All right, students will get started. Okay. Yeah. So a good morning to all of you who are here and a good morning to all of you who are online. And we'll start off today with first Kings. We looked at first Samuel and second Samuel, which was mainly about Samuel the prophet and also about Saul and David. And now we are coming into first Kings, which is mainly about King Solomon and about all the events that occur after the kingdom gets divided. So and of course, we have some important Kings. We have many important Kings. Ahab is one of them in the Northern Kingdom. We have Jehoshaphat in the Southern Kingdom. So these are some of the main things that are covered in first Kings. So let's get going. The genre will obviously be mainly narrative history because we have a historical record of all the things that took place. Also, there would be many prophecies mentioned because the Lord would probably be prophesying against people or he would be prophesying in favor of people. So the main genre that we find in first Kings would be narrative history and also prophecy. Now who is the writer of first Kings and second Kings? There's not much clarity regarding that. Some scholars say that most probably Jeremiah is the one who would have compiled all the historical records. Different people would have written down records of events which are taking place. And then finally he would have brought it all together and compiled it into a single book because if you look in the Hebrew Bible, they don't have first Kings and second Kings. They just have the book of Kings. It's only in the English Bible and then in later translations that people began to divide it into two halves. But otherwise you just have basically one book of Kings. And so Jeremiah probably did the compilation except of course for the last portion in second Kings which talks about something which happened after he was dead. So except for the last portion most probably Jeremiah would have compiled the rest of these two books. And it is generally said that he would have made use of a lot of historical records which other people had been writing down from time to time because these things are mentioned in first Kings. First Kings 1141 talks about a historical book. Can someone tell me what first Kings 1141 talks about? Which historical book does it talk about? Any historical books at all mentioned in first Kings chapter 1141? No, then in that case it must be so sorry. Second Kings 1141. Second Kings 1141. So it must be first Kings then. Unless I really got the whole thing wrong. Exactly that was a historical record which was maintained at that time. It's not mentioned here in our Bible but that was a historical record which someone was maintaining. So another one that is mentioned in 1419 is the book of the history of the Kings of Israel. That was another record which someone had written down. So based on all of these records under the inspiration of the Holy Spirit, Jeremiah or whoever else did the compilation would have chosen the portions which the Holy Spirit is urging them to choose and only those portions would have finally been mentioned in our first Kings and second Kings. So there were a lot of historical records which were maintained at that time and the Lord would have decided which portion should enter into the Holy Scripture. So the person who did the final editing, the final compilation, he would have chosen those portions which the Holy Spirit is urging him to include and only those things would have finally been included in our Bible. So they say that maybe this compilation was done by Jeremiah. Moving on to the key personalities in first Kings, of course you have David and his son Solomon, then you have Rehoboam and Cheruboam and then you have Elijah the Prophet. Ahab of course is mentioned, this Jezebel. These are some of the main characters whom we see in first Kings. Why was first Kings written? Of course it's providing a historical record of Israel, the Kings which they had. It also gives a more spiritual angle to the whole record in the sense it's pointed out whether each King followed the Lord or not. You know, it generally starts off with that description, whether this was a man who was following God or whether he was a man who was disobeying the Lord. So we see a very clear description of whether they were under submission to Yahweh or not and generally we notice that those who were following Yahweh always had more blessings did better during their reign and the ones who were not really committed to the Lord, their political fortunes were not that good. So we see this in these records. We also have one important, we have two important prayers, a lot of important prayers in fact in first Kings but one of the main ones is the Solomonic prayer, the prayer which Solomon makes when the temple is dedicated that would be chapter 8. So that's one of the important prayers which are included in this particular book. Structure, coming to the structure of first Kings chapters 1 to 11 is where we have Solomon coming to the throne. How did he come to the throne? What are the politics involved? What conspiracies happened? All of that is mentioned and then of course how he builds the temple, all the other things that he builds, all those things are mentioned. Also chapters 1 to 11 also talk about how he backslid and how he married a lot of foreign women for the sake of the political contacts that he can get and he finally dies not in an honorable way but after having gone away from the Lord. So we see all of those things in chapters 1 to 11. The second portion of the book chapters 12 to 22 will be mainly a record of what happened after the kingdom got split up into two portions. So that is the main content of the second portion and we have Elijah being mentioned very prominently in the second part because he's the one who deals with Ahab and wants him not to go on with his idol worship and all of that. So those are the things we see. Now when we talk about Israelite history, a lot of Bible students are rather very confused about the whole thing but then there are some very basic things I think which every person who claims to be a Christian should know about Israelite history. Mainly because it's basically from that lineage that the Messiah came and those stories, those specific stories were put there in the Old Testament for us to learn from, for us to receive correction from.  You mentioned David Solomon, they'll put up their hand and say, yes, we know these people but you go a little beyond that and they have no clue and sometimes the situation gets rather bad. They're not even aware that the kingdom got split into two and there was a northern kingdom and the southern kingdom. Now that's rather bad. It's all right maybe if you're just a lay believer but here you all are students of the Bible and so we would need to know some of these basic things. So we will try to cover some of the main major things which we would need to know as Bible students. Of course it would not be possible to get into all of the stories but at least the very main things. For instance everyone knows that Solomon became king but not many are very aware of the conspiracies which took place, how it was difficult for him to come to the throne and what and all they had to do to finally put him on the throne and all the backstabbing and all the scheming which happened in the background. Not many seem to be even aware of that. They just assume that one fine day David says, my son why didn't he go sit on the throne and he goes and sits on the throne and that's the end of the story. No but that's not how it takes place. So in fact if you look right in the first chapter of First Kings is where you have the older brother. Of course I think David had many sons but one of the most prominent among them was Adonija. So Adonija had this deep desire to be on the throne because after all he was one of the elder brothers. Solomon on the other hand was not very important. He was somewhere down the line. So Adonija always aspired to be on the throne and so he when his father is too old and no longer is able to move around and inspect what's going on and like now he's almost sort of bedridden in his room always. He's too weak to do anything and so Adonija thinks now is the right time for me to put myself on the throne and so he literally establishes himself on the throne taking the support of some people. David's commander Joab is one of the people who supports Adonija. The other person who gives support is Ebiatar. Joab and Ebiatar are two people who had been with David almost his entire life through all of his struggles and I'm not sure why they did not want to remain faithful to Solomon but they decided to take sides with Adonija and so they hatched this conspiracy to put Adonija on the throne. But Zadok the priest, Nathan the prophet, David's special command, you know the soldiers who are like a special unit who did great battles, you know even they even killed some giants and all of that. They remain faithful so they don't participate in this conspiracy but many of the other important figures they participate in this conspiracy and they put Adonija on the throne and Adonija who is greedy for the throne what do you think he would have done next? One of the first steps that he would have taken is to somehow get rid of Solomon because if as long as Solomon is alive he will be a threat and so then it is Nathan who comes along and he wants Bathsheba the mother of Solomon that their lives are in danger. She says you better go and inform the king about what has happened because they didn't have news channels, they didn't have phones, mobiles so David would not even be aware that something like this is happening because he's confined to his room he can no longer walk around and all of that. So Bathsheba goes over there and tells the king about what is happening and then David is very angry and he says no no Solomon has to be on the throne because God is the one who ordained that God decided that Solomon would be the successor and so it must be Solomon who should be placed and so he calls his faithful priest Zadok and so a small party of you know supporters of David they take Solomon to a place named Gaihorn and over there they formally anoint him as the king and the people of Gaihorn have a big celebration and it says in chapter one in verses 39 and 40 talks about how there was a great celebration and it says in verse 40 all the people went up after him playing pipes and rejoicing greatly so that the ground shook with the sound so while this entire celebration