Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/206 Thanks!
Our next speakers, Eric, here.
He founded Tool U.S., started
many hackerspaces and worked
in the U.S. Department of Energy,
developing attacks and defenses
for tamper evident seals.
Now he runs a physical
security company called Rift Recon.
Ryan has launched the data
Haven Haven Co
built satellite wireless networks in
Iraq and Afghanistan,
and now he runs a trusted computing
company, Crypto SEAL.
Together, they've been developing novel
seal and cryptographic technologies
to thwart physical attacks on
computing devices such as
What You'd Find from an Evil
Made.
So I turn it over to you guys.
Awesome.
Oh, cool.
Oh, it's on.
Thank you very much. Thank you.
Thank you. Christine Christie.
Also, I look forward to when you pass the
bar. We're real friends, so and when you
do first drinks on me.
All right. So let's get started.
So this is thwarting evil made attacks
physically in clinical functions for
hardware tamper detection.
My name's Eric Michaud and this is Ryan
Lackey case hair.
No hair. You can separate a strain of
talked easy.
Anyway, so let's get started.
So what are we going over
today? First off, what are evil made
attacks?
And then we're going to go over who is
at risk. It turns out everyone
in this room is probably at risk at some
point.
More so than they were a few years ago.
How is it done?
What are the methods of attack that are
common and more esoteric?
And then how can we be safer and
more useful technologies are coming out
that you can implement yourself?
So, all right,
so now here's a little
bit of here's my CV, just a little bit of
it.
I was the co-founder of Tool Use.
Some of you may know some you might not
know.
I started to use 2004
and I co-founded a few hackerspaces and
riffed. I'm really I mean, like,
I don't really have any engineering
degrees, but I am a self-taught engineer,
a machinist hacker and now now an actual
CEO. I have staff I have to look after
and have great responsibilities.
I've always been a breaker of physical
systems. I love breaking things.
I've figured out tax from multi
locks. Some of you might be aware
mÃ©dicaux and will serve alarm sensors
and many other high security systems,
including voting machines.
While I was at Argonne National Lab, we
did the verification of the voting
machine hacks from Princeton University,
and we invented a lot of new stuff there
too. And also now I'm
currently through a partnership of Rift
in Exploit Hub.
Some of you don't know that, as I say,
soft are nano design
we built. We're building their whole
hardware directory.
So check it out.
Well, I'm Ryan Lackey.
I started Haven Co.
with a couple other people back in around
2000, the world's first offshore data
haven in the North Sea nearby.
I worked on anonymous electronic cash
payment systems using blinded protocols.
I'm a security consultant and payment
technology and cryptographic hardware.
And I founded a satellite and wireless
networking company in Iraq and
Afghanistan. So a pretty high threat
environment back during the the
conflict. And I also operated
U.S. military medical imaging systems
in Iraq, Afghanistan and Kuwait.
And now I'm one of the co-founders of
crypto. We do trusted computing
technology development, and we actually
ran a VPN provider for
a while. It was a consumer VPN we were
just using as a sort of a demo of some of
our technology. And when this whole
Lavabit fiasco happened, where they were
compelled to disclose their keys, we
preemptively shut it down because our
current system wasn't resistant against
it. But we're working on a system that
actually will. So hopefully next year
we'll have something great on that
regard.
So stick around.
So what is an evil made attack
and evil made attack is a attack
performed by a trusted entity,
specifically in the hotel industry.
If you are, you suspect that the media
comes to clean your room is someone who's
benign, but in fact, often the used by
nation states, intelligence agencies or
corporations. In many cases where it's
really their staff and they come in to
really clean up, so to speak,
the American idioms aside.
But, you know, bug your laptops, steal
intellectual property or any number of
different, different things.
And I would say these really came to
Mass Knowledge and
Security Committee back in 2009, when
Johanna Rakowski from Invisible Things
Lab published a paper about
attacking TrueCrypt using invisible made
attacks. And that sort of shows.
One of the interesting things about these
attacks is they have some unique
characteristics their way to get
persistent access and pivot to other
systems, and they bypass a lot of
conventional defenses.
A lot of the things that you've already
built for security make certain
assumptions about the integrity of your
physical hardware, and they just sort of
like hand wave away, say, if somebody
gets access to your physical hardware,
all bets are off.
