Balls are in the bucket. Forty-four. High? Sixty-three. But... We know chicken dinner. Fifty every day. We go sixty-nine. Hundred and four. Hundred and fifty. Thirty-five. How? Two hundred. Why is the man dead? I'm trying to go all the way around. I guess it's probably not all the way around. That's the problem.


is Wednesday, December 21st, 2022. I would like to call to order this scheduled public hearing of the Chittenden Solid Waste District for review of the preliminary proposed fiscal year 24 preliminary budget of the Chittenden Solid Waste District. First item on the agenda is the agenda itself. Are there any additions or changes requested to the agenda? I'm seeing none. I'm hearing none. The agenda then will be accepted as presented. Second item on the agenda is a public comment period on the proposed preliminary budget that was presented in the packet. Are there any members of the public attending either in person or remotely via Zoom or telephone who wish to address the Board of Commissioners concerning the proposed preliminary budget? There are no members of the public. I am seeing none. I'm hearing none. I will therefore close the public comment period. Next item is the public hearing itself of the budget. Sarah, would you like to make any preliminary comments? Just to remind the Board and the public that this is a requirement for our charter that we must have a public hearing on the preliminary slash proposed budget for the fiscal year no later than January 31st proceeding to fiscal year for that particular budget. Due to the diligence of my management team and finance team, we were able to present the preliminary budget to the Board last month and have been able to expedite this process, which means that we can start our full budgeting process with the finance committee next month, a full month to six weeks ahead of our normal standard time, which is excellent. So I would just like to commend my team for doing a lot of hard work and making that happen. Thank you, Sarah. I would also note that the preliminary budget does show a surplus and I think the most important message to extend to the public and to the select boards within the district that there is no anticipated assessment for property taxes as part of this budget. So it was important to get that in the record should people come and look at this information after this meeting. Are there any other comments or discussion to be had on the proposed 2024 preliminary budget? I'm hearing none. I can't see if any commissioners hands are raised via Zoom. I will presume that's not the case. At this point to entertain a motion to adjourn this public hearing. So move desicc second south Burlington. It's been moved and seconded to adjourn this public hearing. All those in favor, please say aye. Aye. Aye. Any opposed, please say nay. The public hearing is now adjourned. We're ready to move on then to the regularly scheduled meeting of the Chittenden Solid Waste District Board of Commissioners. Before we begin, I just want to take a moment to introduce the new alternate from South Burlington, Allison Lazarz. She is here present in the meeting room tonight. It's a, we're delighted to have the team from South Burlington rounded out. There is a learning curve involved. I've encouraged Allison to speak up whenever she has a question. She's got a great tutor and Paul Stabler here, but it's great to have this addition to the Board of Commissioners. So welcome, Allison. With that first item on the agenda this meeting is the agenda itself. Are there any changes or additions requested to the agenda? Sarah, your hand is up. Thank you. Yes, I had to update in my executive director's report, which I don't think needs to actually be removed. So if you would like Paul, I can simply update in either other business, or if you want to pull the, can we go and get there? And then for item number five, the administrative office, I would like to remove that item from consideration. I decided that we should put that part of the project out to bid. So we will not be asking for authorization on that item and instead we'll be putting that onto bid this week or next week. So you're asking to remove item five in its entirety from the agenda? In its entirety. In its entirety. And then you have a, just to be clear, a little additional information on the executive director update, which you say you can handle in other business? In other business or if, I don't think that it warrants pulling, it really is just an updating of a date. So it's up to you if you want to. Why don't you go ahead then if you, well, no, we haven't gotten to the consent agenda. I'll ask that at that time. Okay. Any other changes to the agenda? So just to be clear again, item number five, the administrative office will be removed from the agenda. If there are no other requested changes or additions, then the agenda will be followed as amended with the removal of item number five. Next item on the agenda is the public comment period. Are there any members of the public present via Zoom or the telephone or in person who wish to address the board of commissioners? There are not. I am seeing none here. I am hearing none via Zoom or telephone. Therefore close the public comment period. Next item on the agenda is the consent agenda. Are there any requests to remove an item from the consent agenda? At this point, Sarah, I would invite you to just update us on your executive director update. Thank you. So the item about the EPA grant, I just wanted to update the due date. So the EPA has extended that timeline to February 15th. So we have, everyone has an additional month to work on the grant. Thank you. With that update, are there any requests to remove an item from the consent agenda? Hearing none here in the room and seeing none on Zoom, the consent agenda then is accepted as presented with that one additional bit of information. We'll move on then to item number four, listed as other businesses, really as old business. This was something that the commissioner from Milton, Henry Banges had asked to be put on the agenda last month due to the lateness of the hour at that meeting. It was, we postponed the presentation of this item until this meeting. And so now, Henry, I'll turn it over to you to share your thoughts and concerns on the item of furniture deconstruction, I believe. Yes, thank you, Paul. Yes, I joined the board here four or five months ago, I forget, and one thing that many of us see in the landfills is concerned as far as furniture. And that particularly was adventurous to me because my wife does upholstery and I build things. So I'm quite familiar with how much of that furniture is actually reusable or recyclable. And then on top of that, just came across the New York Times article, headline is fast furniture is cheap and Americans are throwing it in the trash. And it says during the pandemic from 2019 to 21, the amount of desk chairs, patio equipment jumped by four billion. It didn't have with the base value and it would have jumped by four billion. And most of the furniture designed by Ikea and Wayfarer is only designed to last about five years, okay? So we're looking at, those numbers should be clear, okay, vastly increased amount of furniture going into the landfills. And so just offered to the board and Sarah and the team has something to consider. How can we get ahead of this, okay? And instead of reacting to it and the furniture deconstruction was just my thought as far as a solution to it with the idea of, Sarah said maybe that's use for the old Murph facility. I'll call it the old Murph now. I think that's okay to do, but I, and possibly in, but with that I was just suggesting a pilot program to see how effective it is. The furniture comes in there and of course the metal recyclable but a lot of people may not be aware but those foam cushions are also reusable. If not, besides also being recyclable but they could also be reusable and actually worth quite a bit of money because they're nothing but oil. It's just process oil. So that's my concern. You know, suggest some type of deconstruction look be looked into unless somebody's got a better idea. And with that a