is going on to celebrate the new kingship of Solomon the other king who has established himself Adonijah he hears all this noise coming and he thinks what is this great celebration that's going on and because he's having a party of his own you know his coronation party and so he has invited all these guests and they are having their celebration and then they hear this loud noise coming from Gaihorn and they are wondering what is going on and then A. B. Arthur the priest his son comes running over there and he says you know what David has gone has to overcome a conspiracy and then we established as king and we talked about Adonijah's reaction when he realizes that he has been found out his conspiracy has been found out he goes and takes hold of the haunts of the altar and asks for mercy to be spared and Solomon promises and says that he will spare his life that he will not kill him and so Solomon responds to the situation in a godly manner he could have very legally rightfully killed and executed Adonijah right then and there but he does not do that he just simply says in verse 52 if he shows himself to be worthy not a hair of his head will fall to the ground but if evil is found in him he will die okay so he gives him a second chance and how does Adonijah respond when he gets a second chance he comes up with a new scheme on how he can take the throne because now he goes to Bathsheba and he says you know I've lost the kingdom I was the elder brother I should have been on the throne but now it's been given to someone else but maybe there's one act of kindness which you can do to me and so he says you know request permission so that Abhisag the Shunamite who was a concubine of David either she can be given in marriage to me and it's almost like as if he's indirectly saying you know I am going to be marrying a concubine of David so now I have a say to the throne I have a right to the throne so he is declaring himself as a contender for the throne so this indirect tactic he adopts in the hope of still being able to snatch back the throne and so when Bathsheba goes very innocently to Solomon and makes this request you know Solomon says what a foolish request because if you know if I were to give Abhisag permission for Abhisag to be married to Adonijah it would be almost like giving my entire throne to him and so he says Adonijah does not deserve to be spared anymore and so he you know so he is punished and Joab who has participated in the conspiracy he is the one who goes running now and he takes hold of the horns of the altar that we see in chapter 2 verse 29 so Joab who participated in the conspiracy this time with Adonijah he runs to the altar and takes hold of the horns of the altar but because he refuses to leave the altar and come outside yeah one thing that we need to know about Joab is that he doesn't just go into the courtyard and take hold of the horns of the altar in the courtyard he actually goes inside the tent inside at that time they still had the tent right because the temple had not yet been built so he actually enters into the holy place and he takes hold of the horns of the altar over there and so Solomon says you know he's been given many chances and so he must be killed and so Joab is killed for his treason so just for us on a side note the temple or the tabernacle which was there in those days it had five altars okay so the first altar is the one in the courtyard you know where you have most of the sacrifices being performed and then you also have that large bronze vessel which they used for washing their hands and for ritual cleansing and all of that you also had two altars in the holy of holies and there is one at the entrance of the yeah there are two in the holy place so sorry there are two in the holy place and one at the entry to the holy of holy so totally there are five altars and Joab actually runs into the holy place and takes hold of the altar over there and he refuses to come out and so finally I think it is Benaya who goes inside and kills him right then and there at the altar because of all his unfaithfulness even towards David as well you know the man was not exactly very good in his value system so we are so we this is the conspiracy which takes place and finally because the Lord's hand is upon Solomon he is able to come to the throne this is one basic thing that you would need to know as a bible student okay another thing is about Solomon himself the promises that God makes to him and how does he respond to the blessings of God so we see that in chapter three yeah just a minute please I'm just worried that I don't know should not miss out on the online students okay yeah in Solomon starts off his rule in a very godly manner with much devotion and dedication because we see in chapter three that he goes to gibbian and how many burnt offerings does he make on the altar over there first kings chapter three I need to do this from time to time just to keep my students awake so that you know they do not go into another realm first kings chapter three verse four how many sacrifices does Solomon make on the altar in honor of God a thousand burnt offerings that's a lot of cattle that is his devotion he realizes that he is not really cut out for this amazing role that has been given to him he's humbled by the honor which God has placed upon him in gratitude he goes over there and he sacrifices a thousand burnt offerings you know admitting to God that he does not deserve all of this but because God has been merciful he is willing to take on the responsibility and God who is really placed with him comes to him in a dream and God says to him ask for whatever you want me to give you and Solomon does not ask for material things or temporary things you know he makes a very beautiful request in verse seven it says I am only a little child and do not know how to carry out my duties over here he's not saying that he's actually a little kid because obviously he was not a little child he meant a little child in the sense he doesn't have the wisdom needed to look after a people to look after the people of God and so he says that he needs God's wisdom to be able to look after them and he says in fact in verse nine he says who is able to govern this great people of yours he doesn't say my people he says Lord your people so he starts off his rule with the realization that these are God's people that he is going to be ruling he is going to be a leader of God's people and so he needs to be extra careful how he treats them how he looks after them so he is so aware of his responsibilities and so in verse 12 the Lord says I will do what you have asked for I will give you a wise and discerning heart and he says because you have not asked for you know the material things which people generally ask for I will also give you that so the Lord says in verse 13 both wealth and honor you know would also be given to him so the discussion going on in the last row nope you can have the discussion later okay so yeah okay so this is basically how he starts off his rule and then what happens you know when we come to Rehoboam his son what is the one request which the people make of Rehoboam the son they say your father imposed such heavy taxes on us that we could not bear the burden will you be kind enough and lighten the load for us so what happened to this man this Solomon who said Lord they are your people I am like a little child and I do not know how to look after them something happened to him along the way all of that power and position and wealth and all the praises of the nations it kind of got to his head and he forgot his primary purpose he forgot why he was sitting on that throne and you know if you're all sitting over here thinking what on earth does it have to do with me today don't we see that happening in our church today you know people who are like really big mega preachers and mega pastors they forget why they have been placed in that position it is to lead your people or Lord not their people it is to lead God's people so they have a commitment to the Lord and Solomon over here forgot his responsibility yes yeah so just an example that someone was giving about something that they observed in ministry that's not very admirable so yeah so he spent seven years building the temple of the Lord and then he spends the next 13 years building a grand palace for himself and he builds a grand palace for this egyptian pharaoh's daughter whom he has married so that he can have you know political relations with them and you know improve his status and position and he then he goes on to marry a whole bunch of other ladies all from you know international circles so that he can establish political contacts with all of them and improve his international trade and so somewhere along the way for him power position wealth all of these things become very very important and so for so to to have the funds needed to for all of that he began to impose very heavy taxes and in fact even in jerusalem and you know um historical records they say that he built all these really fancy gardens in jerusalem so that it would look like a very grand capital and so they didn't have you know good irrigation systems in those days so he literally had to build canals and all of that to bring water you know into the different parts of jerusalem to to tend to all of those orchards and gardens and all of that so huge amounts of money was needed and so he began to tax the people very heavily the people who belonged to the lord the people on i know whom he was supposed to be looking after he began to exploit them for his own interests to lift himself up okay and um also another thing which i you know i just noticed when i was doing my reading of this book he purchases a lot of arabian horses you know very very expensive arabian horses they are the best breed at least someone at that time they were considered the very best breed for what i mean is he going to be fighting any wars what did the lord promise him he said he's going to enjoy a time of peace so that in the time of peace it can be a time when all the people can grow in god and enjoy the security which they have all the other nations are busy trying to defend themselves but these people are safe secure and you know instead of enjoying that security and making use of the peace that god is given this man on the other hand begins to exploit the people and he buys all these arabian horses knowing that he's not going to be needing for any battle simply as a status symbol merely as a status symbol all those horses would just be sitting over there as