Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1260 Thanks!
Our next speaker is Joe's
pretzels.
He will have held a talk on
Harry Potter and a not so smart proxy
war. Taking a look at a covert
CIA virtual fencing solution
and joy to talk and give a huge round of
applause for Joe Joe's story.
All right. Hello, everyone.
Welcome, everyone, to my dog Harry Potter
and the not so smart proxy war.
My name is Charles Vessels and I'm a
security researcher with Midnight Blue.
I primarily focus on embedded systems,
mainly in industrial control systems,
automotive and IED.
And I previously worked under protection
of critical infrastructure at the
University of 20 in the Netherlands.
So what triggered a stock,
the 7 release of documents?
How many people here are familiar with
default? Seven documents.
All right. That's quite a lot.
So this this concerned almost 9000
documents belonging to the CIA Center
for Cyber Intelligence, mainly dated
between 2013 and 2016.
And most of them concerned exploits
implants and DTP use for various kinds
of targets.
Now, most of these entries got
in-depth coverage by the security
community and the press,
all except for one, which
is that protection system.
So how many people here are familiar
with the particular documents?
Yeah, that's that's almost nobody.
And that's kind of the point.
So during the release,
WikiLeaks claimed that pretty ego
was a suspected assassination module
for G.P.S. guided missile systems.
For example, in drones used for
assassination and that it was installed
on Pratt and Whitney aircraft.
Now, this release consisted of four
secret documents and 37 related
proprietary manuals.
The project seems to have been maintained
between 2014 and 2015.
And what's interesting about them is that
they're very different from the other
projects in the Vault 7 release.
There is no clear indication why these
documents were in this particular
release.
Now, when I looked through these
documents, something felt off
to me. The claim that WikiLeaks put
forward did not seem to hold.
When you look at the documents
now, this the architecture at a very high
level of this portico system.
So on the top, you'll have the actual
particular subsystem, which consists of a
master processor, something called
a tube smart switch and something called
a missile smart switch.
And this communicates over asked for to
do with a programing box consisting
of two order microcontrollers.
And one of the interesting things that
you can immediately see is that there is
interaction with a G.P.S.
beacon interface.
So far, so good.
Right? All the missile systems
terminology is there.
Or stock of the missiles.
There's talk of the tube from which the
missile launches and their stock of the
call that holds it into place.
But no one this BW
a term.
So this assertion by WikiLeaks
that it was installed on printing
Pratt and Whitney aircraft seemed solely
based on the BW a abbreviation
in some of these documents.
Not a problem with this is that Pratt and
Whitney manufacture engines.
They do not manufacture aircraft
and it doesn't really make sense for
these microcontrollers that are part of
pretty go to decide
on the engine.
So I was thinking what could this BW
a stand for?
And I think a much more likely
explanation is that it stands for
printed wiring assembly, which is
essentially a PCV.
After all, the components are attached
and that seems to me like a more sensible
explanation for this term.
And then there is the second kind of
complication, which is also a giveaway
for what I think that pretty goes
actually about.
There is mention of a suitcase.
There's mention of a B.C.
You add a grip stock.
So how many people are familiar with
the terminology of B.C.?
You can grip stock,
right? That's not a lot of people.
Now, this is not typical air to surface
or air to air missile terminology.
So I have an alternative hypothesis
and that's that pretty go is a man bad,
smart arms control solution.
So for those who don't know MANPADS like
Stinger missiles are shoulder
portable systems that can be used to take
down various advanced aircraft.
And this is essentially how they work.
Like at the base, they have a launch tube
and the missiles are typically delivered
into this Kabul lunch tube, which after
the launch you throw away
and that includes the site assembly.
And these tubes can be reused,
but that's usually done at a depot, not
on the battlefield, and are transported
in a dedicated case which seems to match
this suitcase terminology that we saw
earlier.
And then the missiles themselves look
roughly something like this.
So at the front you have a seeker
had which typically works by
infrared.
And it allows for passive homing.
It takes an eye, our signature
of the target and then locks onto it.
