Good. Hello. Hello. Hello. And welcome. I'm Merron Khalili and we are DM25, a radical political movement for Europe. And this is another live debate with our coordinating team featuring subversive ideas you won't hear anywhere else. And today we're talking privacy. It's 2022 and our right to privacy is looking increasingly tenuous. First, earlier this year the European Commission announced that it wants your messaging provider to spy on you.  This would require hosting and messaging providers like social media companies to scan all your content. So your videos, your photos, your messages and then make a judgment on what to hand over to law enforcement. It's not hard to see how this is an authoritarian government's fever dream. Meanwhile, in Greece, the government of Kyriakos Mitsotakis was caught red-handed over the summer, wiretapping the phone of the leader of one of the opposition parties in a movement called legal but wrong. Spyware, i.e. software that essentially turns a phone into a surveillance device, was also found on this politician's phone as well as that of other politicians and journalists. But Greece isn't even the exception. Over the past year, spyware has targeted opposition leaders, activists, journalists, lawyers in France, Spain, Hungary, Poland and even staff within the European Commission. And finally to round off this rather bleak picture in a new UN report out this week, the organization warns that people's right to privacy is coming under ever greater pressure as digital technologies can be refashioned into tools of surveillance, control and oppression. So what the hell's going on? Are we going to sleepwalk into letting them spy on us? And most importantly, what can we do about it? Our panel, including Eric Edmund, our political director Yanis Varoufakis, our leader of the Merit 25 Party in Greece and the rest of our experts and campaigning gurus are here to discuss this topic and also to take your questions. That's you out there. If you've got anything you want to say, anything you want to throw at us, thoughts, rants, things to get off your chest. This is live. This is YouTube. Please put them in the chat and we'll put them to our panel. Let's start off with Eric Edmund from Brussels. Over to you Eric. Yeah, let's let's start with the particular and then expand to the to the more general question at hand. So let's talk about Greece in 2018 Mitsutakis was elected Prime Minister of Greece. And one of the first moves he did was to move the Greek Secret Service under the direct jurisdiction of the Prime Minister's office. A move that to put it mildly already seen dodgy at the time. He also then appointed his nephew, man called Grigoris Dimitriadis, as the Prime Minister's general secretary. All right, I'm setting the scene here. Now, Greece, remember ranks at the bottom of all EU nations when it comes to press freedom that includes Poland, Bulgaria, Hungary, which I'm mentioning because they are the usual offenders when it comes to these matters. But Greece actually ranks at the very bottom of all EU countries for for press freedom. Now, on average, last year, for example, about 15,000 Greek phones were under government government surveillance at any given time, which is a staggering number, but it is strictly speaking legal according to Greek law targets of state surveillance must be informed that they are being surveilled. But there was a recent amendment that introduced an exemption to this if it occurs exclusively on grounds of national security so if the people being surveilled are considered to be spies, essentially. Now, what was revealed earlier this year was that Mr. Andrew Lachis, who is the leader of one of the opposition parties, Pasok Kinal, and Thanasius Kukakis, a journalist among other politicians and journalists, were in fact being surveilled, but being surveilled using a spyware called predator, which has been explicitly condemned by the European Union. Also, they haven't been informed of being surveilled, meaning that unless these people were thought to be spies at the time, the Greek government broke the law by doing the surveillance in the first place, let alone using this software which the government categorically refuses that they've done. Now, Kiriakos Mitsotakis is trying to shift the blame. He says that although he moved the entire Secret Service under his jurisdiction, he had no idea what happened, which either makes him a criminal or a criminally competent. You take your pick. And the whole affair is that the whole affair, he claims that the whole affair has been manipulated by sinister dark forces that tried to overthrow his government and destabilize the forces and the rest of it. Now, his nephew in the meantime, Mr. Dimitri Adis, resigned, and it has been revealed since then that while in office, he conducted a number of financial transactions with a circle of businessmen that had dealings with the owner of Intellexa. Intellexa is the owner of the predator spyware. So there is a lot of murky business going on here that the government hasn't answered to. Kiriakos Mitsotakis, until very recently, may I remind you, was the EU's golden boy. He was the golden boy while killing refugees in the AG and he was a golden boy while introducing police into universities in the country, while cracking down on peaceful protestors. All of that was above board. And even I would venture to say this surveillance scandal wouldn't have been a scandal if he hadn't been caught. The problem wasn't that he was doing it. It has become unattainable to support him because he was caught. So the EU here, which I will come back to in a moment. You also mentioned what they're planning isn't completely clean either. At the European level, the European Parliament has created a parliamentary committee called the PEGA committee, and I was set up to investigate the use of another spyware software called Pegasus, which the Polish government has been accused of using. Now this case, the predator gate as it's being called case is also being brought to the same committee to be investigated so far that committee, however, at the European Parliament has been criticized for being far too lenient with the governments that is investigating. It has a one year mandate at the end of that year that mandate might be expanded by a maximum of six months. So we're talking about a year and a half maximum. And after that, they need to publish a report to the European Parliament and some recommendations to European bodies, the council, the commission and so on, that then the parliament might adopt or not. So how effective this committee will be, is anybody's guess. Most likely it's mostly toothless, also because it's primarily populated by liberals and conservatives who are more often than not members of parties that use these kinds of techniques. So to open up the topic a little bit, Greece is not alone in any of this. We had a few years back the NSA spying scandal where the United States was seen to and the UK were seen to spy on almost all of their NATO allies, Hungary, Poland, Spain have all been accused of spying on journalists and politicians. The German government has been trying for years to find a legal ground on which to create a kind of network database of who talks to who how often and so on in their own country. And every time they're being slammed down by their by their courts. But they keep trying on new legal basis to to formulate this kind of yeah database of communication interaction within within the country, under the guise of anti child abuse. And this is important because it's exactly under the same guise of commenting online child abuse that a regulation is being discussed at the European level that would essentially pose a duty on all network providers to search or communication content for depictions of child abuse, child grooming by adults and so on, if they're ordered by the authorities. These are called CSS so client side scans. That's the CSS and this would basically run and check on all messages on any particular device to see if any child abuse images or communication has is included in those messages. And if there is a hit when this software is being run on any device, then it would send a flag and alert the control point which would then involve the relevant authorities. And the suggestion would be to create basically a branch of Europol that would have specifically the power to ask a network providers to run these tests on suspects and and also order the authorities to then investigate further if there are any hits. It has been widely criticized as a, as a proposal. There's even child protection associations have called it a change that the danger to privacy overreaching it's a danger to it security free and remove expression and democracy in general to be honest, and the current draft legislation does not even prescribe exactly the kind of legal procedures and and the protocols involved. They would leave all of that to be decided by this branch of Europol once it's created. So the whole thing is incredibly dodgy and the problem with it is that it would open the floodgates. It would create the kind of infrastructure legally and technically technically we already have this technology, but it would create the legal basis on which could then be further expanded on under more and more pretext to essentially render privacy entirely obsolete online. So it's widely criticized and incredibly problematic. And essentially what I'm trying to get at is that at the EU level, various national governments around Europe, including Greece, which is the latest big scandal if you like. They're all constantly trying to chip away at privacy rights, excusing it as as it moves to what used to be to counter terrorism, sometimes it still is child abuse, like we said, and so on. But the reality is that once, if, let's say not once, but if these floodgates are open, then those legal, that legal pretext to wiretap citizens could be weaponized to attack any kind of citizens on any kind of pretext. So it's quite dangerous and the only ones really fighting this fight currently, apart from a minority in the European Parliament and various parliaments around