display that's all so it's a very sad thing that he does yes so probably it started off with material greed and once that level of backsliding set in it you know once you allow the first stage of backsliding to set in and you don't correct yourself when god is you know convicting you in your heart then you start going into deeper levels of backsliding which is what we see over here in Solomon's case because gradually maybe to please his wives and his international contacts he also begins to participate in their idolatrous practices you know because now for him international relations has become very very important now he is securing his power and his kingdom through international relations rather than by having a relationship with the lord and strengthening that okay so these are all things that we can actually learn from so we are doing all of this in detail because we're all going to be in leadership positions tomorrow so it's not so important for you to you know be nice to people and try to build your relations with them just to butter them no it would be better for you to build your relationships with the lord strengthen that because that will establish whatever work you want to do for him that will take you forward you don't need to have a partnership and approval with all the people around you though of course you're meant to live in a godly manner at peace with them in a way which they cannot point fingers regarding so that's also good but I'm just saying don't butter people don't reach out to people because you think that they you know your ministry depends on them and their support it's never like that okay so these are all vital truths that we can gain for our own leadership and for our own ministry in the future all right yeah so because Solomon has fallen so badly not just in the in the matter of greed but even in the matter of spiritual adultery because he's now going into idol worship he's participating in things which which disgusts the lord so because of that god finally decides that you know the 12 tribes should no longer remain under you know the davidic lineage and so in chapter 11 you see god choosing someone else and that is basically how Jerobo Am comes into the picture so we have a hijab the prophet of Shiloh who comes wearing a new robe in chapter 11 and in front of Jerobo Am he cuts the new robe into 12 portions and he says take 10 portions because you're going to have 10 tribes under you okay so Jerobo Am had just been newly appointed by Solomon as one of the leaders of his labor forces okay because he had all these building projects running so he would have many labor forces so Jerobo Am was placed in charge of one of those and now Vahija the prophet comes to Jerobo Am and says you know what you're no longer just going to be the head of a labor force you are going to be a future king and so he promises he says the lord is going to be giving you 10 tribes and this very lovely promises that are made to Jerobo Am in verse 37 of chapter 11 it says you will rule over all that your heart desires god is in no way treating him as second best god says to Jerobo Am everything that you desire will be granted to you in no way will you be you know second best to the kingdom of Judah you will have whatever you require and moreover God says in verse 38 I will build you a dynasty as enduring as the one I built for David so imagine god is in no way ill-treating Jerobo Am you know even before the man is even a king while he's still just the head of a labor force god is making these promises to him and Jerobo Am very sadly forgets these promises or rather does not believe them doesn't trust the lord so anyway when Solomon gets to know that this prophecy has been given to Jerobo Am he tries to kill him you know Solomon has now finally come to a stage where he's lost he's completely lost it I mean this man has been newly anointed in order to be a king and here is Solomon you know behaving just like Saul and he tries to actually kill Jerobo Am Jerobo Am runs from there and he takes shelter in Egypt so we see Solomon falling very very badly and the very sad thing is we see Jerobo Am also falling in the same way so the question we even as we're sitting over here we need to ask ourselves what is wrong with all these people why why did they all fall they all received amazing promises God was in no way withholding anything from them but why why were they all falling one after the other so you know just very quickly coming to Rehobo Am who was supposed to be the successor of Solomon so like we already said the people come to Rehobo Am and they say you know will you show us kindness your father completely forgot that he's supposed to be a shepherd king completely forgot that he's supposed to look after us but he exploited us to cut advantage of us but now at least will you lighten the load and Rehobo Am of course he takes the advice of his friends who tell him that he should be a very strong and what very aristocratic monarch and so he you know he says no I will increase your burdens and because of that the people choose that they do not want Rehobo Am to be in charge of them any longer yes it's a valid reason one of the students they say that maybe the kings were falling and not holding on to higher standards because of the example set by the previous king where the previous king fell and he was not up to the mark that wrong example would be picked up by his successor and so the standard was falling and that's very true because David sometimes did not present give an honorable example he did not set an honorable example also we see in the case of Solomon and in the case of Rehobo Am that there was insecurity God had made promises but will God fulfill is God strong enough to fulfill can he hold me on the throne and keep me in my position no I need to do something from my side to strengthen my position because God wants me to focus on other things he wants me to look after the people spend all my time attending to them name to their needs and if I keep serving serving serving what will happen to my position because you know this is a competitive world I need to hold on to my power if I'm being a servant always and serving and all of that what's going to happen to my position someone needs to look after that because God doesn't seem to be very concerned about that so Solomon goes down that same line you know one political alliance after another trying to build himself up trying to make himself stronger and Rehobo Am in the same way he takes the advice of his friends and he says no no if I'm soft then they'll you know they'll take me lightly on the other hand if I'm strong and hard and tough you know then they will respect me and Rehobo Am goes in the same direction because he says to himself after you know he he has got the 10 10 tribes and now only two tribes are left to the house of David he says to himself this is what he says to himself in we are still in chapter 12 okay fine first king's chapter 12 verse 27 if someone could read out okay maybe 20 just a minute 26 and 27 yeah first kings 12 26 and 27 and no yeah yeah yeah let's just yeah 26 and 27 should be fine so again we see Jerobo Am is telling himself all these people from my 10 tribes every year they're going to go up to Jerusalem to offer their sacrifices over there they're going to have this sentimental tie towards Jerusalem they're going to be reminded of their ancestors and their ancestral history and all of the things that Yahweh has done and they will want to go and be again be part of Jerusalem they will abandon me in fact maybe they may kill me and he starts thinking about all of this but what is the promise that God made to him he said everything that you desire you will be able to rule and God says I will make you a dynasty which is as enduring as that of David and those promises are all just forgotten because Jerobo Am is so insecure he's so afraid and he wants to hold on to his throne and so he takes one step forward which is even worse than the step which has been taken by the others you know he thinks no no I need to come up with some other gods so that these people will stay over here itself and not go to Jerusalem and so he takes the advice of some counsellors and he makes two golden calves and he sets up one at where are the two calves set up just to see if my students are awake you know that would be maybe versus around there only 26 27 he makes two golden calves and where does he set up the golden calves perfect yes in Bethel and Dan and it says in the next paragraph that he also you know appoints a festival which is similar to the festival which they will have in Jerusalem so he tells the people you don't have to go over there and celebrate the festival you have a similar festival over here itself so you can offer sacrifices to the golden calf over here and participate in the festival so Jerobo and this is called throughout you know the kings and chronicles this is referred to as the sin of Jerobo Am because of him because of his sin the people are led into massive idolatry okay so PC Solomon and Rehoboam and Jeroboam suffering from deep insecurity now compared to them you and I are just very ordinary people we have no thrones you know we don't have any royal coronation ceremony nothing like that and so it is much easier for us to become insecure in the ministry that the Lord gives to us in the tasks which he assigns to us and that's a very foolish and dangerous move you know so just be secure in your Lord the plans and purposes he has for your life they will be fulfilled the plans and purposes that he has for someone else he will fulfill in their life don't try to be them don't aspire for what they have because in your eyes what you have may be small because you know we have defective eyesight defective perspective we look at the task given to us and we think it is small but in the eyes of the Lord there is no small task let me tell you for him whether you have the gifting of hospitality or whether you have the gifting of you know of being an apostle for him it is equally important and in fact we see that in the New Testament where the people engaged in hospitality was as anointed by the Holy Spirit as the ones who were doing the apostolic work so just because you have a very limited I know perspective about yourself and the task given to you don't limit God in his eyes every task is important so do not be insecure hold on to him be loyal in your serving because it's leadership is all about serving and even as you're doing that he will take care of your name and your position that he