pilot program before the old Murph becomes available for an alternate use, which will still be some time a pilot program to evaluate it. And then if we did something with the old Murph as Sarah seemed to like, well, we'd already understand the impact it could have some logistics figured out. So thanks for the time, Paul. That's my nickels worth all yours. Thank you. Sarah, did you have anything would you wouldn't want to add at this moment before I just open it up to commissioners for questions or comments? I'm interested in what other commissioners may have to add. Audio is not great for me here but nothing to add. Other commissioners at this point wish to offer any comments. Leslie. Sarah or anyone else on the staff here. Are you aware of any other facilities across the country that are doing furniture deconstruction? I think it's a really interesting idea. Not as a municipality or none of the districts I believe, Jen, you may have a better sense but I don't believe any of the other districts are doing deconstruction. When Henry and I discussed it, part of the concern that I had would be just the space needed for storage until deconstruction could occur. Most of the deconstruction that I'm aware of is around mattresses and there may be some smaller programs that are kind of like the ARC programs that are job training around a certain particular trade but nothing along the lines of a municipal activity. And so, as I mentioned to Henry, we haven't decided what we may want to do with what will eventually become the old Murph building. So really, a lot of options can be explored. So it's good to talk about some of these things and see if there's a possibility and what benefit there may be. But no, I'm not aware of any formal programs from a municipal school. I wasn't so much thinking about a municipality but about firms that might be doing it. In other words, is there a market from what materials and is this something that could be contracted out if there's no market for materials then it becomes perhaps an issue? Yeah, so the model that I look to is the current mattress recycling model. And I know that that industry where they do choose to deconstruct, so there are kind of two pathways. One is deconstruction and the other is shredding. And where they do deconstruction, they very much are reliant upon the markets, particularly in scrap metal markets and the textile markets. And several years ago, more than that now, probably a decade ago, you could move a lot of the fabric components out of mattresses, both the fabric and the shoddy. That right now is very difficult to move. The scrap metal goes up and down and then the other component in furniture could be, as Henry mentioned, it is foam and then wood. So there could be some value in the foam if you could collect enough of it, perhaps densify it, sell it as a fuel starter, kind of a product of the fuel pack and wood, there's not much market for that. So it would be marginal at best. Thank you.  Yes, when you deconstruct it's basically four items. This may be obvious, okay, but there's the fabric or leather or faux leather, whatever the covering is. And there's of course the metal, obviously recyclable. Then there's a wood, which is depending how it's treated is either trash or it could be burned, okay, along with the other scrap wood. But then the biggest one, volume-wise, is the foam. And a lot of the foam could actually be re-sold and not even one market to explore because, again, my wife buys a lot of it, okay, to do a poultry and so that can actually be reused, but would have to find a market for it. Then beyond that, I haven't looked into processing the foam into recycling it, that would take a little bit of research. But it really comes down to those four materials. The one being the covering can be multiple materials. So it's really pretty simple. And again, what we're just, if we, now's the time to be researching it. So yeah, good to have some questions there and what can be done. And so I haven't researched myself, probably, should have as far as what companies are out there that do deconstruction, that would be something that should be done. Thank you. I have a question really for staff. Do we have a sense that you could share with us how much material, furniture material is disposed of throughout the district? There is a volume or percentage of material that we have to deal with. I think that would be an important question to nail down. I don't have a number right off the top of my head. I know that we do receive couches, chairs, different types of chairs. We've got categories for different types of furniture and we do collect those in bunkers at our larger sites off the top of my head. I don't want to give a number that's not accurate, but I could definitely look into that and get back to you guys. It's not a larger volume than the bags that we bring in. It could be a data point in the state's waste composition study, I think it is. So you could look that up and extrapolate for Chittenden County. I think that would be a good number to have and my bias would be, and I think Leslie was kind of intimating it'd be, it's a great idea, but encouraging a private enterprise just along the same lines as the mattress company that just got going. Having that kind of market information for Chittenden County might be an encouraging signal to a private company that this is something that they could get into and perhaps do it profitably. So Paul, we have Lee and then Rick and then Henry. Thank you. So yeah, I don't know, obviously City of Burlington deals a lot with furniture left on, within the right of way, and we haul it to Cassella and just thinking, I'm wondering on the invoices because I know there are certain charges for different materials. If I can kind of extrapolate something out of that, but I know it's a fair amount that we pick up every year, especially, the city does a good job with student move out, but there's inevitably still furniture, unfortunately, as Henry pointed out, the wood in certain instances is recyclable, but if it's painted or stained, we can't bring it down to McNeil, as you know, and unfortunately that goes into the landfill. But maybe I can do some poking around what I have for invoices and paid invoices and find some information on that. Thank you. Yeah, sir, I'm gonna rely on you. We can't see the hand raised, or at least I can't too well, who's got hands raised, but Rick, I think, you're up next. Rick is next, yes. Yes, this isn't directly about the furniture, but it is about the reuse of the mirf. It's interesting to think about what we might use that for and I was thinking that sort of discussion was wildly premature at this stage, but I'm wondering if maybe we should schedule alternative uses for the mirf for some time maybe in the spring, mostly because if there are ideas that call for data collection such as exactly how much furniture is disposed of, we would have time to actually conduct that kind of study. Agreed, I think it's a great idea. Add it to the agenda and Paul will talk to you about March or April, and so we can kind of start that conversation. I now have the ability to see hands raised on Zoom, but I believe you had said, I know Henry, you had mentioned, Sarah, is there somebody else before Henry? And Henry put his hand down, so that may have been a leftover hand. All right, any other questions or comments? Thank you, Henry, for bringing this to our attention, and I think we've got some good questions to ask and move this process forward and seeing if it's something that we can actually address in a substantive way. We'll move on then. Next item on the agenda is executive session for the purpose of discussing Flint Avenue and the Materials Recovery Facility or Mirf contract. We will require a motion to enter into executive session. So Moose up Erlington. Thank you. Thank you, Musford. Thank you, it's been moved and seconded that we enter into executive session for the purpose of discussing Flint Avenue and the Mirf contract. All those in favor of entering executive session, please say aye. Aye. Aye. And opposed. We will enter executive session. As usual, there are some