And then you have the guidance and
control stare section, which essentially
steers the the missile during
its flight towards the target.
And then you have a warhead, which is the
thing that goes boom.
And then you have this grips duck
terminology that we saw, so in MANPADS.
You'd get the missile, which is a one
time use thing typically.
But the grip stock is something that is
reusable between missiles and
that is detachable.
It contains the trigger which you use to
fire the missile and it contains the
targeting electronics.
So they essentially get the signal from
the secret, had its rerouted
to the targeting electronics into grip
stock and then makes all the kind of
complicated calculations and sends that
data back to the missile before firing
it.
And this is also where you insert the
BSU, which is the terminology that we
saw earlier, which is a term that stands
for a battery cool and unit.
So it's a canister filled with something
like liquid argon, which shoots jet
into the system for both power and
cooling purposes.
And the launch procedure looks something
like this. Like a can picture on the
right, are you attached to grip stock
and maybe an identify friend or foe
system? The launch tube used
the site to track the aircraft.
Then you get audio feedback from the
identify friend or foe to see if if
maybe it's a friendly aircraft and you
don't want to fire on it.
Then if you've decided that the aircraft
should be taken down, you insert to be
you and you get audio feedback from the
grips dock as soon as you have a target,
lock on and you pull the trigger.
That's essentially very roughly how these
kind of systems work.
And I think this matches the kind of
terminology and a pretty good documents
much better than a system that's
installed on drones.
Now the core of what pretty good does.
You can see on the left here,
it essentially limits the operational
conditions for ensuring
system operation ability to
a conjunction between the three
situations that we see on the left.
It needs to be within border.
The G.P.S. signal needs to be valid and
the operational period might not must
not have expired.
So what is essentially is is
a geo fencing solution.
So people who are not familiar with geo
fencing, that's essentially any
kind of system that restricts the
usage of a particular system
to a particular time in a particular
place.
Why would the CIA want something like
this? And I must add that
this is obviously speculation based on
very few documents.
But I do think it is a more plausible
hypothesis than the one that is that is
currently out there.
Well, if you've been following the news a
little bit, especially around the the
terrible Syrian situation
after it, the the situation
deteriorated. Many of the rebels started
facing serious air power,
both by the Syrian army as
well as by Russian allies,
because the U.S. has a vested interest
in opposing the Assad regime
and the Russians have a vested interest
in supporting it.
The situation emerged where voices
started calling for maybe supplying these
rebel forces with MANPADS to counter
this kind of airpower.
Now, this does come with some problems,
especially if you're aware of the history
of supplying MANPADS to what I'd like
to call less than trusted third parties.
Man on the right went on to become very
famous.
So during the end of the Cold War,
the are the Americans, they sent
Stinger missiles to the Mujahideen
in Afghanistan to counter Soviet air
power that did end
up working. But the problem is that you
then had the proliferation of this kind
of powerful technology among parties
that went on to be not exactly
allies.
So people started
talking about maybe implementing
technical use controls in these kind of
systems, using G.P.S., for example,
to limit the use of these
these Stinger missiles to a particular
time and place to counter proliferation.
I think the most sensible candidate for
something like this to have been
developed is what came to be known
as the Timber Sycamore Program.
So Timber Sycamore was a CIA program
to supply Syrian rebels with weapons
and training from 2012 to 2017,
supposedly in all the official
communication that followed afterwards.
Disclosure meant that were
barred from the program.
But there have been sources that claim
that small batches of MANPADS have made
it to rebel hands in Syria.
Now, I have to say it is unclear to me
whether potato was a part of this
program, whether it was even field it,
maybe it was just developed and never
actually feel it.
But I do think this is a very good
candidate for the kind of technology that
you can see on those those documents.
So what is the Harry Potter connection?
Well, it's mainly in the name, and the
name is not a giveaway for the
functionality of the system.
So within these documents, two names
come forward from Harry Potter, the devil
snare name and pretty go.
And essentially Vertigo is a charm
that protects the caster with a shield
spell. And the devil snare is a magical
blend that constrains someone to a
certain position, you know?