will take care of whatever he needs to do to know so that you can continue having that name and be able to accomplish the things that you're meant to accomplish through your ministry he'll take care of he'll deal with those things so you just be secure that is the difference between David and these other kings David he was nothing he was running around in the wilderness for his life he gets two chances to do away with Saul he says no no God can take care of my position God can take care of my power I just need to have the right attitude and do what is honorable in his sight so that is the contrast that we see between David and these kings so I'm sorry that we took up so much time on these things but I really wanted us to grasp this one basic truth because we see we're going to see a lot of this happening even in second kings and in chronicles where these kings what is motivating them what is driving them what is causing them to behave in a particular way you know so this is one very key key factor all right so um this was one important lesson that I wanted us to pick up from the lives of these main you know leaders in the in the very beginning of this monarchical stage all right if anyone has any questions we could get to that yes I do not know where exactly it is mentioned the student is asking about the king who had held the Passover feast after a long gap and who also you know broke down all the idols he's probably referring to Josiah or Hezekiah I'm not particularly sure whom he's referring to and he's asking for the scripture reference I don't know I don't know which but but yeah okay so yeah we'll get to all of that to whatever we can get to but we'll try to look at the main main key points we know which are which are there in each of these books because these are history books and history can take months actually to cover and we don't have months okay uh yeah um any other questions otherwise we'll actually close with the word of prayer okay all are at peace but they're all awake yes okay let's just close with the word of prayer Lord we just thank you so much for the very very valuable life lessons a lot that are contained in your historical books you didn't put these records together just to impart knowledge you placed them over here oh Lord for correction for inspiration for for learning and so Lord I pray that we would never ever read the historical books just as a historical account but we would try to see what we can gain from a spiritual perspective from these stories oh Lord so Lord I pray that we would be secure in you we would be confident in you we would stay focused on doing the task that you have given us and Lord we would not focus on position and power and status oh Lord because those things come from the throne of the Lord in your time in your way you will grant us whatever is needed for us to fulfill our work and fulfill our ministry so Lord we don't need to run after those and Lord if we are still hungry for those things when the kingdom comes so Lord when your new heavens and earth come in that time oh Lord we will have all the glory and position we would possibly need so Lord we don't need to run after those things now now oh Lord is the phase of life where we are meant to focus on you and serve you and be your hands and feet and fulfill your purposes help us a lot to do that help us a lot to do it in such a way that you can declare and say that we have been faithful servants who had your own heart oh Lord help us to be that kind of leaders and servants thank you Lord in Jesus name amen thank you so much online students and thank you I know all of you who are here will close the recording and we'll meet again next week


So as a sensor operator, as a pilot, I am basically taking care of the sensor throughout the whole mission. I fly the RQ-4. I'm making sure that we're collecting our targets and giving the correct amount of intelligence to our mission commanders and also to our customers. I work with my crew and we execute the task missions from the given combatant commander. And also providing invaluable intelligence to the troops on the ground. We train in exercises in order to hone our skills as RQ-4 pilots and our sensor operators as well in order to ensure that when we do employ the aircraft for those combatant commanders, we are doing so at the top of our game.


Academic historical study, acclaimed cornerstone of modern civilization, and our understanding of antiquity, incredible lost treasures rediscovered, particularly during Darwin's era, pushing the field of historical study especially regarding our own origin into the forefront of public interest, one of which initially coined the survival of the fittest. It is ironic, however, that later Charles would himself come to realize his assumptions of non-design wrong, yet far too late to protect his musings from greedy talents, although due to the lack of resulting, substantiating evidence has, regardless, slowly transformed into an alternative to classical religion, one without a god. The fatal flaw in Darwin's theory of evolution is that it remains just that, a theory, never demonstrated in a controlled environment, namely Earth. With predictable and repeatedly observed results, yet this justification for this seemingly agenda-driven promotion of the theory itself could be perceived as a first draft antithesis to a god or design, for the proof remains absent to this day. A tangled web they weave, harnessing the variety found within nature and often subsequent similarities within the animal kingdom, who, due to environmental changes, were often forced to adapt, wheeled around as examples of that which the theory depends on, the proof, the magical link, the species-hop, a display of the power of adaptation, nothing more. The Hairless Apes explained evolutionarily as due to reproductive preference for apes with less hair. There is no evidence for this claim, no mention of any environmental benefits or negative consequential factors of its result. Long-exhibited as proofs, along with the moth depletion during the Industrial Revolution, fall into no evolutionary category. What we are witnessing is extinction and natural selection, not a strong argument within the evolutionist's armory. Again, these remarkable finches remained finches. There is no denial that there is an incredibly diverse world around us, with millions of subspecies, but this does not prove that they share a single ancestor. Even fossil records support this. They show, during the Cambrian explosion in particular, the sudden unexplained arrival of complex lifeforms, who seemingly just appeared in our oceans about 550 million years ago. There contained a small set of separate phyla, the original species, a group of separate genealogical individuals. Now a half billion years old, yet no others, or more importantly, any separation or the crucial cross-species hop, has ever been discovered. The Convolution of Adaptation A competition for resources. The fossils we are permitted to see show that lifeforms on our planet can be and were once far bigger. Yet an event, a driving mechanism, triggered a demonstration of natural selection, survival of the fittest, best suited, or more specifically, a mass extinction at its most rampant. For although we know birds, thanks to MRI scans, are biologically dinosaurs, they could have only been small scavenging species. The world becoming unsustainable for large creatures. The Genealogical Similarity Argument Although iterated in an earlier video, every living thing on this planet shares something nearly identical, but each is unique. DNA, the building blocks of life, like the pain on a canvas, diversity is only limited by the complexity of what can be made with said materials. Which would explain why you, I, all humans, share nearly identical DNA, Darwin, Einstein, Newton, and so on. We all share near-identical chemical makeup, down to a microscopic level. Yet most compellingly, we all also share about 50% genealogical similarities with a banana. For life to live on our planet, we must all share many things which lay in abundance. Yet interestingly, the living kingdom has a group not singular ancestry never leaping or crossing phyla. The Eyes of an Ape The stunning biodiversity we see on our planet, from said phyla, facing and subsequently overcoming challenges faced by each species, and thanks to the immense complexity of the universe. We get to witness awe-inspiring variety in skills, mistakenly perceived as appearing from nowhere, techniques and abilities pressed out by design, Newton's third law, and the ultimate pursuit of a perfect effect, a reality whose purpose, direction, or indeed causation, thus far, we are yet to discover. Or if indeed a single-celled living organism was the creator of all creatures great and small, where did their own origins arise? Metamorphosis From the very hungry caterpillar to the beautiful butterfly, this is supposed with no intelligence totally by chance. It pulpates. It becomes a chrysalis, internally turning to goo, rearranging within said cocoon, reappearing as a fragile creature who had managed to master the power of flight, subsequently successfully procreating, mathematically proven as so unlikely by chance as preposterous to accept as the case. Yet let's not forget the frog, who too created cycles which mathematically are absurd to claim as occurring simply from trial and error, only extinction. Gill-breathing amphibians growing powerful limbs, capable of living for long periods out of water? Which environment on this planet so forgiving as to permit such unexplainable developments all by chance? Apes Enter Stone Age Let's ignore ravens, who have been using stones as tools to do simply incredibly intelligent things for many, many years. Eagles, along with many other birds of prey, witness for millennia dropping turtles, etc., onto specific rocky outcrops. Animals have been using tools for as long as recorded history, much like us. If there was no one around to hear it, did the big bang make a sound? Claiming life has no meaning, no purpose, no direction, that it came from nothing would make a big bang impossible. Gill-breathing comes from nothing. I'm here, so I came from somewhere. Inbuilt within this place, I find myself cause and effect, pre-existing ipso facto design. Cause and effect, the pathway to perfecting practices, learning, and possibly life itself. Revolution, technological and worldly advancements, and a perfection of our understandings as a species. Why such direction if merely all by sheer chance? We find it all highly compelling.