But the problem is people get access to
your hardware all the time.
So it's really not very helpful to say if
they get access to your physical
security, we're not going to help you.
So we had to come up with some stuff and
security communities to cover things that
will work in that environment.
So who's at risk?
Originally it was, you know, government
entities, intelligence,
community or major criminals.
But nowadays, as travelers with business
science and engineering intellectual
property, how many of you how many of you
in the room?
I mean, some of you are young, so you
might not be working at a large company
or even not know that you want to.
But working in an area where you're
developing something that's unique,
that's valuable. Raise your hand.
Whether it's source code, you know, I
knew actually pretty much all our hands
up, I have to explain any further.
So it doesn't even need to be a company.
It could be your academic research.
So people that are Ph.D.
students or are working on anything or
even a personal project if somebody wants
access to you.
You don't have to tell us. But how many
of you are activists?
Raise your hand. Some of you OK.
This is stunningly relevant for you.
How many of you play poker?
I know some I've seen PokerStars bags
going around, but but are online gamers
in some way or deal with cash or some
other value? Exchange cool and
journalists, some journalists in here?
Yeah, see a few hands and people
who have lived or are living or
have family members who live in war
zones.
So I mean, I see a few hands go up.
OK, yeah, that you guys are actually at
risk. It's no longer the people, the top
of the food chain.
So what changed?
Yeah. So really, what's happened is
it's a few things the government sort of
has changed its focus.
It used to be that intelligence agencies,
primary adversaries were other major
state intelligence agencies.
Now, most of the big intel intelligence
agencies are focused on small groups,
terrorists, nones, non-state
actors. So they've developed a lot of
technology that sort of targeted on that
kind of smaller threat.
People travel in internationally a whole
lot more. It's really cheap.
It used to be expensive and difficult,
but we flew here from the US for this
conference. A lot of people fly across
international borders all the time, and
it's pretty frequent.
They also carry a lot of vulnerable stuff
with them. It used to be you travel with
maybe a physical notebook and a pen
and maybe a film camera.
And now you travel with laptop,
cell phone, tablet, e-reader, camera,
fitness tracking, device, flash drive,
all sorts of stuff and just in one bag.
So people carry a lot of stuff around
with them
and items that actually carry a lot more
information than just a notebook.
So it's a lot easier for you to.
Yeah.
In addition to the nation state threat,
there's a lot of ways that commercial
entities can now make a lot of money by
compromising accounts in the news.
There's been there.
There've been a bunch of big attacks on
major retailers where huge numbers
of credit cards are compromised, all
sorts of compromised. So it's very
profitable now to have a commercial or
criminal organization attack.
Also, if you get first to market when a
new technology is about to come out and
you're beaten to it, you get first mover
advantage. So the thing is, it's
it's it really pays to not pay for
research, it turns out.
Yeah.
So it's a pretty scary world.
Yeah.
So to illustrate this, we've come up with
some scenarios on exactly
how users can be
attacked while they're in in various
environments.
So we've got business travelers that are
doing international travel.
We've got activist organizations, the
gaming user, journalists
and people that live in war zones.
And we'll go through those and describe
some security threats.
They face some counter conventional
countermeasures they have and how those
countermeasures are defeated through
physical attacks.
So first up is the international business
traveler, and it's not really an
executive, it necessarily it could be
anybody. It could be some could be a
student, it could be an engineer.
Actually, engineers and scientists are
among the the main targets
for this right now.
And one of the things they do
is they carry a lot of intellectual
property on a device. They have source
code, they have research findings over
everything else.
So there's information that the adversary
wants to steal from their devices.
There's also the access systems back at
home. They keep online to keep working
because it's kind of crazy to go on a
vacation or a work trip and not have
access to systems so they can attack your
system while you're in a country and use
that to attack the system back at home.
And the scariest thing is they can
actually attack your
device while you're in a country and
leave something on the machine.
Take it, you take it back to your home
network, plug it in and it keeps
attacking your home network, which might
be protected. So that's the pretty big
threat.
One of the unique threats that these
people face is border checkpoints.
So and a lot of countries, you have
pretty good rights and personal personal
liberties when you're inside the country
in the U.S. and the EU, lots of other
places UK.
