what level of emulation is actually happening there? Is it just like the CPU? How does it handle peripherals and stuff? Okay, yes. So the Unicorn Engine is a really powerful tool and I've seen a few talks on this by the people who've actually developed it. I'm sure it was at Defconn as well. It's a library that's purely used for loading into other things. Now I always write my stuff in C so I load it into C. All it does is emulate the core architecture you want to go for. So in my case it was ARM thumb. Then it lets you map out memory mappings you want so in order to write and read memory to start things up and then you can hook both function calls or sorry, operations and reads and writes the memory. So when you hook into operations you can make them act in weird ways. For instance, one of the problems I had with my hardware was it would sometimes hit the wait for interrupt operation which wasn't supported by Unicorn and I could override that just to a standard knob because I didn't need to think about it. But hooking into the memory reads and writes was really key for me because I can map out to say there's actually hardware addresses at certain points. I could then just put an if statement a switch statement and just say if it hits this address mess with it in this way for instance in the I2C interface it was when it hits the I2C status buffer I wanted to return random data so it eventually hits the okay status or sometimes the busy status and then when it hits the read and writes I wanted it to you know read and date so I was writing to it the physical chip and then write data back when it was the physical chip which is how I got that initial fuzzing working so it's really powerful for that but it has no integration for actual realistic hardware just the processing as it's going on so just the core operations which is really cool. You can write like basically functions that are at those memory addresses just to pretend to be that hardware right? Yeah, so you can literally set R0, R1, R2 you know the command and then the program counter and say and you can also set the address to tell it to finish they can stick that at the end of the function and that way you'll run through the function call the functions it needs to but also then stop when it's ready and you'll then be able to read out memory as you want so for instance what I wanted to do before I started up part of the project I didn't really mention was I start off emulating the actual firmware binary that I had rather than the bootloader and what it was load that in and let it run so that I could set up all the hardware addresses I needed so RAM etc to see how that was laid out so I could see anything because you can let it start and then let it stop and then dump the memory out as you need to without really any problems. Cool, that's actually really really slick. It's really powerful, yeah. So how do you like go about making the jump from these accessing like a particular hardware address to saying okay this is an I2C like external peripheral like how do I enter and make that inference? Well it was definitely inference I was pretty much guessing when it came down to it so what I was doing was I'll go step by step with what I did because it was pretty much as I outlined in the talk it hit that first address and which just keep looping and reading and doing a few other operations before jumping back to the start where it read that address again and I already knew that that was the correct hardware address because it was at 400000 which is all the hardware addresses are so as it was reading it was literally some code compiles too often is shifting values down to hit a certain bit to check them and I thought okay so it's probably you checking the certain bits in some sort of order and so I just randomised that and then it started trying to read in bytes and was loading them into a buffer in RAM and I could see this in the emulation and I thought if what happens if I start writing my code into it? So I started writing different operations in and there was sort of a staggered approach where because I didn't have interrupts I think but for some reason it wouldn't respond right away so I gave it a whole list of commands I wanted to run and then it had like three of them and then it would start pumping out the responses so eventually that worked really nicely so it was quite cool in the end really That is really what it's like Yeah but it's all assumption essentially it's all guessing, it's all guesswork and eventually it gets that And I imagine that like interacting with those pieces of hardware might allow you to say like okay this is a this is clearly a memory buffer that's being shared with something else that can't be experienced will just help you kind of thing Yeah and I sort of stepped through some of the parts of the code so I stepped through because there was that infinite loop that started which was constantly reading and I jumped into there and a few functions in and that's where I found the state machine of command 0, 1, 2 and 6 which were the first commands that the chip would like see at the start of a firmware update so 0 was a reset, 1 was get some version information and 2 was start sending the show on hash and the signature and then command 6 was the secret one which was the firmware I wanted which was the the file that existed was quite surprising at the time Yeah but I mean it worked out just like being able to find that so if you didn't have that command you briefly mentioned about like doing that kind of reversing blind you already had the previous version you were able to use the knowledge you gained from that first stage to attack the later on chip if you wanted to go about doing something like this would it be just an enormous amount more effort or is it just not possible? It probably would have been an enormous amount more effort yes because I had that bootloader to emulate and I could make assumptions about the two size values it made it a lot simpler now it wasn't the full process but it was helpful enough but the blind part was very simple in the end because the bootloader had