We are told Keir Starmer has completed unconscious bias training, but does he need lessons in identifying racism which is a little bit more explicit? That's the question I asked myself after watching him respond to a caller on LBC this morning. So the lady had phoned in to ask Keir Starmer what he thought about her husband who she said had been one of the fans booing at Millwall's match when the players took a knee. Starmer said he disagreed with the booing but then failed to challenge her on something she said which was far more worrying. Let's take a look. He is of course and I respect his view of course so it doesn't mean I agree with it. I think that what's happened over the many years, this is the counter argument, it's quite a powerful one, is that there is racial inequality, there is injustice and from time to time it becomes an issue, it's looked at for a few weeks and then it goes away and this is an attempt to keep the focus on it until things really change. The round now focus just on taking the knee and the important issue of getting black managers, black directors of football, black chairman or chair women of clubs, I mean that's been lost because we just take the knee. No I don't think it's one or the other, I think you can do both and it's a way of drawing attention to it but in the end it's for each individual to decide how they want to tackle injustice. Gemma why did your husband, sorry you didn't quite explain if I may go there again, why did he choose not, choose to boo, sorry. Because if anything the racial inequality is now against the indigenous people of Britain because we are set to become a minority by 2066 and taking the knee, bringing that into, bringing the political sphere into the football arena and we just have to look across to the Middle East, you know Israel has a state law but they are the only people in that country to have self-determination. Well why can't I as a white British female have that same right? Final point to you on this, Sakir. But Gemma we all have those rights, this is about recognizing some injustice gone on for a very, very long time and I think people were genuinely moved this year and want to make sure that that injustice is dealt with and you know people will look at it different ways but I think the vast majority of people do want a more equal society. Gemma thank you. Now I mean I think actually Kirsten's answer in the first half of that clip was quite good, I think his defense of people taking a knee was very thoughtful and very persuasive. The second half though, I mean let's go over what that caller said. So the caller said that actually it's white people who are oppressed in this country because they're about to become a minority by 2066. Projections from some demographer now that sort of become core to the great replacement theory. I'm sure Ash will talk about that in more detail in a moment. What I want to focus on now that the caller suggested we learn from the nation state law in Israel and pass a law which is basically saying let's pass a law guaranteeing self-determination for white Brits. So she's saying why don't white Brits have the same right to self-determine that Jews in Israel do and in response Kirsten says we all have those rights. No we don't all have those rights, we don't all have the right to live in an ethno state where our ethnicity is treated as privileged over others. I mean it's essentially apartheid, right? Now obviously I'm not saying that that clip shows you that Kirsten supports apartheid but I do think it is quite troubling that that is essentially I mean that's how you can interpret his words. He didn't challenge that woman who said let's have self-determination for white people in Britain like they have self-determination for Jews only in Israel. He sort of just brushed it off. Ash I want to bring you in on this. Kirsten, he has done unconscious bias training but he I mean either he didn't recognize what I thought was quite blatant white supremacy there or he felt that it wasn't appropriate to challenge it. Well you should really be getting a refund on that unconscious bias training shouldn't he? If you can't pick up on really obvious white nationalist conspiracies and when it's right in front of you and look I mean you've both done radio phone and shows and sometimes you don't get to say all the things that you want to say and you kick yourself a while after but I don't think that's quite what happened here. I think what has happened here is that Kirsten was listening for what he knew to prepare for which was the question on millwall and booing and BLM and taking the knee and it meant that he had just tuned out these I mean it's not even a racist dog whistle where it's an absolute honking white nationalist vuvuzela and what that indicates to me is a certain lack of racial literacy is what I would call a lack of racial literacy from Keir Starman. We've seen this you know a couple of times before when he you know called Black Lives Matter a moment and not a movement when he you know dismissed defunding the police out of hand which is fine if that's a policy decision that you disagree with and want to distance yourself from but with this kind of degree of disrespect for the activists who had generated it he doesn't have that kind of discerning ear and ability to react and to respond from a place of I think very deep confidence and knowledge and that's going to be a problem and it's not going to be a problem because the left who are phenomenally disempowered within labor are going to kick off that's not going to be a thing that troubles him. What is going to trouble him is that this phenomenon of great replacement conspiracism and this kind of you know subterranean media infrastructure ecology which is sort of being generated and nurtured by the alt-right this kind of phoning into radio shows in order to wedge in your white nationalist talking points that is only going to grow and unless you have a labor leader who's able to identify when this is going on and have some kind of prepared response to it which is making you know a real impassioned defense of the kind of society that he wants to see a multiracial multi-ethnic and multicultural democracy then a labor leader is not going to get anywhere near a downing street than his predecessors I think and there's also one more thing that I briefly want to touch on if that's okay and it's about the matter of the great replacement itself because whenever I call the great replacement a conspiracy theory I have a million and one far right thunder heads in my mentions sharing this one clip from a video that I did a few years ago called Against Integration and it's a nine second clip in which I highlight some statistics which had been reported I think in the Daily Mail indicating demographic change in London ago all right lads we're winning and the reason why they clip this and they distribute it is they think that it represents not only me saying oh the great replacement is real but saying and I'm a part of it I endorse it and I think it's really good the actual much longer video is about the research produced by sociologists called Ted Cantal and I cite those statistics because I think that what it shows is that he handled this data in a very biased way he looks at rising diversity and because he judges it by the fact that you have a smaller proportion of white Brits in diverse areas he goes oh that's a segregated neighborhood I just grew that fundamentally the great replacement is a conspiracy theory which essentially says that there is a kind of shadowy you know cabal of elites often coded as Jewish it's you know very very close to you know lots of other anti-Semitic myths this great great replacement that's pulling the strings to try and you know eradicate you know the indigenous white race from Europe and America and sometimes Australia this is of course complete ho come what they do is they take these statistics which show demographic change and there's all kinds of demographic change right there's religious demographic change there's racial demographic change obviously there's also age demographic change which no one seems to have that they've got of a problem with and they go see your your races under attack no what's going on and what drives these numbers is that you know those waves of immigration which were once kind of temporary people would come over they'd make some money they'd move back there's changed people have settled down they put down routes they have children they fall in love you know they make lives with one another they actually perform the kind of integration which everyone's telling me is the right thing to do and that's what what drives this this great replacement conspiracy theory it says that essentially demographic change is the result of these nefarious forces which are which are trying to rob white people of what's rightfully theirs it's very closely linked to anti-Semitism also very very closely linked with lots of really horrible stuff to do with you know anti-abortion you know very very conservative on reproductive rights and I think it's important that when this is going to be I think such a core part of of you know the far right story going forward and you can see that there is this porousness between the barrier between mainstream opinion and all right opinion because of the kind of like you know huge electoral upsets of you know Donald Trump having one in the 2016 American election you know you've also got hard right Brexit you've got this current composition of Boris Johnson's cabinet and then you've also got a media ecology which is constantly drawing on these figures and elevating them to pundit status this is going to be something which is going to I think you'll hear about it more and more in our politics and Keir Starmer if he wants to actually be a trusted figure on anti-racism and I've got no doubt that that is something that he wants to do um if not always has the tools to be able to do it's going to have to work out a strategy for it because tuning it out responding to the question