Europe are civil society organizations, which we could discuss further later on in this live stream. Thank you Eric for setting the scene there. To be honest, the only thing I find surprising is that people are surprised. I find this astonishingly surprising. Why are not always surprised political surveillance and commercial surveillance has been with us since the 1860s. Since the days of the telegram. The unknown case of message tapping was during the American Civil War, when one side was trying to decipher the messages that the other side was sending to the to the front. And in the case of commercial wiretapping, again in the United States, where else New York City where savvy stock market trader had found a way of tapping into a telegram line in which signals going to Chicago, the gutting share prices were transmitted. Because if he had, you know, five minutes notice, compared to everybody, all other traders, he would make a mint and he didn't make them in that till he was caught. So none of that's new. We know why Richard Nixon was different in 1975 in the United States because he was caught red handed. His administration was caught red handed, and he tried to cover it down, listening in to his opponents in the democratic party at Watergate, none of that. We have no excuse for being surprised after, you know, Ed Snowden came out. I mean, the reason why Ed Snowden is in Moscow is not because of the weather or the food. He's there because he revealed to all of us that every single phone is top up blue by the NSA. They can hear any one of us except those who use extremely ancient, you know, Nokia phones, non smart, very dumb, Nokia phones, but even those they have ways now of listening into when I was in the government in 2015 I've written this in adults in the room but I might as well for the benefit of those who are watching, because they count some moments. First we go first day I was in India in the ministry, the head of the Greek secret service of the Greek CIA. Pointed out to me the two vans employed by the German Embassy, listening into my communications and communications of my team. We had their license numbers we could even we even knew where they were. And of course, our services were trying to listen into what they were saying to one another. And the finest moment came sometime in May of 2015 when I was on the phone to our comrades and friend Jeff Sachs. Jeff Sachs has famous to support the DM at some point he appeared with us on stage if you remember in Brussels. He's joined the Progressive International. Columbia University professor establishment figure used to be very close to to the IMF has done tremendously damage to the countries of Eastern Europe and Russia. But he's done his mere cool by his apologize for a friend and a colleague back then he was helping me during the negotiations with Troika. And he was in New York and he was pushing me as if I needed any pushing to default to the IMF. And I was pushing the Prime Minister Zipras here. And at some point I succeeded in getting Zipras to say all right. At long last we're going to default to the IMF. So I remember we're still between the morning. I had just come home. Actually to this flat from the ministry and I called Jeff with a good news we are defaulting next week to the IMF. And he said oh yes that's great. At long last now let's plan the next step and so on. I was really dead tired to put the phone down. I fell asleep 10 minutes later. It wasn't 11 it was 10 minutes later the phone rings and it's Jeff saying to me laughing. He was actually laughing. He said Jeff why are you laughing what happened. He said you won't believe it. I just received a call from the NSC the National Security Council which is a White House president of the United States. Security organization in the White House. And they asked him. They asked Jeff, Jeff Sachs. They asked him. Professor Sachs do you think that what the Greek finance minister just told you that he actually meant it. So they weren't even hiding it. They were not even trying to pretend that they had had it somewhere else. It was clear. I was under surveillance. Everybody's under surveillance. We're on the under surveillance. And yet we can constantly find it on ourselves to be surprised by this. It doesn't mean we should not be outraged doesn't mean that we should take it for granted. But let's not pretend that we just discovered it now. Eric is right. What is significant about the events in Greece. Very significant is that three things. First, that the prime minister. That was the first thing he did when he assumed office prime minister missed attack is took the Greek CIA under his personal responsibility.  No other prime minister has ever done that anywhere in the world that I know.  So it's revealed that the CIA, the Greek CIA that he had accepted full responsibility for was listening in to one of his political opponents during a very crucial period in that political parties machinations. I'm not going to go into this. I don't want to bore you with that. He was actually caught. And the third very important thing is he said it's okay. He dismissed it. He said, so what, you know, it was legal. It was not the right thing to do. It was probably political mistake to do it, but it's legal. So in other words, it was suddenly normalized. And you have a European Union with a member state like Greece. It's not so ban, Hungary. Effectively telling the world that it's okay for the prime minister to be personally listening in through a service, secret service that he has adopted as his own to be listening into his political opponents. So it is the declaration of something that was new went on. It's declaration as something that is legal. That is a precedent that is new. The fact that it's been happening, not even Nixon said that not even Richard Nixon there to say that now he was trying to deny it. And when he was caught that, you know, red handed, he was forced out of office. So that is not being forced out of office. The European Union is not starting proceedings against the great government, the way that it started proceedings against the Hungarian government for anti-democratic behavior. And it was not just, of course, it's like it was journalists, anybody who opposes the order of things. So what we need to do is we need to make sure that the standard DM 25 line. From the very beginning of our integration in Berlin, back in February 2016. Remember what we used to say? We used to say, we want, we demand, we demand it's a part of our political agenda that citizens should be opaque and those in power, corporate power, as well as political power should be transparent. In other words, a reversal of what is going on. That should be a political agenda. It was our political agenda from 2016 onwards. Now that the European Union or at least parts of the European Union are proclaiming the opposite of our goal. It is time for them to fight to repeat more vehemently and more fiercely and more passionately our original line. The line of Julian Assange, the line of Edward Snowden, the line of DM 25, that citizens must be opaque. And it is governments that must be governments and the oligarchs who must be transparent. It's a good political campaign to have, even though it's very difficult to imagine us winning that without changing the whole of the texture of the socio-political economic system we live in. And this is how I finish because it's one thing to say that commercial surveillance has always been with us since the 19th century. I mentioned the example with the stock exchange trader who was trying to discover insider information in order to make money in the stock exchange. What we now have is something far, far deeper, worse, more insidious than that. Big tech, they're not just surveillance. It's a very long discussion. I could speak for hours on this. I promise I won't. I'll just mention it a bit dramatic. We have a new form of capital, which I call cloud capital, because it lives in the cloud. It's algorithmic. Of course, it's got wires and optic fibers and satellites and cell towers and all that. But it is a very special kind of capital because it's not producing commodities. What it does, it produces a network of power, a network that has the capacity through surveying what you do, what you say, your facial expressions when you look at a product in the screen of your computer or your phone. It can predict ways or it can plan ways of surprising you pleasantly with good recommendations for movies, for books, for things to wear, for this, that or the other.  And then you start trusting it because the things it recommends to you are things you actually like. And the more you trust it, the more sucked in you get into its capacity to tell you what to do, to tell you what to buy, where to go, which platform to visit, which platform not to visit. And if you take into consideration the fact that this very same kind of network, algorithmic network, this kind of cloud capital, is also replacing marketplaces, markets, physical markets. Amazon.com, Alibaba, and so on. The same algorithm that through Alexa, through Siri, through this, through that and the other, listens into you, trains itself to train you, to train it, to tell you what to do. The same algorithm is now selling you the stuff that it has convinced you you want. That's not a marketplace. This is what I call techno feudalism and this is not surveillance captains.  