Nice metaphor for a geo fence.
So let's take a look at a little bit of
technical analysis to delve into that.
This is the the actual block diagram
from the documents.
So if anyone with clearance is in the
room. Sorry.
There is three main microcontrollers
there.
The main processor on the left.
The tubes march, which in the middle and
the missile smartwatch on the right,
which all pick 16 bit microcontrollers.
I put some additional terms on there,
like 80, which stands for Anti Temper
IP, which stands for in Border U.
Eoin, which stands for End of Mission.
And then her stock of the Sigma Dot,
which is missiles terminology for
a tracking signal.
Now, this is the heart of the
smartphones and how it works.
So the way is these these methods work
is that the missile after the Seager have
has found potential targets
sends the signal that signal over
a wire to the grip stock.
Where are the actual calculations need to
be done by the targeting electronics?
So what the Smarts defense mechanism
does is it ensures that this switch is
default open.
So no signal goes from the missile seeker
to the grip stock unless certain
conditions are met.
And that's the whole the whole core of
the system. It closes only
after these conditions have been met and
otherwise not.
So how does that work?
You can see this on this this sequence
chart after the conditions have to be
met, after the BSU has been inserted.
It sends an encrypted signal to the tube
smarts, which to say said audio switch
on, which is terminology for a closed
smart switch and then forwards it
that the missile smart switch, which
ensures operation ability and
the protection of the system, relies on
the fact that these channels for these
communications, which is an internal
serial bus, are encrypted and
as such required the presence of keys,
which is why they included key erasure
functionality.
So when do these keys get erased
after you enter the border ones?
So you go to the target where you want
to deploy your system and you entered
into this geo fence border.
Then the keys get erased.
If you detect an anti tampering event,
you detect low batteries or if
you go out of the border.
Automation ends and then the main
processor key as well as the tubes march,
which keys are both erased.
You're also raised if a missing missile
is detected. So if you removed a missile
from the tube.
So these are the status indication let's
and I think these these would be mounted
on the suitcase and they indicate the
status in which the missile is in.
Why is this probably there?
Because operators need to know the system
is good to go before running up to an
aircraft and then figuring out, oh, it
doesn't work too bad.
This is the message format.
It's not terribly important, but it's a
send over to serial buses.
And the inner core of the message, which
is 1 2 8 bits, is is encrypted.
UNENCRYPTED messages are allowed, but
only for one message type.
And that's the case if the nonce is set
to zero.
So these are the messages that are sent
between this programing box and a
particular subsystem.
And the only interesting ones, in my
opinion, are the ones that allow you to
reprogram the main processor or
change the Beacon State configuration
or enter tactical mode.
And these are the messages that are sent
internally between the microcontrollers
closing the audio relay, detecting anti
tampering, missile missing, that kind
of stuff.
So let's do a brief security analysis.
And I have to say that this
is, again, hypothetical because the
CIA did not provide me with any missiles.
So I'm going to be talking at a very
high level. But this is the general
attack plan that I would imagine people
attacking these kind of systems going
through hypothetically.
This is what a pretty good lifecycle
looks like. So you start about
programing, the device with
key material, which is loaded into
the firmware images.
You switch it to storage mode, then you
ship it to a covert facility in
or near the the theater of operations.
The programing box, which I imagine to
be handled by a CIA officer, is then
used to configure the G on the time
fence, which is requested by by
this less than trusted third party.
It enables tactical mode.
You're handed over to these guys.
And if it is stolen, it's rendered
inoperable outside of the fence
conditions.
Or if the mission period expires without
use, you return it to the facility and
you can set it again for another go.
And this is the cryptographic
architecture underpinning it.
And you can really make up a lot of this
out of the documents.
So the keys are generated using a key gen
application, the written into the
firmware images.
The programing box itself does not
contain any keys.
Maybe it queries them from some kind of a
back end. Maybe they're entered using
some kind of a key loading device.
It's unclear to me are the keys
that are loaded into the political system
consists of a one single
one to a bit key, which is
shared between all the microcontrollers
on this man.