that you wanted to hear rather than the comments that you did actually hear simply isn't good enough say he wasn't listening actually gives him more credit than he deserves I mean he's an intelligent man he was clearly listening to what was said and he didn't he even didn't recognize that something very something drawn from white supremacy was said or explicitly white supremacist was said or he didn't feel comfortable challenging it and one thing that I think actually stood out for me is that he clearly wasn't paying attention in the whole summer long debate that we had about the IHRA definition of anti-semitism because if he had he would know that one of the big problems with that one of the big complaints people had was that by saying that Israel has a right to self-determine essentially that that can be used to justify the nation state law which is to say that if a people have a right to self-determination then they have a right to be an ethnic majority in a nation which is precisely what's what's motivating the nation state law which is to say that yes look there's concerns in Israel the Arabs are you know reproduce it I'm using their horrible language that the Arab population is growing faster than the Jewish population so to secure the rights of of the Jewish population you have to put and basically a bit of an apartheid clause in the constitution to say even if Jews no longer are the majority they still are the only people with rights to to have ownership of that nation essentially and this is being taken up by white supremacists in this country who are saying ah look there is a danger that whites will no longer be a white people sorry I don't want to use their language white people will no longer be the majority you sound like you know de Klerk or something what I mean that that's that's what the caller was suggesting and because Keir Starmer wasn't paying attention to Ira he wasn't paying attention to the nation state law he didn't notice that I noticed that in like half a second right and that completely went over his head because he's not paying attention to liberation struggles around the world and the nature of ethno nationalism is something that he he's he's not alive to and that means he completely missed a point there I want to talk a bit more context for you which is that thanks to researchers on Twitter we know that the caller was was not actually Gemma from Cambridge as she claimed but someone who goes by the name of Jody Kaye and so she has a YouTube channel promoting far right conspiracy theories and is a supporter of the far right patriotic alternative group apparently she was she's actually in she was introduced as Gemma from Cambridge as I said but she is in fact a yoga teacher in Ibiza the far right were also pleased with how it went so this is a screenshot from a far right telegram broadcast it was found by the crowdsourcing collective red flare on Twitter definitely were a a follow and you can see there this is a far right account charlie big potatoes official I don't know whether the name comes from they say an absolute masterclass of griping which is to say you go on sort of mainstream platforms and put in conspiracy theories unbeknownst to the to the to the host from Jody Kaye here as all Keir Starmer can do is try and worm his way out of answering any of her points well done Jody now obviously that they're being completely opportunistic they're claiming this is a victory because it makes them look good but it is undeniable that Keir Starmer didn't successfully challenge and in fact by saying we all have those rights in a way by accident I'm sure by accident reinforced and legitimized the quite horrific views which were being put to him


G3 XL. This is a combination of the G3 slide assembly and barrel length. Four inch barrel with the G3C grip with 12 round magazines. A single action trigger it measures right at four and a quarter pounds. That same very short reset grip that is ergonomically pleasing.


All right, everyone. Thanks for coming out. I really appreciate everyone being here. Let's get started. Hey, everyone. Thanks for coming out. Although this is not my first black-at-talk, it is the first time I'm speaking in person. I'm really, really, really excited to be here. Let's get started. One second. Wardrobe mode function. Hold on. All right. Just kidding. Of course. I'm really honored to be here. It's my third time at DEF CON. Unfortunately, I was under the age of 21, so I wasn't able to partake in the shot celebration for speakers, but I was this year. So, a bit of background. My name is Bill Demercupa, and I'm a researcher for the Microsoft Security Response Center. While working full-time, I'm also a full-time student at the Rochester Institute of Technology. I have a relatively diverse background in offensive and defensive security, but my specialization is low-level operating system internals with a focus on Windows. In this talk, we'll be exploring my work into digital signatures, specifically the implementation issues I found with them. We'll start with some background on how digital signatures are validated, approaches for attacking them, which will tie into the systemic fly found and its impact on the broader ecosystem. A quick disclaimer. We'll be discussing several first and third party vulnerabilities in this talk. Everything you see here today is patched. We will not be dropping zero days, unfortunately. All right. So, how are digital signatures validated in the real world? A digital signature is used to verify that a message, document, or software comes from a specific sender and hasn't been altered during transmission. This is done by creating a hash of the message and then encrypting that hash with the sender's private key. A digital certificate, on the other hand, is a digital document issued by a trusted third party, known as a certificate authority or CA. It contains the public key corresponding to the sender's private key, as well as information about the identity of the sender. In order to validate a digital signature, the recipient needs to have the sender's public key. The problem is, if the sender simply sent their public key along with their message, there's no way for the recipient to know for sure that the public key really belongs to the sender. By containing the sender's public key and being digitally signed by a trusted third party CA, a digital certificate confirms that the public key really does belong to that sender. Root certificate authorities are responsible for identity verification of individuals and organizations requesting a certificate. For digital signatures to work in practice, we need these organizations that we can rely on in order to establish a chain of trust for digital certificates. Who verifies the root CA's, they come pre-installed. They're responsible for identity verification, but, for example, in the screenshot below, you can see the Windows trusted read store. These are the authorities that come with the operating system and provide a reference point for digital signature validation. So how is a digital certificate verified? Through the chain of trust. Remember the trusted root CA's that come with your machine? We can verify if a digital certificate is legitimate by checking if it chains up to one of these trusted CA's. In practice, the root CA's verify the intermediate CA's which then verify your end entity or server certificate and allow us to determine the legitimacy of a signed digital message. So let's go through a simplified example of what verifying an executable looks like on Windows under the authentic code specification. First, we need to generate an authentic code hash or digest. We start by hashing the PE headers of the executable. Note that some fields like the security directory entry and checksum are intentionally excluded. Next, we sort every PE section by their file offset in ascending order and hash their contents. If there's any extra data after the PE sections and before the security directory, this is added to the hash as well. Once we calculate the hash, we can extract the encrypted digest from the security directory which contains the authentic code signature. We decrypt and compare this hash with the one we calculated and at this point, we validated that the authentic code signature is valid and the last thing we need to do is verify the certificate and the chain of trust. Does the certificate link to a certificate authority we know about? And that's about it, at least from a high level. Let's talk a little bit about how one can go about attacking digital signatures. So a quick history recap. Since 1996, MD5, the use of the MD5 algorithm has been discouraged due to its inherent weaknesses. For example, in 2004, we saw the first publication of an MD5 collision. Researchers were able to generate two distinct files that resulted in the same MD5 hash. In 2008, the researchers abused known MD5 weaknesses to generate a malicious certificate authority with a valid chain of trust. And using a chosen prefix collision, they were able to create a rogue intermediate CA with the same MD5 hash as an end identity certificate. In other words, something like an SSL certificate. In 2011, we saw a breach of the digital odor CA and in 2012, the flame malware abused chosen prefixes like the 2008 rogue CA attack that let them generate a fake Microsoft CA. So what type of attacks are relevant for digital signatures? Well, we have three broad categories that are generally applicable to a lot more than just signatures. Let's break these down. First, we have memory corruption issues. These are your classic out-of-bounds read, write, or stack overflow vulnerabilities that can often arise from the mishandling of untrusted data. How do we find them? Typically manual or guided analysis as well as fuzzing are good strategies. How do we fix them? Well, one of the best advice I can give is to minimize your attack surface. Limit the code that processes untrusted data. You can also use various mitigations or memory safe programming languages like Rust to substantially reduce your risk to these issues. Next, we have logic flaws. These are highly context-specific issues that vary by application. How do we find them? Manual or guided analysis, these issues require a decent understanding of the application's design and intended usage. For example, look for differences in logic and between a design document and the actual implementation. How do we prevent them? Well, again, minimizing the code that processes the untrusted data is a good place to start. Having a test suite of expected outcomes are another good way to prevent regressions and validate design assumptions. We also have cryptographic flaws. These are different than the implementation issues we just discussed in that they exist in a cryptographic algorithm. How do we find them? Typically this involves mathematical analysis of algorithms to ensure things like pre-image resistance, second pre-image resistance, and strong collision resistance. How do we prevent them? Well, for most, the golden rule is just don't rule your own crypto. Don't deviate from the specification that you're implementing. So writing cryptographic systems is challenging due to their inherent complexity. Cryptographic implementations aren't isolated.  