changed just enough that I could guess anyway so I could make inferences about where I had overwritten the stack and overwritten the memory to have different kinds of responses over the I2C bus because I could get the size of the stack I could overwrite it always whatever addresses I wanted because eventually one of those would be the link register and when it jumped in I literally just would have jumped through them in the same way essentially but it would have been a lot more difficult to find the initial vulnerability I think Fair enough you could then so you could potentially use your custom firmware function to reimplement that kind of memory dumping though like by jumping into that and then dumping everything back out to get the updated firmware version yes so that's exactly what I did and so that was my first port of call when I started making the custom firmware I was adding arbitrary reads to the core firmware so instead of it being in the bootloader I made my own custom firmware capable of doing that and it was a few steps so I had to essentially find an I2C function I wanted to mess with that worked via NCI and then modify that so I could send NCI responses with whatever I wanted and override those functions so it was a sort of good jumping off point and then I could modify my exploit to not load data from random addresses to start off the exploit which was a bit scary when I actually saw what was working in the exploit in the live version so we got a question from the channel when starting your research weren't you afraid to find old vulnerabilities on your chip that were already patched since you started on an old phone yes so I thought it would have been patched to be honest so I started with something a 6 and I wasn't really doing it from a security perspective it's more of a reverse engineering thing that's fun but because they told me they weren't going to patch it because it was so old which was valid I thought I don't think anyone's ever bothered looking at something so innocuous as an NFC chip on a phone so I thought if I bought a later phone which I was in the market for at the time anyway I'd be able to find something just the same and I did which was excellent and it meant that because there was the firmware of different chip versions between the two as well this is just the latest version it was likely that all the ones in between were also vulnerable to the same thing it wasn't just a one-to-one comparison which was quite cool do you know if Samsung took the approach that all those middle versions were likely vulnerable as well and they're only going to be releasing the updated version of this point I don't know a huge amount but I do know which chips are in which phones so I can assume the ones that are supported by them are going to be updated more than I think they do seem very good about it actually in these things cool so we got a sort of a comment from someone in the channel I really want to understand firmware and boot much more in depth looking for the more established projects can be somewhat overwhelming should I just grab a pine phone or pine time and ticker around old think pads what kind of more entry level paths you suggest to learn more okay yeah excellent so it very much depends on which path you want to go through if you want to learn into custom ROMs and things on phones and modifying phones in that manner then yes something more like a standard Android device like a pixel or something which has the capabilities of custom ROMs and OEM unlocking is the best port of call you can mess with the operating system as you want to learn a lot there's a lot of tutorials that people have for things like compiling things like linux os which are can be modified in certain ways for instance you can unpack the zip files of some of the custom ROMs and then just modify the boot script and things as you want or add your own things into the system image you cannot add these things that's sort of it's kind of a big question on that side if you're looking at learning how to reverse engineer much more the chips things like the NFC chip you should start looking at chipsets like the STM32 these are the probably the most used Cortex M and armed embedded chipsets around there's huge numbers of very cheap development boards for them and you can write code for them using free tools there's also tools like the STM32 cube which allows you to set specific pins and configurations you can create your own USB device acts the mouse whatever in minutes using some of these tools and just deploy them to the phone and that's where you would go if you wanted to start learning about how to develop firmware for these things to reverse engineer them all you need to do is take those binaries and look at how they work more than anything chuck them in IDRA or RADAR or you know GEDRA or whichever one you like and start looking around them there's a huge number of really good tutorials about how to do this but mostly all I can say is just dive in and try things and if you get frustrated too much then you're probably going the right way with it because reverse engineering is a pain I mean I don't want to tell you how hard it was to find all the addresses and things in the firmware that I reverse engineered for this project it took days and days and days for some of them especially when it came to things like a lot of the functionality was based on interrupts and I didn't even know which interrupts were there was no documentation for this chip and everything is completely custom to Samsung these are really difficult things to come up with but you can start adding to your knowledge just by doing the most frustrating things you can but if you're starting with embedded firmware in that style start with an STM32 dev board even start with a Raspberry Pi and just start looking at bare metal stuff if you have one available there's all sorts of ways to go into it really that's awesome that's a great and very thorough answer I appreciate that do you believe that Samsung will eventually start using signature verification for downloadable firmware? So the chip did use signature