That's the missile smarts, which
he never actually does get erased.
And interestingly, there is one
maintenance key.
So they mentioned that there is a
maintenance key that's embedded in the
firmer images, which is identical
for all the particular instances.
So not just one man, but all the
missiles.
Why is this the case?
Well, I think that if you have
a event which erases the keys,
for example, the expiry of the mission
period, then you still need
to be able to reconfigure a new
mission, period.
And if there is no case, you cannot
communicate over this programing
interface.
So there's probably a maintenance key
that exists as a fallback that if
the actual mission key is no longer
there, you can still reconfigured this
new situation.
But from a security point of view, having
a global maintenance key
among all these these MANPADS is not a
good idea, in my opinion.
So what does the attack surface look
like? It looks like something like this.
You want go for attacking the G.P.S.?
You might go for physical tampering.
You might try to extract or modify
targets already.
The system logic.
So if we were to go for physical
tampering, this would be the most likely
candidates.
In my opinion. You might try to mess with
the beacon interface signals to try to
cause a default true evaluation regarding
of the the actual fence conditions.
Or you might try to target with this when
the smart switch itself by ensuring
that it's normally closed regardless of
defense conditions.
Now in these kind of systems, there's
bound to be anti temper measures,
obviously.
So these might consist of things like
metal shielding or they might consist of
encapsulation into coatings that
are resistant to tampering or might cause
damage to the components, should try to
remove it.
There might be light sensors.
So as soon as you open up the device, you
know, it triggers an anti tampering event
or as soon as you apply a certain kind of
pressure to the ECB, it might
ensure that the keys are erased and
there might be active measures there,
which is essentially a grid of very
thin wires that as soon as you break
them or you short them cause an anti
tampering event. And these might be exist
at an icy level, but it might also
exist at a enclosure
level or they might be woven, Judy.
Encapsulation to make
things even worse.
Now, there's many well explored invasion
techniques and also
via the icy backside, which I will not
explore in this stock.
But I think one of the most interesting
things here is that the keys are stored
in flash and not in battery backed
aspirin.
And that's interesting, because of an
attacker can bypass enough anti
tampering measures to be able to cut the
right enable line to the flash, they
might at a later point be able to prevent
erasure if the keys are
stored there.
The issue for an attacker here
is that these kind of methods are quite
knowledge and capital intensive.
And you're also working on a system
with an active warhead in there.
So that that's probably nerve racking.
The bigger issue.
My opinion is that these secret
signals might be unencrypted
and if they're unencrypted.
That would mean that even if I open up
the device and I ensure that the
smart switches default closed and the
keys are erased, then
it might be possible for the secret
to still get a lock on and get the firing
signal from the grip stock.
So I'm not sure if this is the case, but
if they are unencrypted, that that would
not be very good.
So I'm not I'm not sure how hard
tampering with that switch is.
It's just speculation.
But there's nothing indicating that these
signals are encrypted as well.
Then there's the the route of going
logical tampering.
So we want to bypass the fence.
And then in this rough attack area, you
can see that we can either tried to
change the fence parameters, we can try
to reprogram the main processor firmware,
or we can try to attack the G.P.S..
So let's try to explore what's
involved here.
Now, in both cases, we will need to first
understand the protocol, because while we
understand it from the leaked documents,
but in an ideal situation and Decker
would not, so we'd have to reverse
engineer to firmer, which we would have
to be able to extract either from the
political system itself or maybe from
the programing box.
But that's not very likely because then
we would have to steal it from a CIA
officer.
The same goes for obtaining the keys,
which would either have to extract from
the microcontrollers or again, the
programing box.
And I think that the conclusion here is
that most of these approaches will likely
require you to sacrifice at least
one man.
That's for research and then tried to
generalize it to other MANPADS that
might be in your possession.
So when trying to extract or modified
keys and firmer, there's four main
approaches.
You can go for debugging interfaces.
You can go for PSI general analysis.
You can go for invasive attacks.