The problem is at borders, a lot of those
rights are either limited or suspended.
And as we've seen,
it's pretty scary. So they can require
that you turn
over a machine to them for a certain
period of time and they'll give it back
to you. They can require that you type
stuff into your computer and all sorts of
other stuff. So you might think, Oh, I'm
just going to encrypt all my drives.
There's an obvious attack, too, that they
just tell you you must decrypt it.
And if they're pointing a gun at you or
holding you at a checkpoint or something
you can't really like, say, No, I'm not
going to do it. I mean, you can, but it
becomes a legal challenge.
And once they even if they don't
get your encryption key, they just image
your drive. So they've got an encrypted
image and then they can go out and get
your key later and decrypt your your
data there.
And that can be done through any number
of different methods, whether through
video surveillance or other types
of ways of driving the key or just
brooding over time.
Yeah, yeah, especially on something like
a cell phone or something that you're
accessing all the time you're going is a
pretty short passphrase.
Another threat is the hotel maid,
sort of the the the origin of the term
evil maid.
You say you rent a hotel room, it's
expensive and small, and
you might want to have somebody clean it
every couple of days. So the the maid
or come in, they have access, they don't
have to wait for you to give them access
to their average time.
There's a door lock and the maid has
access to their master key.
If it's a conventional system or another
digital key and they can come in
and you're gone and they know you're gone
for a while. You keep a travel schedule.
They know you're out at a restaurant or
they know you're in a meeting or whatever
else, so they know you're going to be out
of the room for a certain period of time.
And the threat is not so much that a maid
becomes evil. It's an evil person becomes
a maid, an intelligence agent or
a true story.
True story. Yeah.
So, so, you know, in a
country specific
bordering country, actually, a couple of
those the the nation
states intelligence apparatus will send
people into your room and image your
drive while you're out.
If you're there for meetings and it's
pretty widely known,
there is a lot of problems with that.
They can attack your machine.
They can also attack the room so they
could bug your room and they could.
They have some control over what room
you're assigned to? So there's a pretty
big vulnerability there.
So you might think that you can use the
safe, though it turns out there's a lot
of problems with those like master codes,
ways to bypass it and the it here,
the bottom right of the panel.
There's a little easy, a little off
color, you know, circle.
That's actually a bypass key.
So you know, there's a lock out like the
battery fails or some other mechanisms
inside is not performing correctly.
You can pick that, and all hotel
steps are not rated for by any security
center that I'm familiar with.
They just say it's secure, so
it doesn't have any time to attack, like
takes 15 minutes of tools or just they're
not really that good.
And you can also take the panels off this
thing called spiking, which is you pull
the wires out solenoid because they're
usually electronic, not mechanical
anymore, and you just connect an battery
and it pulls the solenoid back and you're
in. And and there's a number of other
ways to
another threat, which was recently in the
news is the implant.
So as we said, you can image your device
when you're through a checkpoint or
whatever else, and they've got an
encrypted image, but they need to get a
passphrase or they need to get physical
access. They need to get logical access
to a machine and do it various other
stuff.
It's very difficult to detect hardware
changes on physical hardware.
There's a variety of them you can go
over.
Yeah, like I mean, to be honest, like,
how are you going to run antivirus on
that keylogger and the left side,
honestly?
What if you have a firmware updated for
your Ethernet card? I mean, know there
aren't really a lot of technologies
available immediately today commercially
to solve these problems.
Also, what about what if someone removes
the keyboard, puts a single layer PCB
with a villa that logs or keystrokes
and just transmits transmits that over RF
as many different ways to do it, as as
many different tools are available
in your electronics catalog and stuff
that you can come up independently if you
have a lot more resources like coming up
with a tool on the right called the
Cottonmouth
probably doesn't cost $20000 a year to do
this commercially. Yeah.
Another threat that you face is, of
course, network monitoring. You're in a
country where.
The cell phone company is most likely
either an organ of the state or is highly
licensed by the state, so they can see a
lot of traffic there. They can do over
there upgrades, you can do all sorts of
stuff, your cell phone, they control all
the wide area network access they can
monitor there or they can just have the
firewall. So you might think like, Oh, a
VPN is a great solution to that.