verification in this instance what they should be adding to that rather than modifying the signature verification is encryption on top of that so at the moment you could take the firmware that they've deployed and analyze it in Ida with no problems because there's no encryption whatsoever now different chips that's from different manufacturers that's where even NFC chip ones are encrypted and signed that means you can't reverse engineer them to find any exploits you also can't deploy modifications to them and that's sort of the way they should be going more than anything Do you think that that's actually a good way making it harder for reverse engineers to inspect the actual firmware? It's kind of a catch 22 on that point isn't it I see where you're coming from I think especially with the threat mobile such as this where the only real reason someone would reverse engineer this is to make a cool NFC hacking tool rather than to damage other people is that if you really wanted to stop people doing this which I don't agree with on a moral level but I would say encrypting it and preventing from doing that is the best way to go because then what they'll have to go for is both guessing how the bootloader works and also guessing what things like secret vendor and CI functions are available which aren't necessarily all vulnerable to things but are available and people can brute force through them How much time did you spend on this project? A lot I feel like my boss has probably asked me that in the chat so the project started off at the end of the last DEF CON actually which is when I was seeing my hotel room looking at the original firmware and then I just did it in little bits over time more than anything it wasn't a solid amount of time when it got to the point where I had a signature bypass on the Simpsons when I really started focusing quite a lot of time was so it took me about three weeks not every day but three weeks in total to go through everything and start implementing every single part of that firmware because I was having to look through the entirety of the firmware image which had no documentation whatsoever and nothing to work with no strings at all, no function references that you'd get enough, it's literally just raw code, it's all guest work and that's sort of why it takes such a long rendered amount of time compared to some more desktop level projects where you can rather as an engineer see an application quite a lot more easily I'd say. So other than challenge of doing the reverse engineering and figuring things out did you have a particular use case for the end product like a sneaky version of the Proxmark or something? A sneaky version of the Proxmark is exactly right, yes that's very correct. I do have Proxmarks and I really like them so I've got one right next to me which I actually use the reverse engineering of this project really heavily for the NFC side because it so lacks on things like the bit of verification, the parity checking it meant that I could build up the project really simply from that. Now essentially yes I was trying to make a fakie Proxmark and part of that was passive NFC sniffing so one of the tools on a Proxmark is this thing where you can sniff high frequency communication between the reader and attack this is used for like breaking authentication and things. I wanted to add that in so you could go up someone with a phone and stick it over them as they're trying to open a door or something by accident and pick up the communication now that's feature is almost done but it's quite complicated now because you have to switch between hardware registers now there's one block of hardware registers I mentioned in the talk and that handles every single aspect of NFC so that's the reader part and the actually like attack part so you have to switch between those constantly in order to get that data and it sort of works but until I've got that full functionality in place it's really not a replacement for the Proxmark. That was the goal, yes. That's really sneaky, I really like it. Why do you think so little has been done for why do you think so little has been reverse engineered from a Qualcomm baseband? Is it more challenging? I'd say yes. I've looked at some aspects of Qualcomm as well just from interest so I've looked at several different aspects of things like how their bootloaders work, how they have Qualcomm emergency download mode and all these sorts of features they've also got the baseband which is highly complex the problem is you start looking into them and then you realise how much of a kind of worms you've opened with reverse engineering this project by comparison to something like a Qualcomm chip is very simplistic it's one very small say 12k firmware to look through whereas when you get to the Qualcomm baseband which is going to be hugely complex it's just a huge project and it's something which is better suited to a multi-person team rather than just me on my own. Largely the size of the firmware on Qualcomm chipset is the limiting factor or is it also that is the snapdragon still like a natural arm core or is it something Qualcomm specific? It's an ARM64 core I believe for the moment so I know there's been quite a lot of research done on Qualcomm in general on their chipsets because it is the focus of the phone I mean that's why I chose a chipset that was a side aspect of a phone because I thought I would rather bother to look at them and they haven't with this one because I feel like the vulnerability I found would probably be found quite quickly but yes when it comes to the Qualcomm side of things it's just such a hugely complex chipset and there's so much to look at and there's so many potentials for bugs in different places that like any chipset of that complexity it would take a team and quite a lot of time to find something I think. Yeah fair enough it's like we got some potential questions coming back in. Yeah is there any part of the talk that you omitted because you just ran out of time? Yes quite a lot so I wanted to go into more details about the reverse engineering side which was considering it