commissioners who will need to recuse themselves. I think we'll make that decision once we're in executive session as to which topic we address first. Let's do that. So we'll see everybody over in executive session. Present Amy. Yes, we do. And we are back, Paul. Thank you very much. Do we have a motion to exit executive session? So Moose, Jericho. Thank you, Jericho. Do we have a second? So we're in South Burlington. Thank you, South Burlington. It's been moved and seconded that we exit executive session. All those in favor, please say aye. Aye. Aye. Opposed, Seine. We have exited executive session. We're now back in public session. Next item on the agenda is for action on a memorandum of understanding with the city of Burlington. Sarah, do you have language to read into the record? Yes. The commissioners authorizes the executive director to extend the memorandum of understanding with the city of Burlington to June 30, 2023, and following the provision in summary terms as presented by the Department of Public Works Director, Chief and Spencer, in his memo to the Burlington City Council dated December 5th, 2022. So Moose, South Burlington. Seconded, Mara Essex. Thank you. It's been moved and seconded to extend the memorandum of understanding with the city of Burlington to June 30th, 2022. Is there any discussion on the motion? 23. 23, excuse me. June 30th, 2023. It's gonna take some time. Is there any discussion on the motion? Hearing none, seeing none. All those in favor, please signify by saying aye. Aye. Aye. Any opposed, Seine. Any abstentions? The motion leads. I'm sorry, Lee? Lee. Lee has abstained. Thank you. The motion carries. Do we have a motion to, well is there any other business that commissioners like to bring forward tonight? We've already had other business. Move we adjourn. Thank you, it's been moved. Seconded. All those in favor of adjourning, please say aye. Aye. Aye. It's adjourned. Everybody have a great holiday.


So, it is now 10 a.m., and we are ready for our first talk, and I know you've been waiting for both of you have been waiting to do this talk for a while, and it's my pleasure to introduce you, Vesem and John. Hello. Backside, can you hear me? Okay, thank you. Today, we will talk about Wi-Fi threat modeling and monitoring with my co-worker. But firstly, I want to introduce myself and my co-worker. But before I begin, I want to say we love Wi-Fi hackers. I am Vesem. We come from Turkey, and this is a lot of information about me. And for now, I'm working as a security engineer in Barikat Cyber Security in Turkey. And I am developer of the Wi-Fi Hunter project. Wi-Fi Hunter project can detect a lot of Wi-Fi attack and can monitoring a lot of Wi-Fi threat. And today, I will talk about the Wi-Fi Hunter. And I'm founder at Pantester Training about Wi-Fi. And now, I am student in Turkey in computer security and Suleyman Demiral University. And before then, I will attend a lot of conference in Barikat in Davkon. Before then, I did presentation in Barikat Arsenal. And I have a book in Turkey about wireless attack and monitor defense. But just now, just Turkish. And if you learn a secret information from my book, you should learn Turkish maybe next year. And I have a hobby for fight against the Wi-Fi hackers.  Thank you. Hello, everyone. Hello, everyone. Is it clear? Great. I am John Kurnas. Actually, I'm originally from Turkey. We worked together then I moved to Netherlands two years ago and I'm now working for KPMG Netherlands. I already presented on Blackit this year and also last year's Davkon and this year's Davkon on IoT Village, etc. My hobbies are IoT and ICS security. I'm working as a penetration tester and I'm also contributing to Wi-Fi Hunter. We are also discussing each other for ideas, etc. And also, this project come up with collecting the ideas when we are discussing. So, today's agenda, we will talk about, of course, Wi-Fi networks. We will try to profile Wi-Fi hackers. Then, after doing this, we will try to create some sort of threat model about Wi-Fi hacking. Then, we will try to fight against Wi-Fi hackers. And of course, at the end of the presentation, we will discuss about the recommendations. Sorry. Okay. I made a mistake. Sorry. Yeah. So, about the Wi-Fi networks. Yeah. Basim was developing a tool called Wi-Fi Hunter. Basically, the idea was trying to see the Wi-Fi pineapple around your company or around your environment. If you run as an individual. So, after that, we come up with an idea that we can maybe create some sort of a tool that we can do every single step to catch Wi-Fi pineapples. And then, we started trying to implement some tools in order to have some sort of protection for the Wi-Fi hackers. And as you can see in here, mostly, if you're already connected to a Wi-Fi with your phone, after that, basically, your phone will take a look on everywhere. If your Wi-Fi is open on your phone, it will take a look everywhere by just sending the proper request to the air if the access point is still over there. Yeah. Your phone or your laptop will constantly send this, then it will be looking for an answer as a proper response from an access point. So, if an access point that you already provided the password, or if you have been connected to an open, let's say, access point, with the same SSID or the same name, if any of any other access point will answer to that, answer to your phone, it will try to create an authentication request. Your phone or device will send authentication request to the access point, then access point will send back to authentication response, then the connection will start, and also the association request and association response. After that, you will be connected, basically. So, your access point is just sending the beacon frame, and your device will try to find the SSID that already knows. So, we try to create a profile of the Wi-Fi hackers. We take a look to the, let's say, field, what they are using at the moment. And mostly, we've seen that they are creating open Wi-Fi networks in order to prevent any password authentication, because it's really easy to connect for you. And a lot of stores, a lot of places, malls, etc., are providing these kind of open networks, so it makes sense, right?  That's why attackers use that. You realize that's important for them. And also, they tend to use interesting SSIDs for rogue access points, because it will also bring your attention to these access points, and you will try to connect them, like, I don't know, coffee break, like, if you sit on a Starbucks a lot of time, you will see SSID names related with the coffee, etc. So, they are just creating smart and catchy access point names. Then, of course, it's really easy to create rogue access points by using Wi-Fi pineapple. They're also selling it in here, I think. It's quite famous. It's really easy to use. So, we've seen a lot of Wi-Fi hackers are using this device. So, they are basically performing automated attacks, automated Wi-Fi attacks, like collecting SSID information, creating SSID pool, and creating rogue access points with this SSID pool. So, basically, they are trying to catch you by using the smart names. And they're also using host APD mana to perform automated Wi-Fi attacks, like GTC downgrade, which is basically on the enterprise networks. By using this downgrade method, you can get the password on clear text. They're also using this technique, and also they are using karma attacks, that this one basically will explain it later on detailed. And then, after collecting these kind of profiles, we try to create a threat modeling for Wi-Fi. Because, of course, the security of an object is quite associated with the other objects that it's used. So, I mean, if there's a weak point on a chain, it will be a problem for you. So, we come up with this map. We are, of course, open to, let's say, develop this with you guys. If you have any advices, or if you want to discuss anything on this, please don't hesitate. So, we focused on, let's say, roughly three points. First, the access point, of course. The second one, your Wi-Fi IDS and IPS, intrusion prevention and intrusion detection system. And, of course, the environmental