And it is. I mean, I love VPNs, but
they're they're not so great if your
endpoints compromised.
So the the
countermeasure you put in place to
protect you from network monitoring
doesn't protect you if your endpoint gets
compromised.
So another organization that has a lot of
things to fear would be an activist
organization, say, a group that gets
a lot of highly sensitive documents given
to them or they acquire them
somehow and they're controlling them, and
a lot of people really would like those
documents. So they need to
do things with them, and they're
it's pretty darn, pretty dangerous.
So they have access to documents the
adversary would like to get access to
them. Also, knowing all the personnel
that are involved in the organization is
a big risk because some of those people
might not be public about their
involvement with the organization and if
they're exposed, they might lose their
privileged access. All sorts of stuff
like that subversion of the systems of
the organization and potentially
prosecution and persecution.
All sorts of bad stuff can happen to you.
And it doesn't have to happen in your
home country can happen a lot of other
places.
One of the unique problems that activist
organizations have is they're usually
pretty poorly resourced.
They don't have a lot of money, they
don't have a lot of dedicated hardware or
anything else. There's a few that have
been raising a lot of money recently, but
in general, they're especially outside of
it. They have very bad it.
Your average like labor organization
group or whatever has has very minimal
computer security and resources for that.
So they're using a lot of their personal
machines with no real security policy,
no real full time sysadmin, nothing
like that. They're certainly not
security, a full time security guy.
So it's pretty easy to compromise
an end user in one of these
organizations. You just sort of put up a
site that attracts the users from that
site and compromise in there.
And once they compromise their computer,
then you can access the systems of their
organization.
They also face a fairly unique problem
that you're familiar with at their
physical premises, so
yeah, so black bag operations are
generally, you know, beanie breaking
and entering operations.
So you need to get physical access
somewhere. And I can be either picking a
lock by going through a window,
bypassing alarms and sensors and switches
like I'm uniquely familiar with.
This is my company does
teaches the defenses and offenses of it,
so we know what to look for and
there's many, many different ways you can
do it. I mean, one of the
one of the things I learned years ago is
like, you know, it's great to have a
carpenter on staff because you can cut
through drywall and repaint it very
quickly. And no one knows you didn't
touch the RFID reader.
How many of you have worked in data
centers where there's no steel wall
in between the drywall?
Yeah, I see a few hands. I'm pretty sure
a lot more than you think seemed quite
a lot of data centers in my time.
But yeah, there's a lot of ways to do it.
I mean, even triggering a
request to exit sensors, as an example
turns out, you can put a little pocket
warmer. You know, you go skiing or
snowboarding. You open up a bag, it heats
up. Keep your hands warm.
Push that under the door.
You'll trigger the inside sensor to
release the door lock from the inside, as
if your person leaving.
So many ways to do this, and I just
covered a very small percentage of them,
but it's really it's a big
and real threat,
and I don't think your average activist
organization is going to have a super
high security physical office because
they'd rather spend their money on on
activism rather than physical facilities.
Another class of users that are
vulnerable are online gaming users, so
this is really anybody who's got an
important online account.
It's not specific to gaming, but one
really, really interesting example
recently is F-Secure
came out with a report that a poker
player likes to play poker.
A lot was in Barcelona, and this was in
back in December, actually earlier this
month, and he
would play poker online.
He also played physical, so he left his
laptop up in the hotel room at sort of
like a physical poker competition, went
down, was playing poker and
people were compromising his laptop and
installing some subversion software on
his laptop while hours away, so his
online poker accounts got compromised.
And the really scary thing about this is
not that it's happened once it's that
this, they say it was not the first time
is not particularly unusual, has
a purely commercial profit motive.
So it's sort of like a self-financing
operation. There's no reason to believe
this doesn't happen frequently and
on an increasing basis.
So one of the things that people
think about if you're, you know,
an evil made you have the cards and keys
to get in. What if you're not and maybe
you maybe know, look, locksmith or you
convince metal, you can do something like
this with the under the door to over.
You don't need to touch the locking
systems at all.
You just grab the door handle from the
inside.
It's about a minute.
Yeah, it's.
So you can talk to her. Yeah, so what I'm
pulling out here actually is a little
wrap of steel with the cable inside,
and that's called the end of the door
tool works on lever locks,
so you know the handles with a lever so
that one's all wound up with the
velcro and then shoved under the door
actually have it over there?