Patching implementation issues can get complicated as well. For example, like one reason why XYZ, Insecure Future, let's say MD5, is difficult to get rid of is because if you simply prevented its use entirely, you may break legacy systems and applications. Memory corruption is better understood. Logic flaws are much harder to prevent as they are context specific. Let's review the different types of signing certificates and the minimum requirements for obtaining them. First, we have regular SSL certificates used to secure your connection with a web server. At a minimum, you need to prove that you own the domain that you're requesting the certificate for. This can involve adding a DNS record or serving a provided file over HTTP. SMIME certificates are used for securing email communications like SSL certificates. You need to prove that you own the email address that you're requesting a certificate for, which can include the identity of yourself or your organization. We also have code signing certificates. These are used to maintain the integrity of your software. Unlike SMIME certificates, the bar for obtaining one is substantially higher. As we'll soon discuss, you will almost always need to verify your identity or the legitimacy of your organization. Finally, we also have document signing certificates. These are in a bit of a gray area as they're frequently interchangeable with SMIME or SSL certificates and have similar requirements. The requirements for different types of certificates can greatly vary. Let's break down the different types of validation that certificate authorities can perform. With domain validation or DV, you need to prove that you control a given domain. This is a pretty low bar for verification because there's a higher risk of abuse. All you need to do is put up a file on your web server. Organization validation is where we get into the moderate level of verification. During this process, you need to prove the legal and physical existence of your organization. This is the bare minimum for code signing certificates and other sensitive digital use cases. Extended validation is one of the highest levels of validation that a CA can perform. It's everything you need for organization validation but more. For example, you often need to show that your business is legitimate and not a shell company. This can include face-to-face verification. When I started my research into digital signature implementations, the differences between certificate requirements caught my eye. For example, in our context, having a digital signature alone is not sufficient. We not only need to be able to verify that a signature is cryptographically valid but also that it originates from a trusted source. These two diagrams overview the extended validation versus domain validation process. The question I had was, what prevents an attacker from abusing a certificate that has only proven domain ownership for purposes that require a higher level verification, like code signing? Now, let's get into the fun stuff. What defines a certificate's purpose? What distinguishes an SSL certificate from a code signing certificate? Often, it's the extended key usage field present in most end entity certificates. EKUs can specify what a certificate is allowed to be used for. As an example, the image on the right shows this field from an SSL certificate. The server and client authentication usages mean that the certificate is allowed to authenticate to a remote server or client. But what actually verifies these EKUs in practice? When you sign digital data, the utility you use can impose restrictions. For example, if you're signing an executable, you may receive an error if you tried to sign an executable without the code signing EKU present on the certificate you're using. But the restrictions these tools impose are not what matters because they run before the attack is actually performed. As we'll soon see, if I, as an attacker, got an error related to the intended purpose of my certificate, there's nothing stopping me from modifying the tool to bypass this check. So, how do we identify vulnerable implementations that fail to validate a certificate's intended purpose? First, we started by identifying some basic criteria. The Microsoft Security Response Center is interested in protecting the entire ecosystem, not just first party implementations. We ended up looking at a variety of file formats that leveraged digital signatures. Most frequently, this included code signing because of the bare minimum organization validation requirement. For testing, we also generated an SSL certificate, which only required proof of domain control. In the next few slides, we'll review the signing tools relevant to the file formats we're interested in and modify them to remove any client-side checks. Remember, modifying our signing tools comes before any attack on our environment. What matters is the receiving end and how it handles EKUs. To start with, I looked at Microsoft Sign Tool, which lets you sign over 25 unique file extensions. This utility is most often used for authentic code and is included with Windows SDK. First, I performed a sanity check and tried to sign an SSL certificate, sorry, tried to sign an executable with an SSL certificate. As you can see, Sign Tool by default does validate the EKUs of your code signing certificate. We need to get around this. Using Ida Pro, I was able to quickly find the function responsible for the check by looking for the EKU filter error string. The function was conveniently named filter certificates. I patched the function to immediately return and avoid filtering entirely. Next time I tried signing my executable, it worked without a problem. Sign Tool isn't the only utility relevant to this project. The manifest generation and editing tool is used to create and modify application and deployment manifests. Part of this tool includes the ability to sign manifests. We'll discuss how these manifests are used in a later slide. Like Sign Tool, Mage performs EKU verification when signing a manifest. Unlike Sign Tool, Mage is written in C-sharp. How can we patch its EKU check? I use DNspy, an older .NET assembly editor that allows you to both decompile and modify C-sharp applications. I found the responsible method can sign with by looking for the relevant error message. Using DNspy, I modified this method to always return to RU, bypassing the EKU check. And as expected, this modification allows you to sign manifests with an unrelated certificate. Now that we've prepared our test data signed with our SSL certificate, let's try against real-world authentic code implementations. All right, some background. On Windows, the primary API commonly used to verify the trust of supported objects is WinVerifyTrust. This function abstracts the job of signature validation to subject interface packages and trust providers. SIPs are responsible for the format-specific verification of digital signatures. For example, a portable executable will store digital signatures in a different format compared to a PowerShell script. The key is that there's a SIP for both to handle both formats. In this talk, we'll briefly review this architecture, but if you're interested in understanding this design in detail, I would strongly recommend that you read Subverting Trust in Windows by Matt Graber. Trust providers don't care about the SIP you use. They are designed to perform format-agnostic trust verification actions. Common providers include GenericCertVerify, which will verify a certificate. GenericChainVerify, which will verify a certificate's chain of trust. And GenericVerify alone will verify a file or object according to the authentic code specification. The GenericVerify provider is most commonly used for verifying authentic code formats. As a simple test, I wrote a small test application to verify an executable signature using WinVerifyTrust. Unfortunately, or fortunately, depending on how you look at it, it didn't work. I received an error stating this certificate is not valid for the requested usage. Remember the GenericVerifyTrust provider? Unfortunately, it turns out that one of the basic requirements for this provider, which is used in almost all authentic code formats, is that the code signing EKU is present. This meant that most of these formats that are verified through this architecture by default are protected. Although Windows may have gotten it right, I was curious about other libraries that validated the authenticity of authentic code applications. What about workloads that needed to verify these signatures on other operating systems? Unfortunately, as we'll soon see, several authentic code implementations outside of Windows itself were vulnerable to this attack. So the Mono project is an open source equivalent to Microsoft's .NET framework. Microsoft sponsors the project and Mono is