threats. So, for the access point, we realized there are some open source tools or open source, let's say, sources that you can find your SSID, your geolocation, your password. Basically, some tools, right, on Android or something, on iOS. Basically, when you go somewhere, if you get the password, then you're just writing there and providing everyone the password and the location. So, someone else would come there, and then they can check if the password is over there, and they can use, connect for the free internet. So, we are checking Wi-Fi map leak. We basically downloaded by using the API. So, it's also risk. Of course, the other open source, let's say, source places are also risk. And also, we are considering the version of your access point and also brand of your access point as a threat, because it could be, I mean, it could be vulnerable to a certain type of attack, or it could be vulnerable to, I don't know, some sort of an exploit. So, we also need to be aware of that. We are also considering that as a risk and threat. And, of course, broadcast denial of service is a risk that could affect your access point, and it won't be available when this attack comes. And also, for the access point, pretty sure, we are also considering the password is a threat because if you are using weak password, which is quite easy to crack, it's also a risk, right? And, of course, for these access points, we have users which are connected to the access points and also the user devices are a threat for the Wi-Fi environment because basically your phone, your laptop, et cetera, are saving the password of the access point. And also for the users, if someone else sends proper requests for the user, sorry, so the user sends proper requests to the air, then it might leak some sort of information about the access point or about anything else. Yeah, some location like a hotel name, et cetera. So, it's sort of... I mean, what can I say here? I mean, last year you stayed in Vegas and you didn't tell your wife but your phone connected once, then when you go home, your phone will try to send it again, try to find the access point of the Caesar's Palace, then it would be a threat if it's detected right. So, you can think about something like this. And also the karma attacks are a risk. And for the Wi-Fi intrusion detection systems and intrusion prevention systems, we also wanted to know how secure are them or how mature are them because, yeah, you are having them, you are setting this up, but you don't know if you set it up securely or if you are not sure if it's correctly implemented. That's why we are also considering this as a risk. And of course, rogue access points are quite a big threat for this environment in the corporate or inside of your company, et cetera. And out of the corporate or outside environmental threats, we will discuss it later, but basically we come up with this threat map. So, we will try to fight against Wi-Fi hackers and Bessim will continue after that point. Thank you. I come back again. Everybody ready for enjoy for Wi-Fi pineapple and karma attack and some deception techniques. Before fighting against Wi-Fi hackers, we must know all solutions don't need to be complex. So, we will think as basically and think basically and apply basically. Firstly, I will explain some technique for detect karma attack and in this techniques, we will use FF methods like fake probe request, probe response and beacon packets. But before detect karma attack, we should know what's going on around here during karma attack in environment. If you know what happened during karma attack, you can solve everything. So, karma attack generally use a lot of probe response for all probe request. If your devices want to connect another network and send probe request and if there is an attacker in environment like karma attacker, always generate probe response and want to trap client for collect a lot of information. And this is a detection method and I collect a lot of information from air and some analysis about this packet and I see some interesting information. Karma attacker send a lot of probe response from just WEMAC addresses. This technique first method for us and I create a tool name of tool pKarma and pKarma can detect karma attacker with first method like this, I won't say. Firstly, I am my tool with help option and I check my interface name. It is monitor mode or not because I need monitor mode interface and I set for the send the authentication attack when I detect a lot of probe response from WEMAC addresses. I send the authentication attack for save all client from karma attacker and as you see now, collect information from air and detect karma attack. As you see, this is karma attack activity, WEMAC addresses and five probe response for create a fake access point and send a lot of the authentication packet as you see in Wireshark and save all clients. This is the first method for us and like same previously methods but I did show difference. This is a free Wi-Fi different tool and generated probe response like karma attack and I can catch again with this method. And another method for us if attacker creates a lot of probe response with different MAC addresses, first method doesn't work for us. So we know if send a probe request to environment and if there is karma attacker in environment send to us probe response. So if generated probe response generated probe request with fake SSID firstly and send to environment if some devices send to us again probe response with same SSID we can say yes, we catch karma attacker in environment. So for this you can use SCAPI and generate fake probe request. In other methods if know how does work access point and how does work karma attack we can solve everything as you know. Access point always send beacon packet and probe response and beacon packet and probe response same so generated by access point. Beacon packets include the SSID SSID and target information as a broadcast and probe response same SSID and broadcast information. So if I see some information like probe response and I want to show you I run karma attack with my disk computer and I catch a lot of packets and I save I save for analyze this is host APD mana activities for karma attack and I want to show you from Wireshark if you want to analyze from Wireshark some Wi-Fi threat activity you can use wireless and wireless local network traffic and you can see in here a lot of information like this one MAC address created with Adrum SSID a lot of beacon packet but same MAC address send and a lot of probe response from just when I make addresses and if you choose this and click and apply as a filter select it create for us a step link I will create some special filter with Wireshark and this is a probe response and I want to see if this access this real access point I must show I want to see beacon packet with this SSID but if I cannot see beacon packet with this SSID I can say this is fake and this is karma attacker because karma attacker cannot generate beacon packet generate just probe response yes as you see I can see just probe response with this SSID and I cannot see beacon packet so I can say this is a karma attacker because there is no any beacon packet related with this SSID and now I will show something about Wi-Fi pineapple detection technique and firstly we must know like karma attacker how does work Wi-Fi pineapple and what happen when during attack in environment Wi-Fi pineapple in environment so we will show three methods firstly same SSID analyzes secondly beacon packets and fingerprint techniques for Wi-Fi pineapple and this is a first method for detect Wi-Fi pineapple and generally Wi-Fi pineapple collect all SSID information from air and parse beacon packet and probe request and collect all SSID information and create SSID pool after create SSID pool generate beacon packet for create a fact access point so if you see two access point two beacon packet one of them encrypted and another them unencrypted with the same SSID you can say yes this is a this is Wi-Fi pineapple activity but you should see one more then and I will show demo and write tool and this tool analyzes pick