Actually, Starbuck, who did the
Touch ID hack? Actually, I have to give
one to him so you guys can keep on here
in the country.
But yeah, if you want to see it later,
come by the locksmith area and say Lock
picking area and you can do some demos.
Yeah, checking to see, you
know that the door is open or locked
because sometimes it's actually left
open.
Measure the distance.
Slide under the door already seen the top
left, the tool going in.
Lifting up one to
three on, I was on the handle.
And sit, and once I know it's there.
Pull the wire jiggle.
And I mean.
So another class of users that we
care about that are here that are at risk
are journalists, and there's a lot of
definition of who's a journalist, but
really anybody reporting on this kind of
stuff at this point is doing
journalism, and journalists have
often are very public people.
So they themselves are known, but they
have confidential sources.
And the reason why these sources are
willing to give information to the
journalist is that the journalist
protects their anonymity very,
very strongly. There have been
journalists that have gone to prison for
protecting to to protect
people from from being compromised.
And certainly and worse in other
countries.
So this is very important to journalists
and there's some attacks that are
that are pretty unique to journalists
like, well, not terribly
next journalists.
You basically just arrest them and
you have them. Do you see their equipment
and you image it and you give it back to
them, potentially with with malware
installed or if they didn't bother to use
crypto because the majority of them
don't. They've got the data there, and
they're they're usually not very rich.
So they're if you seize their equipment
for a couple of days, they're really
worried that they're not going to be able
to get any work done when they get it
back. So they're not going to go out and
throw it away and go out and buy new
hardware. They're going to take that
equipment and keep using it as if nothing
had happened. And and
you went.
So yeah.
And if there's no evidence that it's been
tampered with, it's going to be really
hard to pressure your boss to get you a
new laptop
if you're not independent,
if you're not an independent
stringer.
And then the other category of people are
people in war zones. And that's really
the whole range of people that are
just sort of like families that live
there. If you've got a relative who
happens to live in a country that becomes
a war zone over time, they're at risk
because both your personal physical
safety is at risk.
I mean, obviously it's a war zone and
going after contacts and networks, you
want to find out all the people that are
members of certain organizations.
You find one of them and you sort of like
do a network analysis and find all the
people they talk to and all that stuff.
And there's a fairly unique
problem for four people in these places
where people on both sides are
in Middle Eastern countries that are in
war zones, they will find somebody
who's in a network, they will
compromise that person, they'll in
prison, they'll kill them, whatever else,
take their systems and continue
impersonating them and
find everybody else in their network,
attract them and arrest
or kill them. So it's a huge risk for
them. It's pretty much the ultimate risk.
So you'd think, as we said earlier, the
governments were sort of the original
people that that face
these kind of risks and they have some
solutions. But as we'll see, they have
solutions, but they were really just for
government. They're not really applicable
to a lot of other people and a lot of
cases, and they're not really foolproof
either. So government security is
certainly not a bulletproof thing.
One of the things they've always built on
is they have is physical security.
Governments have have long way before
computers relied on physical security to
keep their records facilities safe.
They have a bunch of standards.
I'm familiar with the U.S. standards, but
a lot of countries have these things
where the if you're going
to use a computer at a very high security
level, you can only do it in a special
kind of environment.
You don't go to a coffee shop with your
laptop, you don't go to a regular office
environment with a laptop to process.
You do it in a room called a skiff
sensitive compartmentalized information
facility. It's basically a bank vault
that is lined with some metal
to block. RF shielding has physical
security, so it's got very high security
locks monitoring
alarming everything else.
Super expensive, like the seals on the
doors alone are like five 10 grand, so
you're not really going to buy these
commercially.
They're restricted. A lot of the standards
are actually themselves classified in
order to build one of these things.
They're required for defense contractors
in America. It's it's a big, big
deal.
One of the things they have actually our
embassy. So they actually were
able to get all the other countries to
come up and do some treaties.
So there's Vienna and other places where
they they decided
that all countries embassies would be
sort of inviolate territory of
other of the country extraterritorial.
So they will not be able to be
subject to local search or anything else,
which is great because a great way to
defend against this search is to just
not be allowed to be searched.