Or you can go for exploiting software
bugs.
Now, some of these approaches might
trigger anti tampering measures, but
the maintenance key never gets erased
and it's global. So even capable of
extracting this, that's a very
interesting route to go down
on.
These are the debugging interfaces for
the microcontrollers that are used and
pretty go it's the Pixies
16 bit which uses intricate serial
programing and you can use that to read
or write to internal memory.
Now there is an issue.
Microchip does have code guards, which is
its own readout and write protection
is configured via flute fuzes
in the microcontroller and
a violation of its policies will trigger
a security reset and
it offers three levels of segmentation.
You have the boot segment where you have
your secure bootloader, then you have the
secure segment where you can put secure
IIS errors or small lookup tables or
something like that.
And then you have the general segment for
all the rest and the privileges go
from high to low there.
Now, this is the memory layout of the
particular microcontrollers.
You have the the firmer in the executable
flash.
And that's essentially checked with
version number and a 16 bit CRC
during startup.
After that, you have the key and the key
number, which is also checked with
a checksum which is also CRC.
And what's really interesting to me is
that there's no mention of firm or
authentication whatsoever here.
There's no mention of a hardware route of
trust or secure element.
There's really nothing beyond code
guards. That's that's the core protection
here.
An interesting disclaimer from Microchip
is that regarding code
guards there are dishonest and possibly
illegal methods used to breach the
code protection feature.
Imagine that all of these methods
to our knowledge, require using the
microchip products in a manner outside
the operating specifications
contained in microchips data sheets.
Most likely the person doing so is
engaged in the theft of intellectual
property. Well, that's very confidence
inspiring.
So the microcontrollers that are used and
pretty go only offer code guard basic
which only supports a single general
segment for read and write protection.
So there is no separate segment for boot
loaders or keys or whatsoever.
I didn't delve into code guard security
in depth for the newer microcontrollers
of PICK because I didn't have the time
for that. But interestingly, older
families code protection suffered from
what they called the heart of darkness
attack. And what you basically did here
is that you could erase the
the memory on a per block basis and that
would reset the security settings
only for that book.
So for the first block to boot block, you
would overwrite it with the dumper and
upon execution that would dump the rest
of the microcontroller memory.
And then you would at a later stage
override one of the other blocks in
another known good and then dump the boot
block that way and you would be able to
extract it.
I'm not sure if that applies to these
microcontrollers as well, but might be
an interesting avenue of approach.
Another way to try and obtain the keys
would be using side gentle attacks.
I'm not going very in-depth here.
I'm assuming people are familiar with
simple differential and correlation power
analysis.
Interestingly, 40 for the pick
microcontrollers.
The ones that they chose here is there is
no hardware crypto and there is.
No hardware based site, general
countermeasures there.
There's probably, in my opinion, also no
software countermeasures like blinding
and masking or anything like that
because they might affect Barak
consumption in an adverse manner.
And that's that's an issue for Politico
because there are extreme power
constraints here, because you only draw
power from the BSU or a battery that
is in the grip stock.
Then in this case, you would target the
maintenance key, extract it, and then
apply it again to a different man.
That's.
Invasive attacks would be an all around
the pic microcontroller families.
I believe 12 and 18 suffered from
an attack where if you d kept him down
to the dye level and you've shown you ve
light on the floating gate, you
would be able to reset the security fuzes
and quite reliably because the fuzes were
quite far away from the rest of of
internal memory.
And this apparently applies
as well to the big 20 force.
I've never seen a public write up, but
when googling this, there was a Chinese
company offering the capability to
bypass read out protection on these
microcontrollers, and I believe that
that would probably be an approach like
this. So if that applies, that's
quite serious.
Then there is the route of software
vulnerabilities that we'll be using
a memory corruption bug or a state
machine logic bug in order to either
full trade to cryptographic keys or maybe
try to cause a Senate switch
closed message. While it should not be
sent.
There is very little to say about how
applicable this is, but there are
software change requests with league
documents and they mentioned things like
when BSU power is applied
and the missing missile is active.