a file for detect Wi-Fi pineapple activity activity use first method with same SSID and different encryption and now running and read pick a file before then I create a Wi-Fi pineapple and generate some activity generate some packet for activity and save it for analyze now reading pick a file and we should wait just one minute this is a real demo live backside can you see okay now reading all pick a file and I want show my code analyze all packets and give us some information I write with this copy and find total packets and found unencrypted Wi-Fi and found encrypted Wi-Fi networks and as you see find same SSID but different encryption in a lot of Wi-Fi broadcast and now we can say yes this is Wi-Fi pineapple activity in the environment yeah and I will share this tool after our presentation you can access from GitHub and I want to explain another method about Wi-Fi pineapple activity same karma attack this is same karma attack but different with this point karma attack generally send probe response from one MAC addresses but Wi-Fi pineapple generate a lot of beacon packet from just one MAC addresses and if you see a lot of SSID broadcast from one MAC addresses you can see this is a Wi-Fi pineapple activity or let another hacker tool activities and same method with the karma attacker and finally we can detect Wi-Fi pineapple with the fingerprint as you know before I begin I say all solution don't need to be complex this basically but does work for us every time and for fingerprint Wi-Fi pineapple firstly create one fake access point if attacker create one access point first method and second method doesn't work but if you use this method and fingerprint when connect the network you can detect Wi-Fi pineapple and how many people use Wi-Fi pineapple no I did see your sticker in your phone yeah okay and when I connect Wi-Fi pineapple I did see some interesting information like port number over HTTP and clients and users cannot change port number from web UI and as you know Wi-Fi pineapple is automatically devices for Wi-Fi attacks and if users cannot change port number from web UI don't change every time use with same port Wi-Fi pineapple if you check when you connect to network Wi-Fi network if you check port number maybe you can find Wi-Fi pineapple and another item for Wi-Fi pineapple use default hostname and a lot of user don't change this feature and detect from this and when you connect to network if you check DNS support maybe you can say yes it could be fake access point or Wi-Fi pineapple and I have a demo for this I developed tool name of tool P finger and as you see firstly I will check my interface as a client mode not monitor mode and I type my interface sorry and as you see I find port number as a true and manufacturing information and other check information for detect Wi-Fi pineapple and fake access point when I detect port number is true I visited from website like this yes we catch Wi-Fi pineapple is correct for us you can try if you have a Wi-Fi pineapple you can try or if you don't have any Wi-Fi pineapple just connect one open Wi-Fi network and check this feature this options and we think if attacker use another Wi-Fi pineapple techniques and to a mission we develop new tool name of tool P open and as you know firstly my co-worker explain Wi-Fi hacker profile and Wi-Fi hacker generally use Wi-Fi open Wi-Fi network when want to create fake access point and in this screen as you know firstly P open detect all open network in environment after detection we can connect automatically with external or internal Wi-Fi adapter and after connection we must do some fingerprint techniques and firstly you should know some Wi-Fi hackers profile information generally Wi-Fi hacker when want to create a fake access point use DNS and or open Wi-Shark and or use are spoofing like this and generally access all access point has one web interfaces with username and admin when I connected network with P open after detection open networks I check this information like Wi-Fi pineapple if I want to check Wi-Fi pineapple firstly check default configuration with same P finger techniques and check another information like DNS spoof if there is a DNS spoof ARP you can say yeah it could be fake access point because it is anormally not normally it is not normally if you see DNS spoof ARP in Wi-Fi networks and this is another techniques for deception if there is a attacker in environment you can run this deception technique for hackers and as you know generally Wi-Fi hackers use hostAPD-WPA for create enterprise fake access point when create the fake access point enterprise you can send a lot of information fake with the fake username and when attackers see all users want to connect to fake access point wow what the facking and I have a demo for this as you see this is a attacker mission and create a fake access point with hostAPD-WPA and this is a blue team mission and creates fake connection request to enterprise access point and as you see always send fake connection request and in attacker mission you can see fake request okay and we name of tool p-trap as you see create a lot of fake request to enterprise network if there is a attacker in environment you can confuge mind yeah you can confuge the hacker and another deception technique for Wi-Fi pineapple and for karma attacker this is a pinocchio John if it's possible can you explain pinocchio no okay this is tool firstly collect all SSID information from air and can parse all MAC addresses and all MAC address SSID information from probe request after parse all information you imagine this is a proxy on air and collect all information and change all SSID and send again to environment to air and if attacker in environment you can put a lot of fake probe request like amroge turn off Wi-Fi and fake access point dangerous Wi-Fi to SSID pool in Wi-Fi pineapple you know and if you generate like this SSID probe request you can karma attacker always generate probe response with this and when you check your phone like this and check your computer you can see a lot of information and attacker inform to you am attacker always inform to user in environment this model just collect SSID information and change all SSID information and send with the same MAC addresses to environment and if there is attacker in environment you can see like this and attacker inform to you about attack and another threats for us and as you know John explain something when talk about the Wi-Fi attack map this threat for us the authentication attack hidden Wi-Fi network SSID brute force similar SSID open network in interesting SSID all of them threat for us and we create tool name of tool Pdance Pdance can detect and monitoring all environmental threat environmental threat not a direct threat for your company this we can we should think it could be threats maybe next time but not now so if you see a lot of the authentication packets in the environment you can say maybe hacker try collect handshake and maybe hacker try jamming for disconnect all client from networks and maybe hacker try trap clients with the ROJ access point and always disconnect client from real access point yes it could be threat for us not now but maybe next time another threat for us interesting SSID and as you remember John explain this feature when talk about Wi-Fi hacker profiling and hacker generally use interesting SSID and sorry if you see a lot of information with interesting SSID in environment not directly to your threat you can say yeah it could be threat and it could be hacker here because we see a lot of interesting SSID in environment and another threat for us similar SSID if you have a company and broadcast some SSID like barricade can you explain this John basically if you are using a name with the capitals and if someone else will create with some of the lower characters or if someone else would use for instead of A or I don't know at instead of A like this and yeah it's quite likely that you might connect on these networks because you already know the original name and if you are drunk or if you are not having attention it's likely to connect to these networks thank you and finally threat for us in environmental threat how many people know malicious cable and VHD injector how many people and as you know devices when you plug to your computer or some client computer create for you hidden network and you can say you can connect to hidden network and hack clients but this is so this is threat for us we should hold monitoring all hidden network all hidden Wi-Fi network for the tech this activity if you detect some hidden network in your environment and maybe if you analyze and detect real name of the hidden SSID maybe you can detect malicious cable in your company or malicious VHD injector like usp like this this is just example it could be another devices and as I say we create a tool in Wi-Fi Hunter if you use this tool can detect all of them hidden SSID information same SSID and authentication attack density like this and now we have no any recommendation yeah if you have a pineapple Wi-Fi pineapple please turn off your Wi-Fi pineapple and get us okay thanks to all Wi-Fi hackers thank you for listening us