This is techno feudalism. There's no marketplace. There is no market competition. There is simply a new digital feudalism in which your attention is not simply drawn by the algorithm through surveillance. Your attention is shaped. Your desires are manufactured on the same production line as the things that you think you desire and therefore that you purchase. So we're not talking about some sinister people listening into what we do or some surveillance capitalism or some kind of CIA or NSA or NSC. These are just the very beginnings of the realization that what we now have is a socio economic and political system. Most of its capital lives in the cloud. That's why I call it cloud cloud capital that has you said has gone far beyond capitalism. It has effectively replaced capitalism with a new kind of feudalism, which is technological, algorithmic and well beyond the human minds and human political systems capacity to do anything other than overthrow it. Thank you, Janis. You did. You did my up in Berlin from a more technical perspective. Thank you. So, of course, I agree with what has been said, but I do think that maybe we're taking things too, too simply. We're saying that there has always been surveillance. As you just have to imagine, I mean, the obviously the husband's surveillance, but even the GDPR, the GDR East Germany was not able was not able to surveil people at scale. They hired like every first person to be a spy. And even so they were not able to listen to every conversation. And they had to actually install wires if they wanted to listen to your phone calls. Nowadays, well, the first revolution was that all of our most of our conversations are now happening online, even if we're calling on the phone a lot of it is happening voice over IP which means on the internet. So that suddenly there is a possibility and a possibility that is being used for the state or worse for private companies to suddenly have access literally to everything that's being set and to do this at scale. And of course, another problem was that even if you log every single phone call from every person on earth and every single text message, then you still need a huge number of spies to analyze all this, especially across a lot of different languages. And this is where we're on the cusp of another technical development where AI will be able to analyze all this and tell the state exactly this conversation sounds more dangerous than these thousand other conversations and to help save on employee costs, and to actually make it possible to determine who is searching in the various plot and who isn't of course at the cost of a lot of ordinary people also being caught caught in this web.  This already exists in some form in America and I believe in the state of Arizona there was a woman who tried to send a picture of her little son's genitals to their family doctor. And she got arrested by the police for spreading child porn. It's just to show that these these algorithms are not as intelligence as they would have to be to actually catch just the people that are affected they will result in a lot of ordinary people seeing their privacy violated. They can totally be a danger in the sense that they reduce the the staffing costs by 100 or 1000 to be able to to actually process all this material. So I am worried about adding and not just the ability to store all this material on all our conversations, but adding artificial intelligence to this process, which will make it more possible than ever before to listen into what a lot of us are saying and to actually glean some insights from that even with a high mistake count. And the other thing I wanted to talk about this, the current spice spice candle in in Greece. It's about this software called Predator which was created by an unknown North Macedonian company. This software is also be used by Saudi Arabia and other countries that are not known for the human rights record. And the way it works is that it sends you a text message or maybe a WhatsApp message saying, I, is this really you in this video, something like that, you know, and like a prompted has you absolutely want to click on the link that they sent you They can install some malicious software on your phone. And that is bad enough because a lot of people don't know that they're not supposed to click on links from people that they don't know, or from, I think in in in this case of the of this Greek MP the the message actually seemed to come from from someone he knew. So they like spoofed this record and then send this message. But yeah, generally just if you see a link that that looks strange. It's not like Google dot com but some kind of weird number common and letter combination just don't click on it. But the problem is that this does not protect you anymore so this used to be the advice don't open attachments that you don't recognize don't click on any links that you don't recognize, but it's not enough because there is also this other software called Pegasus, which was used against Macron and more than 600 politicians from like 34 countries, including some other heads of state, and with this software with Pegasus, which was created by an Israeli company and it's used by the NSA by the German Secret Service by a lot of different different secret services. And with this software you don't actually need to click on anything. It it installs itself without any input from you. And this is possible because they have invested money in in in buying bugs from iPhone and Android developers. So they they the buy the right to know how to exploit certain parts of the operating system that already exists. If they're the only ones to know about it and the company itself has not been informed where they're called zero day exploits. And this is the bigger issue with our system that we have right now we have all these smartphones that have become a an essential part of everyday life, but they're not regulated or control the way that other essential parts of everyday life are there no audits like water is is audited a lot of places by a lot of different organizations. But there is no such audit for the quality of the hardware and the software that runs on our smartphones. And there is a possibility both for the manufacturer of your smartphone and for the people creating the operating system to introduce something that that would allow them to to listen in on you to log everything and send your data wherever. And and that is the issue and you can you can you now have a choice whether you want to trust Apple not to do that or Google not to do it, but it's not a big choice and especially with Google you also have to trust your manufacturer because if you have like a Nokia phone with with Android running on it then you also have to trust Nokia, because Nokia also has the ability to install an extra part to the operating system, which is not part of the official Android operating system and which you cannot actually access and and check whether there is anything nefarious in this thing. And even if you think okay, Apple or Google or whatever they wouldn't betray us we know that they do I mean, in some cases we know that they haven't reacted even after some of these exploits became known probably because important people were exploiting them. Or more recently there was a case where a bunch of researchers found out that it is possible for iPhone apps to insert extra code into websites that you're visiting while you're using their app. And these researchers created a tool that you can use you just open that website and it tells you if the app is inserting something. This way it became known that tick tock, for example, is logging every single thing that you type while you're using tick tock while you're using the browser of tick tock so if you're going to like your mail provider and you type in your email and password, then they have a copy of your password. Can I ask you something though because it's getting a bit technical.  Can I finish this? Yes, yes, okay. Sorry, I didn't plan enough but I was trying to make this point. So it was found that the tick tock, for example, is one of these apps that collects everything that you type your passwords and whatever. And the reaction by Apple was interesting because Apple, when they saw that some of these apps are logging everything that you type, they created a new way for apps to have a browser where the apps can do anything you want, anything they want and you're not able to detect this anymore. So in response to researchers showing that some apps were really abusing the system and collecting all kinds of stuff from your phone, Apple just made it impossible for researchers to know that they're doing it. They're not protecting us from apps doing it. Okay, now your question. Sorry, I wouldn't ask you. I mean, I understand tick tock in their own app. They do this logging, keystrokes and so on. I mean, Facebook's Instagram, Apple's also monitoring how you're looking at it. No, not just when you're browsing tick tock videos but if you are in the browser that's in the app. Yeah, if someone sends you a link, you tap on it and you went up using Facebook or another app and yeah. Okay, no, I understand that. I mean, but if we look at this Pegasus thing that we were talking about before, why is it not possible today that we can quickly check are we infected with these very, very capable spyware apps like Pegasus? Why don't we, isn't there an app for that where we can just download it and go, yes, you're infected or not similar to an antivirus on a PC? No, because for Apple it's obvious because every app is in a sandbox so it can only access its own data and it cannot check what other apps or what the operating system is doing. For Android there is a bit more access but still there are some parts of your phone that are locked down that you simply cannot look at. If you want to check, for example, there are some instructions online on how you can figure out if you've been infected by predator or Pegasus but basically it involves you cracking your phone, jailbreaking it and trying to get access to the parts that are locked and it's not certain that you're able to see everything that the manufacturer tried to hide from you and hidden partitions and so on. Okay, and before we move on to the next speaker I wanted to ask you, do you agree with what Yanis said that essentially we're all being monitored, surveilled all the time? I mean that's sort of the new normal so presumably we should change our behaviour to fit that new normal, that new technical normal, given that we can't avoid it, we can't reshape it without massive sweeping changes in legislation and cultural shifts and so on. Do you agree with that? Well it's well known ever since Snowden that everything we do is recorded. It's another question is whether they have the interest in the manpower of doing anything about it and maybe if you're just exchanging