The arrays does not a cure.
Now the cop stuff like this.
But if bugs like that slipped into
production, attackers might be able to
exploit it.
I don't think this is a very viable
approach for the kind of attackers that
will be going after it is because the
attack surface that is exposed on the
software level is very minimal.
And doing any kind of a full blackbox
vulnerability research or exploit
development here is is hellish.
So we need to be able to extract a firmer
anyway. So I don't think this is a very
viable right.
What's more, viable, in my opinion, is
attacking G.P.S.
because the core security decision
of pretty go is based on G.P.S.
derived info, location and time.
Now, for those unfamiliar with G.P.S.,
a little bit of a 1 0 1 GP has
is part of a set of systems known as
G.A. s global navigation satellite
system. There was also a Russian glowing
ass out of you are being Galileo and the
Chinese by do pretty
go in my opinion, probably uses
the plane cause acquisition codes
because in G.P.S. you have five bands
and that the L1 and the L2 band consist
of course acquisition civilian code
and a encrypted precision code for
military systems.
I don't think particular uses that
because that would mean that the system
needs access to these military
cryptographic keys and you
don't want that in a system like this
because it needs to be handed out to
a less than trusted third party.
And it also does not eight plausible
deniability.
So that means it uses plane signals
threat. No one here would be G.P.S.
jamming because if the GP has it's
unavailable, maybe curator does not
occur. Or even worse, for the people
using these missiles.
If the GP is unavailable, the MANPADS
won't fire, which is quite interesting
for four opposing air forces here.
Now a naive approach would be to use just
over noise on the L1 and the
L2 bands, but this might
be detected through signal anomalies
or it might be corrected for.
For example, you're using multi source
correlation from different genus s
session systems using noise
filtering, stuff like that, and that
might trigger key erasure.
So instead you might want to go for a
smart G.P.S.
jamming approach where you combine your
jammer with info from the G.A.
s system and then you trigger short and
sparred bursts which are aligned with
specific portions of the missions message
such as that preamble, the time Mark
or DSC or C, and that's far harder
to detect.
Another approach to attacking G.P.S.
would be using spoofing because G.P.S.
is an authentic rated and weak signal
which allows for replay or forging,
and that's become much easier over the
years to a commercial and as
the are solutions.
So you would collect an infant signal,
moved a bats to a Faraday cage
and then continue replaying it in
a loop.
Now again, there could be countermeasures
here, such as detecting anomalies in
signal strength, latency, lots of luck
using multi source correlation or using
an internal reference clock to
detect jumps in time.
I do think there is an issue with
implementing stuff like this and pretty
go because active countermeasures would
again drain power here.
So an attacker that that that would
try to bypass stuff like this would try
to use a carry off attack where you try
to carefully align the spoofed signal
and gradually increase the power over
time to take over to signal
without causing a loss of LOC or
triggering these countermeasures.
So it's not an overcoming
all conclusion.
This does not only apply to pretty go,
everything I said is essentially embedded
system security one to one.
This applies to all kinds of geo fencing
solutions like theft prevention and
armored trucks, ankle monitors,
every area, denial and livestock
management. So you might in the future
see cyberpunk. Cattle rustlers using
technology like this.
Is any of this stuff attacked in
practice? Well, yes, especially
to a G.P.S. jamming, because it's very
accessible.
You don't need a lot of technological
knowledge. You spend 10 bucks on an
Ali Express and you buy a jammer and then
you use it, for example, as a car
thief or a cargo thief, which does
happen
in conclusion, pretty go.
I don't think it is a G.P.S.
guided aircraft assassination module.
I think it is a man that's geo fencing
solution for a covert arms supply
program.
It's unclear to me where or when or
if it was ever fielded.
Timber Sycamore would have been a good
candidate.
And interestingly, it used Eliza's
commercial off the shelf technology in a
similar fashion to commercial systems.
A geo fence is a geo fence
and possible Achilles heels here would be
the unencrypted secret signals, a lack
of secure boot and firmer authentication.