Um, I want to introduce the next speaker. It's a gift read books Rhonda He's gonna talk about the Austrian e-held system a lot of projects. So give a warm welcome Hello Like I was introduced my name is Gaffred Fuchs. I'm working on deviant since about 10 years and since two years, I'm working for SVC the Austrian e-health system company and The talk is about the system Which is Imparts based and run by deviant. That's why I'm giving the talk here First I'm going giving you a short overview about what I will cover The first part will be Description of what the company actually is then What the Austrian e-card is what it is for The e-card project itself and the last part might be the most interesting for those that are Interested in the technical aspects, which will be more in detail explained later in the week This talk is sort of to Split into two parts the part today for the general public and the part Which goes more into the details and the issues we are facing that part will be held on Friday so Jeep cards Yes company for running the system and What is in February 2001 by paragraph 31 of the Austrian law It is owned 200% by the hopped for banned the social facilities trigger Which is the main association of the Austrian? Social security insurance institutions It is an It is organized at a Private limited Company, this is what the gets and be how means And the mission of the company is to establish to implement and to operate and extend the LC which is your electronic system for multiple applicative smart card system within the Austrian social security sector and Yeah, the know-how of system development and operation is also based within our company especially in the area of health Telematics and e-government So the e-card system is not only for the health care, but also for e-government I will shortly cover that but it's More or less a side topic Now a short overview about what the Austrian e-card actually looks like and what does it store The e-card has two sides one is the front side Which has the chip on it? It stores the title Academic title first name last name The Social security number which is a insurance number unique to the person And the card number on the left hand side below the chip On the backhand side it is the European health card which can be used in any country Not only limited in a EU in the European Union, but also across the world If you are in health problem, you can use this card to get identified and get The service of the practices of the medicine practice It stores also the same information mostly which is on the front side Additionally some some unique identifier number and the date Until which is this it is valid and also which insurance company You're enrolled for the key card principle means The e-card contains Identification data like a unique key all this information that is printed on it The only additional data that is not Printed on the card itself is the sex of the person That's also stored on the card, but that's the only non-visible card information stored on the card It is not a carrier of applications the applications are stored on the systems of the practices it is meant as an access key and it just works as an access key to the system-based services and This access key is unique within the whole system. There are some RSA keys and Some hashes are used on the chip which are meant to identify you and make the communication between the doctor and the insurance company encrypted and safe Lost tokens lost key cards get locked through the system so that they cannot get abused The extended vision of the e-card usage include social security It is meant to replace all paper-based health insurance vouchers It mostly did that in very big parts already when you go to the doctor you just Give them your e-card. You don't get any paper anymore from your company with which you go to the doctor You just go with directly with the e-card to your doctor Also They There is this system called abets RUM abets on tickets Meldung Which means that you are not able to work which? gets stored in the system and you get the payment form from the insurance company and things like that and There are also quite a lot of other subsystems which are For which rare in the early years done through paperwork, which is now electronic based You have the key card for secure handling of medical transactions like the the practiser sends the data of your Consulting to To To your insurance company and gets the payment for that all this is done through the system E government It is There's also to try to get a sort of burger cart or citizen card and The e-card is ready to host the information for the citizen card which with which you can do government Bury or critic things You don't have to go to the To the different Places anymore you can do that online with your with your e-card if you have it Extended to be in citizen card and Yeah, there are also some other application for third parties Which might use this in the future. They are not very many of them I think I'm not not really aware of a single one right now, but There might be future uses in that direction and Also e-commerce There's there are some cryptographic tokens Which are still unused on the chip card which might be used in that direction the e-card project Is divided into several sub projects? The main sub project is the system integration to get all of this working the consultant system when you are at the doctor you put the chip card in and This consultant information is sent to the insurance company for payment The card system itself like the card reader and things like that and Also the network which I will cover later a bit more deeply call center of course for problems that the different practices might have with with their hardware Rollout and training for how to use the system At least administration client of security of social security institutions In hospitals, they usually don't have a single system. They have bigger installations and require We require to be able to administer all of these themselves like network IP address assignment and things like that and Adjustment to the special environment this can be done, but I'm on on their own and there are also medical software producers who use a soap interface that is available through the system and can do additional services for the for the doctors Now short overview about the time It was started in 2001, but the first two years there were more or less quite a fair amount of Problems of really get it started and rolling The sub project or partial project were done or put into place between 2003 and 4 the implement implementations started in 2004 at the end of 2004 there were the first pilot medical practices put into Life Test operations in 2005 and the national role nationwide rollout started in 2005 Now I'm coming to the probably most important or most interesting part of the talk the chin The Austrian health information Network Chin's stands for Gesundheit Informations Network and yeah, that's the English term them What is chin it's the e-Health Internet? It's the connection of the physicians pharmacists hospitals Over a broadband