recipes with your grandma and you use high grade encryption then maybe they don't find it worth their while to decrypt all that but I don't know. I would assume if you're doing anything worthwhile then you should assume that your activities are known. Okay, interesting, thank you Yudit. Julian Azita from Germany, over to you. Thanks. I think on that point that it's also not just about using the data against us. I mean the having the data and collecting it and selling it, you know, crosswise from one company to the other is also of high value to them so it's not always about getting kind of to us but just like accumulating data. Yeah, I wanted to say about Germany for example, indeed it's illegal, most of that software, but for example the state of Hessen and the state of Nordrhein-Westphalia are using a software which is called Palantir or Gotham. They just named it in German like Hessen data or something so it sounds boring but it's really a software which is unbelievable because it also mines data but it has also all these algorithms which are supposed to also predict based on the data for the police. And what I thought about is if you start and they say it's good for the police because there's so much they are able to see and to solve more crimes with it. But if you see in practice now the crime scene, the police are just collecting the data on the crime scene and they're giving it into the computer and the computer searches for everything and also they just give in the names of people that are related to the crime scene. And the algorithm and the AI does everything for them. So basically if you wait for one generation or two, I think that police work would change through this technological use and that at some point police work would just be like that and nobody could go back to doing the police work as they did it before without the data. So, I think that there is a point of no return with these things. So, so I think that transparency is, is definitely needed when it comes to why we're using the data and how did they start to use the data because there are questions of why do they do do they use software of a US company. And I guess it for example and who made the decision it's all in transparent and there was no parliamentary decision over the usage of it because normally you would choose amongst many different companies and not just one company, you know, you would not take the first offer. So this is what happened there and it's illegal but there's, but it's in usage, you know, it's like for several years now. So how is this happening, although there is no legal ground. And there, therefore me at least is the big question of, I mean, in any case we're not doing enough, but what can we really substantially do to maybe, of course, on one hand, yeah, make public what is happening. I also feel like many people are not taking serious like it's, well, I'm not a criminal so let them know what I'm doing. I don't care, you know, but they don't see the bigger picture and it's really difficult. Well, to talk about it and to be serious about it with those reactions. Yeah, and that's a very important point. What can we do about it? I mean, I think it needs to go a lot further than just installing signal on your phone because I would imagine Predator and Pegasus they probably read everything from signal as well, right. So let's let's put our heads in that now and have a little brainstorm please on potential solutions. Let's hand over to Julia. Yeah, thank you. Thank you. Hello everybody. Yeah, taking taking the link points maybe with a specific UK device. We opened the top of this evening with Eric and the analyst talking about it's legal. It's not okay, we shouldn't be doing it, but it's legal and therefore we'll do it. So if we as a movement actually go back to the core of why DM 25 was created in the first place is about reforming the institutions in the EU. We have legislators who themselves are either within the institutions by integrity or if the legislative group doesn't have teeth and they're not there to instigate policy because that comes from the powerful commissions. Then we've got the wrong people making law and and that's what we're discussing this evening. We may specifically be talking about digital matters this evening in the digital economy. But if if our viewers and people are interested in reform, look at the origins and what the commission does at the EU and the directorates general and the lack of transparency that runs through the the core of what is done there, the lack of election, the lack of profile, how difficult it is to find minutes of meetings of things that go on, especially in the competition directorate general. All of these things take us back to why we are where we are with 25 and with our view of the next European elections. So if I can give a specific EU twist on this and talking about digital surveillance. The legal device in the UK, which is pretty unique, not not completely unknown in the rest of the world called judicial review. And it relies on the independence of independence autonomy of the judiciary to be able to scrutinize the acts of parliament. Because they often are called in to have a look at the security services, the work that GCHQ do. They were prevalent in the Shaila spy case of many, many years ago, and the judicial review process itself is under attack by an ever increasing right authority tendency, shall we say of the British politics as it lurches even more to the right and of course the judicial, the judges who eventually investigated prerogation and the insistent that parliament take a take a vote on triggering the exit article, not forgiven for that. And therefore, the incoming conservative government that sits at the moment is determined to unravel the judicial review process because of its effectiveness of looking at what governments do. So if we take that as a domestic device and then apply it to the institutions of the European Union, it's what DM 25 was created to do was to reform the institutions to make the institutions more transparent. Most crucially, to make the legislative the MEPs, the instigators of policy, rather than the powerful commission, the commission is is is entirely driven by its epithet, it's the guardian of the treaties. And of course, under reform, that needs to be challenged that needs to be reformed and the legislators need to legislate and as Juliana has made the point, and Eric and Yanis made the point, we then may be within an institution that shines a light on what it does. And I think the digital question best illustrates it at the moment, but of course this applies to the rest of the commission's work as well. Thanks, Miran. That's me. Thank you very much, Julia a couple of comments and questions from the chat here. Somebody asked what's going on with digital IDs is that going to be tied to our entire lives online and off so perhaps someone would like to take that question. Also a question. Why is big tech not debated more in the mainstream it's. It's also essential in the discussion on transforming society into being more green, for instance due to energy demands from data centers. True.  There's the most effective way to keep children safe our community, the most effective ways our community based and don't rely on tech quick fixes. And I would also be curious to know from the panel if, if they, if they accept that idea that this is really all about child sexual abuse, or if there isn't just this creeping desire to to get it involved a little bit more in citizens activities in the same way that Juliana was talking about her local police force, installing, or employing these kinds of methods over there. Okay, Lucas Lucas probably our communications director, Lucas. I live in Berlin, and so I use public transport a lot, and I'll often find myself in like a very crowded subway train and I will take a look around and I'll see, I'll sort of do a account in my mind of how many people are looking at their phones. And it's usually most of them, you know, if you ever find yourself in a situation that among dozens of people that might be three that aren't doing something on the phone listen to music text someone. And I, and I'll think like, my God, these are the devices that these people are using two companies basically make the systems that they're interacting with and that's so much of their lives and their communications. Depending on and so many so much information about them goes into those things. If you want to count the other cell phone manufacturers that do slightly alter versions of Android, then the count goes up to, I don't know, a 10 but nevertheless is very few of them. And the power that they have, you know, everybody has a smartphone everybody uses it's a ton every single day. And even if you're, if you think a lot about these things it just impossible to think about them all the time while you're using them and so it's impossible for you to be aware at all times of the things that it isn't not just the things that it's recording about you but how it's influencing your behavior I remember a few years ago I think it was, I think this happened in Australia and internal documents by Facebook made for me by Facebook for potential advertisers, in which they were bragging about the ways that they have found to manipulate people's behavior using the algorithms I remember there was a specific example. I believe that they could do something like take a teenage girl for example they could because of the patterns of her behavior using her smartphone. That say for example on Thursdays in the evening she tends to be depressed and that that because of that that that's the ideal the optimal time to show her an ad for clothes or for makeup or for something like that that would make her feel better about about herself and her looks. So it's not just a matter of understanding what type of clothes or type of makeup you you like it's it's about really honing in on the on your vulnerability and to actively manufacture this this purchase and a conversion for the client. And I'm saying this because I'm I'm just wondering how we got to this point in which this is so pervasive and legal and accepted. And I think the way we we got to this point is, we got cow cow with our pants down because 20 years nobody understood that any of this would ever be possible even the people at Google they didn't realize at first that there was a ton of money to be made by those little crumbs that people left behind when they did when they use their search engine. And so because nobody saw it coming there was no it wasn't free for all there was no legislation society wasn't prepared for it lawmakers, even if they were well intended, they just didn't couldn't anticipate that this was to happen and by the time everybody realized what was going on it was too late because the systems were in place. 