The existence of a global maintenance key
and its reliance on civilian G.P.S.
without any clear electronic warfare
countermeasures.
And that's it. If you have any questions
you can as now or as them over Twitter.
Thank you very much.
You all know the procedure.
We have eight microphones in the room, so
please line up behind a microphone
or also you can ask questions
on the Internet and
our awesome Signal Angels, we will relay
the questions into the hole.
Right now we have one question and
microphone number for police.
Go ahead.
Hi. Thank you for your talk.
When the device uses
the military version
of G.P.S.
H. G.P.S.
spoofing, then still possible.
I'm not sure about it because I haven't
looked really into the details of
like the precision codes.
I have read articles
that it would still be possible in some
scenarios because of the way
key management happens there.
But I can really answer that question in
detail because I haven't really
investigated that.
All right. We have another question and
microphone number two over there, please.
Hi. Thank you for the presentation.
I was wondering, you talked about
G.P.S. proofing to
keep the system working.
It seems like there's a very practical
attack where you could disable the
MANPADS by spoofing CBS
and pretending to be outside the fence
when it's actually still inside.
Yeah, yeah. That's I think like if
the attacker model is not
a less than trusted third party
trying to take these man bets and, you
know, used again against civilian
airliners. But instead, from
the perspective of the MANPADS user,
the adversary would be a opposing
air force.
Then using simple G.P.S.
jamming would be sufficient to
ensure that this cannot fire, which
in my opinion is a little bit
iffy because G.P.S.
jamming is not that hard.
All right. Another question and
microphone number four.
Go ahead, please.
Yeah, thank you very much.
I actually have two questions.
So first is Link.
Okay. Well, you found the documents.
So actually, what motivated you to do all
of this research?
You know, like it's a lot of work, like
the documents which you found, analysis
which you've done and you have very busy
percent. So it's a
lot of work. Let's.
Question number one.
And question number two is
all of these designs which you been
showing, like
key management, certain security
decisions, design
of this, like all the electronics.
How does it compares to you, to all
the industrial equipment you looked at?
Did you see what is more smarter,
more intelligence, more?
Is it better than in the industry
or not?
So with regards to the first question,
it's I think curiosity
and using the little spare time, you have
to somehow still sit behind a
P.C..
That that's the main answer, to
be honest.
And the second answer is,
well, I can't really say a lot about
how it compares, because there is a
degree of speculation in this research.
Like I have looked at the documents
and I can extrapolate from the security
features that I know the microcontrollers
to have and stuff like that.
So it's hard to compare
definitively.
But I would say that that the interesting
thing is that the microcontrollers use
are not secure microcontrollers.
They do not have a secure element.
They are not intended for high security
purposes.
And I'm not sure why they chose
these. Maybe it's because this was only
during a development phase.
Maybe it was because of the power
consumption constraints, but it would not
be my first choice.
So I would say, yeah.
It compares badly
in a sense.
All right. We have a Christian from the
Internet. Go ahead, Angel.
Do the rebels in these conflicts have
reasonable access to the resources needed
to crack the system?
I'm sorry, I didn't quite get that.
Would the less trusted parties
have resources to crack something like
this?
Well, they would have now,
I think. I think that's that's that's
that's the problem.
Like, to be honest, the
less than trusted third parties like
these are not stupid people like they
don't. I don't think these are people who
have the kind of resources for doing
really invasive attacks with focused iron
beams and God knows what.
But G.P.S.
spoofing and G.P.S.
jamming are not complicated attacks.
They're relatively easy to figure out.
And as soon as you know, this is a system
that works on the basis of G.P.S., which
is not hard to figure out, you can try to
develop an attack like that.
So I think even without these leaks.
Fielding a system like this is,
I don't think, a very good
solution to that proliferation
question. So I think
getting around this this kind of stuff,
if it works like the documents seem to
to hint that it works.
Yeah, they did. They could probably get
around it.
All right, Signal Angel, do you have
anything else from the Internet?
Nope. Okay, then.
Thank you very much for this great talk.
Joe's pretzels.