technology it uses the SL or cable modems least lines It uses MPLS backbone for quality of short quality of service assurance reasons, so that there is a Ensured minimum bad bandwidth available Which is required for a reason that I will shortly after that explain Centralized assignment rules. There's a database server within our local in a data center in Vienna which runs the whole system and stores all the Consulting informations especially for payment reasons to the insurance companies and There's a centralized management of the complete network Why was the chin established? For high requirements concerning security quality availability and that it's scale able for up to one gigabit access for For instance hospitals which have Like mentioned not just one system like a local Practicer They have usually a fair amount of more Here's a short overview picture of the infrastructure on the top left we have our data center where all the consulting information gets stored and all the Information about who has a an e-card and who is allowed to Get serviced by the practices In the middle, there's the chin Which is scattered around the whole country of Austria There's the social insurance institutions which also offer additional services and There in a chin network you have the pharmacist physicians Hospitals and the likes and There's also some value-added services like formerly mentioned the citizen card Thing and some some other similar things that would like to offer service through this network To make this all possible there is sort of a peering point required and This is can be seen as the firewall to the internet it rules who is allowed to get to which services outside the chin network and It's there for security reasons mostly It is also part it was also split in and in its own company So that everything is clearly defined who is responsible for what part now we come to the Debian system actually The medical practice unit MPU. We usually call it Gina for Gesundheits Informations Network adapter Which is The practice unit This is the hardware that is at the practiser directly on the right-hand side At the top you see the old system The card reader will remain the same same for the foreseeable future So they are currently talks about getting new hardware for that done, but it probably will most Most likely be the same. It's also Linux based, but there's No devion running on the card reader the box below is Currently MIPS hardware Which is Five years old or even more and just has 256 megabytes of RAM and also flash There are no moveable Parts in the system. So no Ventilation or anything like that because it has to be in Practices Offices and therefore has to be absolutely quiet. They're quite strict regulations with respect to that and other parts requirements We are currently in the rollout of new hardware Which will be atom-based with hyperthreading one gig of RAM four gig of SS solid state disks and It has a TPM module Which we use to store the client certificate all the communication between the boxes at the practices and The central system are encrypted for security reasons To get an overview about Some numbers There are around 12,000 clients spread all over Austria from the far west to the far to the east and All these need to get replaced with the new hardware. So That will be quite a task Gladly, it's not done by our company, but by the providers. They have the technicians that Drive to the practices to exchange them We do software updates to the systems twice a year It is done in four steps. There's first the medical software producers Get the as first the new software so they can adapt to the new interfaces that are offered for different subsystems The second phase is the servers the database get it gets adjusted for the Changes required for the new software rollout then there is the 300 which means a sort of Roll small rollout to just about 300 clients In which we test if the update really works There is a lot of internal quality assurance tests like you might expect But we need to Test it in the field because the field has a complete different in some specific areas They have a different environment than what we can do internally so we first have this rollout of three hundreds and If everything Goes properly with that the rest of the world or the rest of the twelve thousand systems Get updated in one single night and this is quite a stress test for for the whole system bent with why with wise and everything else because Sometimes you don't reach one of the Gina boxes anymore and you will have to get them back to a decent state Because when there is really a problem with about 1,000 boxes or so you can't send out that many technicians So the base system is currently Lenny There are a few additional packages which are mostly for internal use Software distribution reasons like the internal use packages like the software distribution part is actually also part of a package and We roll out that as first and then do the dist upgrade afterwards There is a specific rescue partition Which usually usually is not touched during the rollout, but some few weeks later so That we have a full back point the application stack which the Practices use is Java based They roll out also some There's some hotfix mechanism in there to be able to update Some of the bundles that get rolled out for them The rescue system is a specific partition Which gets booted when the system is not able to boot for ten times in a row into the application So when the application doesn't start up properly, you can always do a rescue and The box gets reset to a known good state from which you at least should be able to log into it again and Do the investigation what's going on? What's the proud? What's the problem in case the rescue system doesn't Fix the issue. There is a technician which has to get on site But that's usually then hardware issues and not software related ones so That's more or less this part of the talk Here again the name of the company for your amusement and Like mentioned on Friday, I will go into a bit more details with respect to the technical aspects of the system like the issues we are facing with having to update 12,000 boxes in one night and If you have any questions Please bring them up now Austria was famous for its Certificates on a mobile phone for a while. So it doesn't mean that now Both can be used interchangeably both the card and the certificate on a mobile phone You mean for the citizen card I'm not really involved in that part, but yes the citizen card isn't really you're not required to have one and Actually any cheap card usually is able to work a citizen card. It was one of the requirements for the e-card system that it's possible to use it as citizen card but You're free to use any other cards or like you mentioned mobile phone For for the citizen card for the e-government thing. I have another question concerning this health system Are the patients records Retained are they still at the hospitals or at the primary health care or There's they are in your company In our system, we only store the consulting information that is required for for the payment between The doctors and the insurance companies. So there's no patient data stored besides the unique key of the card But there's some sort of So so anonymization like the The card gets another unique key that isn't directly related to you as person and Someone having this key is not able to figure out that it would be you mean one way one way function. Yes Why do you have such a large than data center? for Ragging yeah, and else Well, the system is quite big for 12,000 clients across and then health care is a Really critical system. So there is a lot of standby service for when when there's issue and There's a lot of data running Over this when you go into a hospital and see how many people are Constantly getting service there. You May be able to mention what amount of data is flowing through the system actually It's it's a very huge amount of data that is running through this system and because all of it is Done through encrypted channels. There's also a lot of processing power involved to get this data Properly processed