234 companies own everything.  And I think, you know, some other people here more logical than me in terms of what we can do right now to, to, to help sort of fortify our privacy a little bit, but I want to look a bit further ahead into the future. And I'm going to use an example for just for illustration here that the metaverse. Is this ever going to be a thing is ever going to catch on I don't know I hope it doesn't you know, at least not in the format that meta has presented it to us. But I think we have to sort of assume so that it help doesn't happen again we have to assume that it does. And we have to ask ourselves, what is it that we need to do right now to prevent that the same things happen in the next iteration of online communications essentially which for illustration sake here we think that is going to be the metaverse. quasi physical space that might become very important in how people interact in the future. And if we don't get our act together.  So I think that's the case with technology in general right there was always going to be a next thing that's going to revolutionize things. The first time that it happened if we really got punching the guts and those companies that we call big tech took everything over. And it's very difficult to see how that might change but the good news is that there's always innovation there's always a new technological revolution and I think what we have to do is learn from the past. Be ready for the things before they, they turning to something that people are actually using in their everyday lives, talk to people who know about these things to activists to to understand what is it that we can do right now. What's on the horizon so that we can prepare for it, so that you won't be a free for all next time in the next time after that. Thanks, Lucas and you're so right I mean technology is always ahead of the politics isn't it it's always ahead of the regulation. If you saw the way that the US Senate were questioning Mark Zuckerberg two years ago, you could see that imbalance of power he was running rings around them. These these old gray haired guys just going well yeah this this this and they sounded so nonsensical compared to Mark Zuckerberg and they they you see the imbalance. And I think also perhaps we can speak to this before I hand it to deny. There are so many groups that are active in these areas. Why haven't they made more headway. Groups that are staffed by people that know a lot more than any of us about this stuff. What is it that they are doing wrong or could do better. Is it just about money is it just about incentives or other other approaches that could be taken in order to to kind of even the score and create that awareness so that we're not. We're not, as you say, Lucas, kind of just sleepwalking into it. Then I then I started. Yeah, I don't have much to say about they say but because I did experience this whole period that the honest was talking about earlier during 2015 when he was minister and he had all the means to. Supposedly people taking care of the safety and security of his conversations, etc. Well, this is a provocative question to him because I was here experiencing all this and even my own phone was like it was underwater and every time I picked it up so I know they were also listening to my calls but so young is in reality. I think didn't believe there was anything that could be done. And they can see this in his practice every day that he doesn't protect himself on his phone emails, nothing. So, in reality, is there anything we can do, or just either not have smartphones and stuff and not have Google or Gmail accounts, or how can we protect ourselves either is there really a way I don't think, but I pass it on to Yanis because I don't want to get a second go at it. I'm going to answer in a way that most people disagree with. I personally do not believe that this problem can be solved on a personal basis through personal investment in defeating those who are surveying us in the same way that when people come to me and say, you know, I have no prospects, I have this problem and that problem, what can you do for me, what can the party do for me, the movement. The answer is nothing, because if we, I mean, the whole point of having a political party and a political movement is because individuals cannot solve the problems that the whole system has created for society. This is why we need politics in order to change the system, not in order to find private ways of dealing with the system. So, personally, I've given up, I really, as you said, when I, I don't care who is listening to my conversations, I assume that everybody is. There are some basic things you can do, you can put your phone in the fridge. If you want to have a moment of privacy, we used to do this in the ministry, but besides that, I think it's a complete waste of time. I have colleagues that disagree with me that try constantly to update their signal to have meetings face to face, to check the room for bugs and so on. This is too oppressive. In the same way that capitalism cannot be overcome through private initiative and can only be overcome by changing property rights. I believe that the question here is one of property rights, who owns what. There was a question that madam mentioned that was in the chat and asked the question about identity or digital identity. Look, the number one issue of true identity politics is exactly that are digital identity. If you think about it, what big tech has managed to do is to be the owners of our identity. Your digital identity doesn't belong to you.  Big business, big finance and big tech own your digital identity. They own your data.  So, cut a long story short, nothing short of a political revolution can shield us from surveillance from nothing short of a political revolution that changes property rights over, not just means of production but also over cloud capital what I call cloud and that includes our digital identity can bring about the change that we want. This is why we need the movement and it is not a question of an app or a trick or a technique that individuals can use in order to shield themselves from surveillance. This is why we need a movement and that's exactly what we've got. Please join us to address some of these issues that we're talking today. It's a sprawling massive, very complex problem, but you can be part of the solution instead of just fretting over the scale of the problem. Join us at dm25.org slash join and become a member in seconds. Thank you very much to our panel. Thank you very much to you out there for your questions and comments the discussion will go on in the in the comments of the of the YouTube video and tune in at the same time in two weeks from now same place. Thank you very much again and take care.


Make sure it's not just me who's seeing it we're They should see the three of us. Oh, yeah, I see us you see us. Yeah, I just went to the twitch. Oh, excellent. Which twitch tree I Hear myself now, too Okay, it's fantastic. We're a we are a professional organization here on Friday night We're gonna call that with my fault, okay Yeah Welcome to Q&A with Patrick Wardle We are going to be talking about some macOS stuff and some stuff kind of Jason to Microsoft office I Am jurist and the other gun that you see here is fallible and We're gonna be helping ask Patrick some questions this evening and it's good to see you all in the chat Patrick, why don't you? Take a minute to introduce yourself to everybody because I knew that in your talk you kind of dove right in Into into your content. So take a minute say hello to everybody. Tell us a little bit about yourself Sure. Well, how my name is Patrick Wardle. I am a principal security researcher Jamf but also the creator of the Mac security website and cool sweets Check your seat. I have been forced enough to talk a few deaf tons in the past. It's always my favorites events the talk and nerdy at This year virtual, you know full bomb we didn't all get to hang out together in Vegas, but it's important. We're all saying it's safe and healthy and Actually connecting online is kind of super hackerish So I'm stoked you're all here to chat a little bit more about my talk open Q&A Again, welcome. Well, thank you for being here. We really appreciate it And it's nice to get to some folks who want to come and present this way. So Sneaker net gave us what they're considering to be a softball question is SYLK the old file format you've come across Is there a way to programmatically scan Mac OS apps for what kind of files they handle? entitlements particular API usage Yeah, so that's a great question. The first place I would look at is in something called the launch services database And you can enumerate this with the LS register command and what it will basically do is it will dump All the file type and application Associations on your macOS system. So for example, you can see what applications have registered for HTML What applications have registered to handle documents? In this case, what type of applications perhaps support these? That's quite okay. So that's kind of where I would start gives you a global overview of that So if you just Google LS register against Mac OS command, you run it with a dash dump flag And it'll dump the state base. You can also look at an applications info.plist file Which is something that all applications have and in there they can have a set Actually array a dictionary of key value