was only half the talk was the most time consuming part of the topic but I found that it was quite dull to talk about because it's literally going me going oh I thought this might be this I thought this might be this for instance I mentioned interrupts earlier and how these work on Cortex M chips is there's a big table at the start of the firmware which includes the reset factor which is where the chip starts from the start of the stack and then it has a bunch of interrupts like the hardware and stuff now on top of this it also has interrupts for more complex hardware like the NFC so one thing was all the NFC tag mode stuff ran off one single interrupt so it hit that interrupt and jumped some code that meant the code wasn't directly referenced by anything and actually didn't disassemble when I first looked at the firmware what this meant was I wanted to override what I started off doing was overriding that interrupt in the first place but I had to know where it was so I found the the select function that I mentioned in the talk and the word back from there found that had no function reference thought maybe it's a interrupt and then search for that value which was then found as table things like that these are things that are very valuable from a reverse engineering perspective but they're very boring to talk about in the talk I think which is probably bad because I just spoke about them for about five minutes. No no no it's fine we've got time and people are like I'm interested I didn't know that things pointed exclusively by the interrupt table where wouldn't normally decopile not unless it well, Cahedra's quite good at this I found because it understands Cortex-M whereas I just sort of quite hands off when it comes to things like Cortex-M chips it allows it tells you to work that for yourself essentially a lot of the time fair enough which would you say are other interesting targets like not complex and well they use chips? What I would recommend is something that I work with quite heavily which is IOT embedded IOT chips which are not custom chipsets in the first place they're usually STM cores or EFM cores and these sort of things why these are interesting is they're a good jumping off point to learn these things because you're not guessing you've got documentation in place but also people implement bootloaders and things which you can then try and break now I did a talk at 44con a while ago which is about breaking one of these bootloaders by breaking the encryption mechanisms on the firmware update by dumping RAM off an STM32 chip as it was doing the firmware update things like this are things you shouldn't start looking at because there's millions of these IOT devices out there with all sorts of different chipsets and they're really fun targets when it comes to custom chips like this you're really not going to find much information online about them just because they're hidden away there's about two links if you search for some of these Samsung chips online apart from their accreditations from the NFC forum so finding these chips in the first place is probably your greatest goal when you're starting up something like this more than anything cool and someone wants to know if the firmware was based on an RTOS or more long slides which is like a standard raw microcontroller target yep great question so you often find embedded projects like this using an RTOS like VXWorks or FreeRTOS or ECOS and these sorts of things now they weren't because it was literally a straight firmware that they had compiled they had their own presumably they had their own tool genes at Samsung they compiled it up they had to have everything sorted as they wanted to and laid out as they wanted to because they had their firmware as they wanted and RTOS is usually built for certain chipsets or certain families of chipsets or certain styles which just wasn't really meant to be on that point often these RTOS have a lot of overhead as well I think do debug strings for instance VXWorks are the table I think I mean compiled out but it's at the end of pretty much all their firmware which includes all the function names which you can then reference back to all the functions in the firmware which saves you a lot of time reverse engineering but it's also a security perspective quite bad it didn't use an RTOS it was just a straight running firmware they'd put their own function calls in and all that sort of thing other chipsets they've looked at they've done custom often implement their own custom RTOS for this but in this case that was none used it was literally just running as it needed to and relying on interrupts more than threads awesome that was a great answer by the way thank you well it looks like we are running out of questions and we're just about the end of our time anyways is there any additional links you want to share or code or anything like that that you want to get out there yep so if you if we're doing links and that sort of thing you can follow me at Twitter at iscuri1 so that's my username and then one at the end because I didn't get the one without the number first for GitHub it's just iscuri and I should be pushing out a blog in the next couple of days like outlining all of these details as well as linking to the YouTube video of this at pentestpartners.com which is my company website so feel free to have a look if you want the really nitty-gritty technical details awesome well thank you so much for joining us for this QA session it's been great talking to you thank you for providing content to our virtual DEF CON save mode and have a nice day thank you very much guys