and in time because When you are in you have an emergency you don't want to wait a minute or longer for for the return of of the Whether you are allowed to get serviced or not Is it hl7 data? Oh, I'm hl7 standard data um I'm not really sure about that I Don't have that information. Sorry And did you as a company provide all the necessary applications for everything or just Some part maybe network part or what? well There are different applications that is offered by our company like I mentioned that OM the that it when when you are not able to work anymore or When you're sent from one doctor to another that's also another sub system currently We have rolled out a test system for e-medication where there's checked for interactions between different medications and Presented to the doctor. This is just a test system for now, but Things like that are running through our system There are always the medical software producers who can do additional services on top of our stack and There are some some people doing that The question was because of this reason. There is a primary health care and there is an let's say application for the primary health care, then there are special applications for example for for laboratory and then in the there is a Hospital information system with all the different modules. It's pretty much complicated and then some special applications such as radiology whatever so Speaking about the public part of the health care I assume that you have a public part on the let's say private part. Is it is it centralized? Is it is it? No, no, this is just for patient Payment related things Specific software which which might be used in an at a doctor like for a dentist who likes to store all the x-ray files for teeth and stuff This is absolutely not covered by this you might want to talk to Andreas tiller who is related to the Deviant made Project, but this system is completely unrelated to deviant made because it has a complete different Aim or target Thank you finally So I have several questions by the people on IRC that are working are watching your talk remotely Okay, I have several questions from the people watching your talk remotely and they are asking by IRC So I have two questions that can be put together That is do they use other a standard deviant system or do they have to use their own Linux kernel and so on? and if There was any software in the base or system other than the internal application that needed to be added to the VM to support the project I have an understanding problem Okay There is two question better now. Yeah, there is two questions the first one The was there any software in those in the base of in the VM Then it is to be added for supporting the system your application and so on besides what you have in deviant And another question that is coupled with this one is that If you use a deviant standard system and if you need a modified kernel For the first part The kernel is especially tailored for the system With respect to the old hardware there is For Java there was this IBM J9 Which only offered Java up to the tool up up till 1.3 Which is quite ancient nowadays But there is no newer virtual machine for MIPS hardware that we were able to use So we are very glad that this new hardware is now input based to be able to offer a more recent Java stack for the application developers I Shortly mentioned there are not very many Additional packages mostly For the system itself the applications that are offered to the practices Um There is you can hook into the system directly just a monitor and keyboard and use it directly There's a web interface offered If you hook the monitor and keyboard into it you Technically get an e-max that displays the same web interface that you can get if you If you go directly with with a web browser to the system and through that you work with the system The following question is related to the hardware They are wondering why you are using auto and not for example ARM ARM Yes In the office for the new hardware there were arm Proposed but actually didn't deliver the The benchmarks that we required for the CPU especially with respect to open SSL and Signing there's no floating point unit in the ARM processor and this was one of the issues Why? The ARM offer was denied And the final question is a bit of topic They are wondering if you could compare the Austrian system with the German one or another country It's a bit of topic If you could compare the Austrian system with another country like Germany In Germany there's a lot of talk going on. I think the system in Germany is not fully established yet and there's a Lot of press talk going on which Might be or true or might not be completely true There's of course the Elga the electronic electronic health act In a hot topic also in Austria, which would mean to store more patient data But this is nothing our company is pushing or Pressing forward we actually would have to implement what the government Decides in that respect In our system, there's just the consultant information currently stored and Not very much more You mentioned Yes, you mentioned There's a second key on the card that's not connected to the individual directly Yeah, there are several keys and there's also some more space on the card for Which might be used for future expansions or future other services. It's not fully used yet It has 52 kilobyte of data storage Which doesn't seem a lot, but if you just Store the if you count the characters that are in a usual name It might still be very much and there are Just the the key stored the encryption unique token Which identifies you to the system the additional keys one of them might be used for a citizen card and Like mentioned future improvements in that area so none of the secondary keys are used for health care no, and How much capacity is typically occupied now? Pardon and how much of the 52 K is currently in use typically I'm not not really aware of that, but it it's Definitely on the lower side. This is the new generation cards the former cards had like 32 or 36. I'm not completely sure And they also weren't completely used One practical question. What would be the minimum requirements for someone new to the system to join it? Infrastructure infrastructure wise you have a contract with your provider and you sort of lease the hardware from them and That's practically it's From what I understood that the requirements for for the bandwidth doesn't require you to have a A very high bandwidth Connection it's it's rather on the low side, but there are special requirements for the minimum bandwidth that is Ensured for for all the times what I wanted to know What I wanted to know do do you need to lease? Special line like a VPLS No, no, it doesn't have to be a lease line any DSL connection Just to plain internet line. Yeah There's one more question from IRC. They wanted to know the cost of the atom box The cost of the atom box I'm I'm I fear I'm not allowed to give that information even if I would have it But I don't So I was not directly involved in the decision and I Especially in the financial part of the decision So you were saying you were using Java for a lot of your domain specific Applications stack you use the Debian mechanism to update that as well Pardon and you said that you were a lot of your software were written in Java. Yes for the MPU Do you use Debian mechanisms to update that part? No, the Java bundles so-called bundles are Our outside the devian package system this It more or less there is a and a revision number stored in the bundle and if there's a different revision available on the on the web it downloads a list of of the bundles the available ones and Fetch us the ones that are newer on the side. Okay the Metadata overhead would be Banned with wife not not the best option to put all these into devian packages so if There are no more questions. I thank you very much for your attention These are the websites on chip card at RT you even can found For fulfilling the GPL you can download the sources of the packages that we have installed Besides our own stuff that is mostly for internal use but Thank you for your attention See you around