pairs that kind of tell the operating system What type of applications? Sorry, what kind of files they support and this is actually how that database gets popular So for example our shop office lists the doc files and file formats it supports Obviously a browser will have a large list including HTML files probably PDFs, etc. That's a great place to start because then you can see the file format and then I would look at the more esoteric or Unrecognized ones and start fuzzing or playing with that because it's kind of mentioned in my talk the reason that this vulnerability existed specifically the automatic execution of macros was that Microsoft actually has two separate code paths for handling macros based on these file types No, obviously the main one for documents and then a whole separate RK at code path that probably no one ever looked at for these older file formats always a good idea that looks for these More esoteric ancient file formats because there's a lot of security bugs there because they were created in a time when security wasn't really Any time an afterthought gets pulled forward into what's happening now is probably an interest in space Exactly Cool next question coming in also from a sneaker net. Is there a way to programmatically scan Mac apps? Oh, we did that already Let's see here if you consider trying to do something similar to this kind of research with iPad OS or any other kind of non non-windows OS or mobile OS That's a great question. I predominantly focus on Mac for two reasons First my personal opinion is really good to get really niche in whatever area that interests That's just something that I found to kind of have a lot of success in my post-second security career The other fact and guess I will admit this is hacking Mac is far simpler than hacking an iOS Operating system or iPad OS. No, largely this is just because of how it walked down that operating system So I think there has been some research done in the past based on, you know, custom You are all handling which is largely how applications and certain file formats are kind of connected in a way on iOS But you know, even if you found some interesting Issues there you would have to break out of the sandbox and then deal with a lot of the extra constraints that iOS and iPad OS Kind of stack on top that with Mac OS And then you really don't have to worry about too much. I mean you did have to find a new sandbox escape But you showed that was pretty trivial to do and there's been kind of history of that So, you know the TLDR iOS is just really a hard target So I'll probably just stick the Macs for now So that's an interesting statement though that you found that getting really niche is the thing that helps you continue to find new interesting Vulnerabilities, so you're keeping your target list really small. Can you talk about that any more and some of the What are some of the strengths that that's bringing you and can you think of anything that you're missing that? Maybe if there was one more thing you wanted to add Yeah, I know and that's something that you know, as I grow older and wiser It's something that resonates really well with me So, you know long time ago you used to work at the NSA national security agency everyone's favorite US government spy agency and I remember when I got there I was an intern and The intro program you kind of bounce around from different office kind of sampling different Activities, let's say I remember thinking how I want to be good at all of this like crypto and like We're sitting here in malware and writing Windows exploits and hacking satellites like a really cool stuff The NSA does and I got the point where I was like, you know It's just impossible to have depth in so much breath So I said look I'm gonna kind of focus on one specific thing And actually it was only when I left the NSA was what I really started focusing on max the reason for that was at the NSA I did predominantly Windows Stuff and so when I left I wanted to still use my foundational skills of reverse engineering Vulnerability discovery exploit development, but I didn't want to do it on the same platform I was kind of poking around with the NSA just it's good not to cross any lines and you know You don't want to piss off the NSA. Hey look, let me focus on Mac. I can use my same skill sets, but it's a separate platform so I will step on close and Moving forward with that I really kind of doubled down on that and it really allowed me to get a lot of depth in the topic and I've noticed for You know finding new vulnerabilities Giving conference talks, right at least for me having that depth has really allowed me to come You know, so what an expert in the space I would say And allowed me to really dig more into maybe the more esoteric parts of the operating system where a lot of Vulnerability fly whereas if I was trying to do that across maybe multiple operating systems and multiple platforms It's just I think a possible game at much depth So that's something that's just really worked for me I would say the one downside is sometimes you might miss Attacks that work on one platform that might have a conceptually similar Vulnerability on Mac OS one great example. I can think of is DLL or dilate hijacked it was a very common kind of attack scenario on Windows and I you know when I was still kind of coming into the Mac space. I decided to see if macOS was Vulnerable at least conceptually to the idea of hijacking Dynamic libraries based on search pattern turned out it was and I just happened to be the first person that kind of dug Into that and talked about it So I still think it's good to keep your eyes and ears open and see what other research other people are doing Just to be inspired and then kind of say hey, it's just something I can bring into my platform But again, I've had a lot of success really focusing just on one platform You know Mac OS not even iOS as much so again to me, that's worked really well. I think it's Yeah, thank you for talking about that a bit because it's nice to hear somebody who's gotten a lot of success With a pattern like that because there's there's many different patterns that I've been Hearing about even this weekend. So it's it's nice to nice to get that reinforcement Yeah, I would agree with that because I do a lot of digital forensics, right? And you know, so I see a lot of Windows stuff come across and I see a lot of iOS stuff And it's kind of difficult to know a you know, if I'm gonna dedicate some time to build up some skills You know, so the broad base should be targeted and I'm Digging what you're throwing down there Next question, okay, so you showed how putting a zip file into the login items They can turn the intern contains a P list with a launch agent, right? So does Mac OS really register launch agents on the creation of the file in this case creating it via an unzip? Also, actually what it does is it automatically processes it on the next login So it doesn't trigger it right away on creation But on the next login Mac OS will automatically just enumerate all the property lists that are created in the launch agent Directory does the same thing with launch daemons and any property list it finds it just runs it So that's really kind of a neat thing that we were able to leverage as a mechanism to get this kind of code execution outside Sandbox the only downside is we then have to kind of wait until the user re logs in But you know, I like to say, you know humans are impatient, but our exploits are malware You know don't have to be right. We drop this launch agent and we have to wait two or three days Or even a week until the user re logs in and then we get a call back like so be it, right? Generally, we're not in that much of a rush But it is interesting that Mac OS kind of automatically runs those and something that we can in this scenario Leveraged to our own benefit Sure follow up from the same person they asked question did any P list to confined on the file system No, it actually has to be in the launch agent directory, which is either in Tilda user slash library launch agent or slash library slash launch agents So Mac OS will look in those specific directories. It looks for other Items in other directories for example, there are other launch daemon directories Which it looks for for other property lists, but again those have to be in those specific directories Cool So, you know a lot of this starts by you talking about macro attacks and macro attacks have been popular on Windows for a long time in fact using Macros inside of office documents, and you and I roughly the same age That's that that's how you would get out of like the net nanny kind of stuff or Get away that you get around the stuff that they put on the stuff at high school or middle school So you couldn't get on the right, you know, yeah sexual invitations is good. Well, it's it's fine now So it is bananas to me that this stuff kind of persists now Do you? Do you think that this is kind of a trend towards macro based attacks towards Mac OS or Is this just kind of a situation where you know the guys there are you know, if you've got a hammer in your hand Everything looks like a nail kind of a situation Yeah, no, it's it's interesting because I think what we see two things happening Macs are definitely becoming more prevalent You know seen this Especially in the consumer space, but now also in the enterprise space, and I think that's one of the reasons This is very anecdotal. I don't have necessarily dated to back this up But you know you go to college campus even three or four or five years ago Everyone has Macs right and now those students have graduated or interned workforce. What do they want? They want Mac computers understandably so right so we're kind of starting to see growth in the enterprise of Macs as well Apple obviously also pushes for Macs In the enterprise, you know, they're great Hardware great software So Hacker hackers are obviously very opportunistic. So as they see an increase in targets, they're obviously going to start So one of the things we see is we see hackers developing Mac specific attacks and we've seen this trend I would say in the last year