You know what I just hate? Oh yes, yes, I really hate that. But also lines. They tell us that lines and waiting our turn is necessary for survival and staving off chaos. And so we need to take turns. Okay, all right, fine, fine mom. But what if, what if I just took the most turns? Lucky for me, in fifth edition, there's rules for that. Turns and actions. Action, economy, Bitcoin. We will use at least two of these terms in the following. Basically, action economy states that when two parties of close skill level or even slightly unbalanced skill level fight, the party with the most actions will win the combat. Hence why 10 Kobolds with crossbows will defeat any level three party of four adventurers. So if we are looking to fully utilize our actions, we need to understand that we get a move action, a standard action, and a bonus action. And that normally translates into one attack and a move. But we can make multiple attacks using our bonus action. So a level 11 fighter gets extra attack two, which drew its name. Means we get to make two extra attacks. So carry the one, that's three attacks in one action. If we add a level of monk, then we can use our bonus action and a key point for flurry of blows, which lets us make two more attacks for a grand total of five attacks. And that's basically five whole turns. But this video isn't about monks or fighters. It's about druids as they say, hold my ale and watch. Now we're choosing druid for this because of one spell that is going to get us through our mid game. That spell is conjure animals. At fifth level, we can access to this third level spell twice a day. And with it, we can summon a variety of creatures that will roll and share one combined initiative. This essentially gives us two cr worth of animals to control. Now think back to the kobolds from before. Quantity over quality. We can make eight. That's right, eight creatures of cr one quarter. So that means for the next hour, we have nine move actions, nine attack actions, and nine reactions around. And we will literally own the initiative chart. Now the spell says that the DM gets to pick from the local fauna. And that can be done using the random biomed animal tables and Xanathar's guide. But let's just pretend just for fun that we get to pick our animals. Well, then open your shirt and steal some crowns because we're going to get our oka on and we're going to make some elk. Yes, elk. Now the elk has 13 HP and an attack with a plus five to hit for 1d6 plus three damage. However, if the elk moves 20 feet in a straight line before the attack, it hits for 3d6 instead with a chance to knock prone, which means we have the potential to deal 24d6 plus 24 damage around with just our elks. Now I hear you. Rules guy Ranger can use this spell too. So why did you choose druid? Well, I'm glad you asked. You see at level two, we can take circle of the shepherd druid. This gives us the ability to talk with any animal we meet and lets us summon a totem animal, which gives us a helpful aura for all of our allies. At level six, we gain the feat mighty summoner, which gives us an extra two HP for every animal we summon for each of its hit dice. So for our elk army, that's four HP per extra elk. And though it doesn't seem that big, 17 HP elk live through a 2d6 plus four greatsword a lot more often than 13 HP elk do. And elk that live can be extra turns and actions for us next round. It also makes our elk deal magic damage. So we can call our elk army down upon the creepy crawly ranks of undead that would normally resist their bludgeoning damage. At ninth level, we graduate from an elk militia to a full fledged elk army. As we gain the ability to cast conjure animals at fifth level, and that allows us to double our elk output. Now, this could be a time to discuss one CRBs or half CRR options, but we came here to make sure that we are playing more D&D than anyone else. Yo, what's up? Ian, the rules guy here. And are you ready for this dog? You need your DM's permission for this next bit. Because man, we like to have fun for memes here, but it will literally ruin combat for everyone else. You could totally just settle for like four dire wolves, it would all work great. I know you're cool, you know I'm cool, let's be cool. All right, cool. Where was I? All right, 16 elk. Your DM will have to invent new ways to deal with this clearly invasive species as we will demand 17 turns in combat. While the DM's dragon, it's gonna be lucky to live to its layer action. Finally, at level 10, we gain Guardian Spirit, which will heal every summoned unit in our totems range for half of our druid level. And that means five HP every time they end their turn, making our army that much more resilient.  And that means if we go unconscious or lose focus, it all ends. So, we're gonna focus on Khan as our main stat to prevent that first one. And as for concentration, we look once again to feats. Warcaster will give us an advantage on concentration checks, as well as allow us to cast while our hands are tied up. Tough is another featograph, which will give us two extra HP per level, making sure that we won't be the weakest link in the natural world. Well, we definitely took some turns today. We basically only covered one spell. The druid, especially the shepherd druid, is a very powerful class in 5th edition, and it gets to do a whole lot. If you want a less obnoxious version of this build, you can use conjure fey to summon up just one powerful ally. Or you can use the higher end beast on conjure animals. It might not be as good, but it will play much better for your friends. Now, where our Elk Lord build really shines is in comedy themed games, or games with small player counts. With two player characters, the shepherd druid can provide the meat shield that your wizard friend needs to be protected. And how Elkful is that? Hey guys, I'm here to tell you about our sponsor, DiceDungeons.com. They're the whole reason we can make these videos, and they're great. Are you looking for D&D supplies? I bet you are, because you're watching D&D stuff. They got your acrylic dice, they got awesome metal dice, they have cloth battle mats, they've got these super cool little rosewood dice chests that hold your dice, and they're honestly the best thing I've ever used. I just have stacks of them, they fit my bag super great. They got metal coins, you can flip them and go, well that was a heads up when they say, that's a tails, you can throw my people and they hurt. It's amazing. I say, go to DiceDungeons.com, and you should check out code DOORMONSTER for 10% off, and you will have everything you ever need for D&D. Go do it.