frequently used in cross platform applications that wants to use .NET. Mono supports authentic code signing and verification with its authentic code de-formatter and authentic code formatter classes. How can we test Mono's authentic code implementation? Well fortunately, it comes with a check trust tool that allows us to verify the signature of an executable. Unfortunately, due to a lack of EKU validation, the Mono's authentic code de-formatter class is vulnerable to the attack. This issue isn't specific to Mono's simple check trust testing utility. Any Mono application that uses this class for verifying untrusted executables is potentially vulnerable. Trail of Bits is a security consulting firm that helps organizations engineer secure applications. They have quite a few open source tools and one of those projects includes authentic code. Authentic code is a cross platform library that allows you to verify a digital signature of a portable executable. The intent is to provide similar functionality to API like WinVerify Trust on non-Windows platforms. Unlike WinVerify Trust, however, authentic code only verifies an authentic code signature. It doesn't verify a certificate's chain of trust. The chain of trust isn't relevant to EKUs. You can verify that a LEAF certificate is allowed to be used for code signing without verifying that it was issued by a trusted root certificate authority. Unfortunately, authentic code was vulnerable to the EKU attack, allowing attackers to sign code with an unrelated certificate. Fair disclaimer, the real-world implications of the EKU attack with authentic code are limited. For example, according to the authors I spoke with, authentic code is frequently used in CI CD stacks for basic authentic code validation. Of course, given its open source nature, it's hard to quantify its use with certainty. I also wanted to review a bonus example. When I was reviewing authentic code's implementation of signature verification, I noticed that it deviated from the authentic code specification. On the left, we have the same diagram from the earlier slide showing a high level overview of how portable executables are verified under authentic code. On the right, I've modified the diagram to reflect authentic code's implementation of the specification. So according to the authentic code specification, you're supposed to hash the contents of an executable by concatenating the hashes of the PE header, sorted sections, and any extra data. Authentic code ignored these PE sections. Instead, they'd hash the PE header and the rest of the file, excluding the security directory. From a practical stance, what this meant was that it would take everything before the security directory and everything after the security directory, and then combine the two and calculate a hash on that result. On the earlier slide about attacking digital signatures, I mentioned how you shouldn't ever roll your own crypto or deviate from this specification. I was curious, what are the implications of this deviation? Unfortunately, this deviation led to a pretty big flaw. I found that by embedding the security directory within a PE section, I could modify the code of an executable without changing its authentic code hash according to authentic code. The problem was that since authentic code skips over the security directory, it would hash everything up to the modified PE section, ignore the security directory with malicious code, and hash everything after. You could move around the security directory and the authentic code hash as calculated by authentic code would remain unmodified. I was able to leverage this attack to replace the entry point of a legitimate Microsoft executable with malicious shell code. This issue is not related to EKUs. It was simply an extra implementation flaw that I stumbled upon. But it highlights the importance of sticking with the specification and how one small mistake when implementing digital signatures can have a devastating impact. Let's discuss ClickOnce. ClickOnce is a deployment technology that allows developers to create self-updating applications that can be installed or run with minimal user interaction. Under the hood, ClickOnce deployments are made up of application files, a deployment manifest, and an optional application manifest. The cool part of ClickOnce is that you can install or run applications from a website. The picture shows what a ClickOnce prompt can look like, which can be triggered by a link in a browser that supports ClickOnce. ClickOnce applications can be signed automatically with Visual Studio or manually with Mage. The diagram below demonstrates this. First, we take an unsigned ClickOnce deployment. We signed the application manifest in the application files directory. We signed a deployment manifest in the application files directory, and then we optionally sign the application manifest in the root directory. This gives us a signed ClickOnce deployment. Once the deployment was signed, it was uploaded to a web server for testing. The picture below shows you what this ClickOnce prompt can look like in Microsoft Edge. It asks, do you want to open Test ClickOnce application from the domain that you're visiting? The page itself can have any content you want. Unfortunately, ClickOnce was impacted by this attack. As you can see in the picture below, the publisher shows as the domain that I had registered an SSL certificate for. If you had tried to use a certificate that was not issued by a trusted authority, well, it would show that error in saying that the certificate is not trusted. But unfortunately, because ClickOnce didn't actually validate EKUs, it considers the certificate that I signed my deployment with as legitimate. What about other uses of digital signatures that we didn't cover? I want to talk a little bit about some related work. In 2014, researchers from the University of Texas and California released using frank inserts for automated adversarial testing of certificate validation and SSL slash TLS implementations. As the name suggests, the researchers generated mutated certificates with different combinations of extensions and constraints. The idea was to look for inconsistencies between implementations. Now, this paper exclusively focuses on SSL and TLS implementations and open SSL, NSS, et cetera. Of relevance to this talk, the researchers found several libraries that failed to validate the appropriate EKU. Instead of malformed certificates for digital signatures and executables, they looked at abusing them in the browser. If you're interested in reading more, I'd recommend that you check out the link below. We additionally verified that common libraries like open SSL validated these EKUs appropriately. Now, if you use these libraries for solely verifying the authenticity of a certificate without specifying a purpose or there's no default, you can still be exposed to an EKU attack. For example, in open SSL, you can specify context for X509 verification, as seen in a picture below, which can include these EKU defaults. For example, if I set the context that I'm an SSL client, open SSL has the correct defaults to validate that the client authentication, excuse me, server authentication EKU is present on the server certificate and vice versa if you say that you're an SSL server. Let's review some of the takeaways and techniques. In this project, we discovered numerous implementations of digital signatures that failed to validate the extended key usage field. This would allow an attacker to abuse certificates with a substantially lower bar for identity verification in important context, like code signing. The diagram below demonstrates this attack. First, an attacker buys or generates a low-cost certificate, whether this be SSL, SMIME, etc., is up to them. Next, they sign unrelated data with the mismatched certificate. This could include modifying the signing tools to allow this in the first place. Then vulnerable apps fail to validate and detect the invalid certificate. As a result, users can receive a false sense of trust. It can bypass important access controls and more depending on the context. So how do you protect your implementation? Well number one, always fix and excuse me, always validate EKUs in your application to ensure that certificates are used for their intended purposes. Use libraries that properly implement EKU checks. Trust but verify key principles in your application's design. Every single implementation that was vulnerable to this attack we covered today were supposed to check for EKUs. No one verified that they did. Implement regular security testing, especially in components using cryptography for crucial features. Your implementation is much more likely to be vulnerable than a cryptographic algorithm. What is Microsoft doing to protect customers? Well number one, we've released patches for all first-party issues. The third-party vulnerabilities we've discussed were also fixed. We're continuing to work with impacted third-party vendors to address their implementations. And we also continue to explore issues in digital signature implementations. Below is a list of relevant CVEs that were issued as a result of this work. Thanks for coming to my talk. And now is the time for questions as time permits. So the question was would cert pinning help in this context? So it can help in the sense that if there's only a certain subset of trusted authorities that can issue certificates that your application accepts, well then it becomes much harder for an attacker to generate a certificate like an SSL certificate under that authority, right? So it would have to be, let's say you're using your own CA. Yes, that can definitely protect it as long as an attacker can't generate a certificate under that CA. But if it's something like you use DigiServe or something, some specific trusted authority that an attacker could be able to access or generate certificates under, then it doesn't help much in that context. If there's any other questions, feel free to come up to the stage and I'd love to discuss the issues with you.