or two almost taking off the same time in peril the other thing we see the macros is a great example is we see Windows-based attackers or windows-based malware that have had success on the windows platform kind of courting those techniques over So obviously as you mentioned macros on Windows has a very illustrious history a lot of success So those same attacks, you know can work on macros so hackers are kind of like hey We we know how these macro work. We have the infrastructure. We have experience. Why not target Mac users? so macros is probably the best example of traditionally windows Infection vector, let's say being ported over or brought over to macOS I think in a direct response to Macs increasing in the enterprise because these macro-based attacks still require Microsoft products and the average consumer is probably going to be using Apple's office document apps Which aren't susceptible to macro-based attacks, whereas in the enterprise I think that's where we see the uptick in the installation of these Microsoft products on Macs thereby opening the door for these macro-based attacks. However, though, we also see for example Adware, you know, that's been predominantly targeting windows, you know the Chrome on Windows or Edge or Internet Explorer same kind of idea, right? Hackers and malware writers have success on that and say hey we can work these to Mac pretty easily Well, it's kind of cross-platform This these techniques and these malicious extensions we've created So, you know, why don't we start targeting Mac users because they're growing in numbers So we're definitely seeing more and more of these windows these kind of like old school or very well-known windows based Confection vectors and attacks now kind of showing up targeting Macs And it's interesting because I think Mac users maybe are at more risk Because you know, it's like what Mac users thinks that they can get a macro virus on their Mac like zero, right? traditionally Apple's marketing has kind of put out the message that Macs are immune And so a lot of Mac users believe that so whereas someone on a Windows computer might not open a Word document from a random email a Mac user might so hackers may be having better success rate actually like targeting Mac users You know using these kind of well-known techniques that might not fly on Windows anymore, right? Or for that matter not know that the office on the Mac can support some of that stuff that would be also running Over on the windows side, right? Yeah, I wouldn't expect a VPK macro to just go ahead and run. Okay. That's crazy sound We love it There was a little bit of a follow-up from JKBC KR who asked the P list question I'll just pop this out here. Oh, I got it The zip was placed in till the library and extracted folder called launch agents with the P list inside Which is the current or the correct location for launch agents Okay, so a quick follow-up if that's okay Does this only work if there was a no launch agents initially otherwise archive utility would rename that launch agents to right? Yes, and that's actually a really good point So the reason this generally works is because on a default install of Mac OS There's no launch agent directory under users So there is one in the slash library directory We couldn't write to that location from the sandbox So what we could do though is we could write to the users library directory right till the slash library But especially crafted crafted is it file there? And then the archive utility would create the launch agent directly for us because again We could also not create or write a P list to that directory because Microsoft's patch Specifically for beta. So yes, if that launch agent directory is already there this specific attack then you would fail what we could possibly do though is create files and other locations and perhaps create a You know dot bash RC file or some other file that leads to code execution Someone also mentioned perhaps you could do something with sim links. So maybe sim link We put a make a zip file with sim links. I haven't really dug into that But I think the fact that we can outside the sandbox create kind of arbitrary files The launch agent path was really just the first one I tried that worked But there might be other venues that are more globally applicable that for example, for example, wouldn't fail if the launch agent So that's a really good question and an excellent point to make Excellent, okay We'll step back for a second to a sneaker net has another question Are there any Apple specific protocols you found really interesting protocols can be their Interprocessing the same system or between devices. This is an example sidecar between laptop and iPad Yeah, so they're actually the IPC mechanisms in macro ass are are full of Security vulnerabilities or have been in the past So one great example is just the handling of these custom URL schemes So it turns out that if an application supports a file format Or supports a custom URL scheme custom URL scheme can be like block colon slash slash anything You know each one example, but applications can also create their own custom URL handlers as a kind of lightweight IPC mechanism, and this is used legitimate An application contains a custom URL handler as soon as it hits the file system Mac OS actually parses that application and registers it as a custom URL The URL can then be launched from the browser Luckily recent versions of browsers now will alert the user basically saying hey a web page is trying to make a custom URL Custom URL request, but in the past that was not the case We actually saw the wingtail APT group abuse this technique to target Mac users specific So their exploit you browse to a website in the background with download an application that handled a custom URL scheme Mac OS would automatically register that Behind the scenes as soon as that application hit the file system Their exploit code would then just make a URL request from the malicious website, which is totally legitimate something you can do Back to us with a book and say hey Yeah, I have an application that can handle that and then blindly and naively launched the malware which had just been downloaded So these custom URL schemes are kind of a max specific protocol or an IPC mechanism where there are some interesting Issues especially in the past. I think my other favorite protocol or IPC mechanism is XPC Ian beer Google has done some great work finding all sorts of vulnerabilities some other Google project zero Brandon researchers have found bugs as well And basically XPC is just the way where a client can talk to a usually a privileged server And so it's really good to kind of enumerate the API endpoints that the server has and The biggest issue is usually it doesn't correctly validate client Which means once you're on the system you perhaps can talk to a trusted service and do all sorts of nasty things This is often applications specific based on the XPC server, but Apple has had all sorts of issues here So for example the well-known root pipe vulnerability was a great example There was a XPC service running on Mac OS as groups and it would think It's create random arbitrary files and run arbitrary commands as root and it didn't validate the client So as soon as you were on the box You could just send this XPC protocol request to this XPC service that was running and it'd be like yeah I'll run whatever you say and so it was like the easiest best for the gestulation vulnerability is there So XPC great protocol Apple specific I always look at what kind of servers and applications if they have an XPC interface and start auditing those because Oftentimes there's security issues That's your big blinking red light, huh? Yeah like poke on that hard Okay, so we have found ourselves in the last five minutes on this if we have any more really good questions You want to drop in here then please do in the meantime? This is when I've taken to asking people if they have a general call to action a Something you would like us to take away from the presentation that you've done something that you'd like us all to consider and move forward with Yeah, I mean I think You know this is probably obvious to anyone listening here But a lot of Mac users think that Macs are infallible And and this actually puts themselves at risk because you know a lot of Windows users will maybe Participate in best cyber safe practices, whatever that means, you know Don't download random apps click random links and emails run random applications or the macOS People are prone to do that a little more. So, you know, just realizing Macs are just as hackable windows It's an operating system that runs code. So kind of Just kind of stick with that the other thing and this is kind of a self-clug, but it's for free content so I don't feel bad in my Presentation I announced free Mac OS book series. I'm working on so if you go to TAOMM.org the arc of Mac malware.org I'm working on a free book about Mac malware analysis So it talks a lot about Infection vectors these property lists this XPC stuff. So if you're interested in, you know, Mac malware vulnerability research Check it out. It's all free. The content I've published the first part of the first volume It's actually commentable on So, you know, if you see an error or you want some input you can just add a little comment And I will add that into the content again free resource Basically trying to help provide more information for the community so that we can combat Kind of the rising tide of Mac malware. That's that's definitely coming Well, that's something I can look forward to as well So thank you if you would be so kind as to Drop the URL for that in the track one and if you are willing to do so with any other Contact information for you or a Twitter profile or something you want people to follow. That'd be a good place for that Yeah, and I'll put my Twitter my DMs are open obviously. I'm very passionate about this I love the nerd out talking about this Any questions shoot me at the end and we'll chat so excellent Thank you. That's we've gotten to the end of the questions in the live Q&A chat. I Think that you've been a fantastic guest here and we really appreciate your willingness to come and build a presentation And then spend some time with us in the QA So, yeah, thank you. It's always an honor to talk at DEF CON I just feel super appreciative to be able to share my research with just the DEF CON community. I mean, they're just The best Well, we're the best because of the people who decided to come out and do this stuff. So thank you all Seems like that's about all we have so Anybody who wants to do any follow-up on this one? You will have some contact information showing up and Thank you all for showing up and we'll we'll do more later. Cool. See you guys later. Thanks for coming


Hello, my name is David A. Wheeler, and I'm here to talk about securing open source. I hope to convince you about four key points, attacks, weakness, hope, change. Attacks, weakness, hope, change. What do I mean by that? Well, the first part, I hope you already are convinced of. Attackers are attacking systems. They're attacking those systems via the vulnerabilities that they have when they are deployed and also through their supply chains. Weakness. Sadly, those attackers are often succeeding. And this is primarily because current development and supply chain processes really often don't adequately counter-attacks. And even when they're fixed, they often don't get deployed in a timely way. But I don't want you to leave without hope. There is hope. There are counter-measures to attacks, and there's ongoing work to ease their deployment. For change. We need to change how we develop software, how we select it, how we deploy it. Things like making sure that things are secure by default, and we're going to need to continuously learn from adversaries and anticipate adversaries. I think that first point about softwares under attack is pretty obvious. These are just some logos and some indications of examples of software under attack. The top left symbol there is Heartbleed. But in fact, there's a whole bunch of different attacks and vulnerabilities. But of course, repositories have been under attack. The more recent SolarWinds Orion subversion was caused through a subverted build environment. It didn't matter what the software developers wrote because the code they wrote wasn't what was going to be used for shipping. There's an interesting paper called the Backstabbers Knife Collection that reviewed over 174 supply chain attacks, found a dominance of type of squatting attacks, for example. And a good part of this problem is that most projects and organizations simply cannot accurately summarize what software is within their system. And some of you may say, oh, hey, we use cloud, therefore somehow we're immune to all this. And of course, that's ridiculous. Dan Lawrence has this interesting article where he notes that today's cloud infrastructure is still being built out of duct tape and kite strings. So he played around with Helm 3. He looked at a particular Helm chart and tried to answer what you think would be simple questions. So what software was installed, where did it come from, how was it built, and he could not answer those questions. And as a result, he made some interesting observations. One of course is if you think your container scanning setup is catching everything, think again, he found 25 vulnerabilities in just that one package. And he noted that, hey, package managers add convenience, but every layer adds trust and I would also add adds time. It can take a long time for a vulnerability that's been fixed to get through all those layers. So I think it's helpful to think about how is software developed? So this is a simple model of software supply chain called a supply chain integrity map. You can see it's a simple map, what goes on. Developers work within their local environments, then send their changes and so on off to source and data repositories. Then that software gets built and verified. Eventually it's approved for release to be sent out to various package repositories and distribution platforms. Hopefully that's assessed in various ways, both the builds and the eventual packages. Finally, people select and acquire them and then bring them into their environments to go through the cycle all again. And eventually things get deployed out to operations and of course there are cycles here because smaller components get brought into larger components, which get into larger components. But of course, if you look at this from the point of view of an attacker, that's a system. And systems can be attacked and a great way to learn how to attack them is to look at those parts and see how those various parts of the system can be attacked. And these red squares are just sample kinds of attacks and there's a lot of them. Typosquadding, which is basically confusing to acquirers and developers into thinking they're installing one package when they're installing another. Dependency confusion where they think the software is coming from one repository but it's actually coming from another. There's malicious software, there's all sorts of vulnerabilities that go in as part of developments and there's a whole host of problems. But I don't want you to leave with, oh my gosh, there's so many problems. Because in fact, there are countermeasures. And these are again just a sample of countermeasures, various approaches where you can do various things to counter some of those attacks. I certainly can't talk about all of them. But a trivial one I'll note, for example, is one of the big problems right now is developers often don't understand a lot of things. Nobody teaches them in classes. And so a little education and training can go a long way. And of course, that's not enough. There's various tools you can add to say the build verification processes and so on to really help. There's no silver bullet. There is no one thing. If you do the one thing, congratulations, you have solved all problems. That's not how it works. Instead, you need to bring a variety of approaches to bear to counter the different kinds of attacks that attackers can do. So what can open source software developers and users do? Well, if you're not already doing these already, here's some first starting steps. You'll learn how to develop and acquire secure software. If nothing else, take a look at the secure software development fundamentals course. It's free. So on edX, go take it. There's others. Take those. But learn how to do this stuff. Make the software secure by default. Make it easy to use securely. Harden it up against attacks. If you're doing open source software development, work to earn an open source, I'm sorry, a CIFS practices batch. There's the URL. Use many tools to find vulnerabilities in your build and verification environment. No, tools will not find everything, but they're helpful as part of a solution. Of course, monitor for known vulnerabilities in whatever you depend on so that you can immediately respond and immediately update. Of course, in order to do that rapid update, you need to use package managers and automated tools so that you can rapidly respond when a vulnerability is found. And I mentioned these tests, those need to include negative tests. In other words, there are some things that should not be allowed. Test for that. Make sure they stay not allowed. This is something that people often forget, particularly if they're using TDD. Finally, evaluate software before you select it. Look for typosquadding. Is that really the right name? Is that software malicious? Do you have reason to believe it's secure? And when you're evaluating, here are some sample things to consider. Is it easy to use securely? Is there evidence that developers work to make it secure? Is it maintained? Has significant use? What's the license? If it has not an open source license? Shockingly, it's not going to be collaboratively developed like an open source project. If it's important, what is your own evaluation of it? And the good news is lots of folks are working to make things better. The OpenSSF, for example, Open Source Security Foundation, is working on this. There's a number of other projects here. In fact, this is a short list. There's many more projects and foundations and organizations working to make things better. So, if you are an open source software developer user, you need to do all those things I mentioned earlier, but you also need to prep for the future. Here's some things that I see coming down the pike. You need to start being prepared to generate and request software build materials. There's a lot of pressure in even high levels of government and so on, to start saying, we need to know what's in our software, and we need to be prepared to answer that question. It's a reasonable question. Look for more information about the software before you select it. There's organizations like those within the OpenSSF that are working to improve information about the software, that you're to improve information about the software, so you can have better information when you select it. I think verified reproducible builds are important. That's particularly useful for countering subverted builds. Improve cryptographic signature verification. We've had this for a long time, but it's challenging to do verification. I think Sigstore has a lot of promise, but we'll see. But no matter what, I think this is something we need to see more of. More generally, integrity attestation approaches like in Toto, and increasing use of memory safe and more generally safe languages. More broadly, working with others to help make things better. There's a lot of opportunity, and frankly, there are folks who could really use your help to speed these up. So let me do a quick recap. I came and said there are four key points I wanted to talk about. Attacks, weakness, hope, change. I hope that you'll see that it's, yes, there are attacks, and yes, there's weakness, but there is hope, but we'll need to change to take advantage of that hope. A quick parting thought, developing and deploying secure software is a journey of learning and improving. It's not a single event, but that's okay. We just need to get started. Thank you very much for your time.