Unfortunately, by private citizens can't
really do that.
They have special couriers that will
transport material between sites.
They'll have their run basically their
own courier service.
Sometimes they use commercial carrier.
Sometimes they have armed security guys
that travel with the item and keep it
protected that way.
They've got a lot of other stuff.
But basically, the fundamental thing here
is all this stuff is really, really
expensive and one of the things they do,
it's sort of like the least absurd
thing they do is they have a dedicated
travel pool of laptops that
are the only machines that are allowed to
be taken out of their facility.
So if you're a government user that wants
to go to a foreign country for a
conference, you don't get to take your
work laptop. You take a special laptop
that only has access to very minimal
things, doesn't have access to home
systems. Everything else that works great
if you've got like 500000
employees and they don't really need to
do a lot of work during that trip.
But if you're a private person who
travels to a country to do work, you
have to. Take your stuff with you to do
all your work while you're there.
Good question.
Quick test, quick question.
Who travels for work with their laptop?
Everyone should look around really quick.
It's a lot of hands up. No, don't keep
him up him up, so hide it.
Now look around.
A lot of you do that. Yeah, yeah, that
wasn't happening in about 20 years ago.
I just like that the landscape has
completely changed.
Yeah. And they do some cool stuff with
those travel laptops. They actually, when
they get them back, they do
various forensic analysis on them.
Sometimes they do physical inspection,
sometimes they X-ray them to see if
components have an attitude and they do
all sorts of crazy stuff on these things.
Depending on who they are like, certainly
U.S. agencies usually have more money
than a lot of countries do, so they're
going to do more of this stuff.
But. And if they're going to a high
threat environment, they might do more
than if they're going to a friendly
country. But but they do a lot of stuff
that's really difficult to do, and they
have so much money they can build their
own custom procedures, they can
implement great policies, and government
employees are really good at obeying
directives and doing it
persistently and consistently so
they can have a policy where they have to
go, do something every day and they'll
actually stick to it.
But yeah, custom hardware, detailed
accounting procedures, everything like
that.
OK.
Problem is, it's not completely
effective. So it's super expensive and
doesn't actually work.
So it turns out
certain organizations, when they come
into problems like these, they develop
specialized tools.
So as I said at the very beginning in the
co-founder of Tool USA and Sport
Picker for a long time, then I worked for
the United States government.
Learning more stuff and how the mindset
worked was like, You know, you need to
get access in these hardened areas.
I never worked on those particular
problems, but I learned around that and I
eventually started learning about other
tools. And as a man by the name of John
Faull, who makes tools not generally
for the public market, he makes lock
picks for the public market.
But he came up with this particular tool
about 20 or 20 years ago, I've been told,
used to be a classified tool.
I don't think anyone has seen this ever
in public.
And so this is basically we're dropping
this right now.
This tool right here is called the
universal pin tumbler decoder.
You can buy the lock, pick an area later
and take a look at it.
Basically, what it does is it is
designed to not pick a lock, the decoder
lock this tool.
What it does is has a very thin wire
shim. It doesn't lift the pin.
It slides between the pin and the cavity
and it curves back and you can see
if you could see it very well because of
the wires. So thin rdsap, I'd like to
hear you. We'll have more videos online
in a bit.
This tool is no longer classified, so I'm
not getting that kind of trouble.
But the tool I turn up the hypodermic
syringe, which carries a needle as like a
little wire and slides up.
And you can see at the top 10 you
mentioned seal spins right there.
That means I touch it
and I'll feel that on the plunger.
And when trained,
when you trained enough with this tool,
you can decode locks and down in as
low as 30 seconds.
And the other interesting thing is to the
design of this tool is that you can
come back years later as long as the lock
has not been repaired.
So if you only have time to lock in a
dark corner, go by and try the first
pin. You figure it out,
go away till maybe one of your other
backpack operators and say, OK, we got
this one to do this one.
And if you only have 10 seconds at a
time, you can do that.
And then eventually you will have
persistent access because you will be
able to cut the key to code after
the fact.
So these are tools that are, I guess, I
said, not available to the public
market, all heavily restricted.
I can't even really buy them, but I do
have one from a friend.
And so I thought it would be interesting
to show the public what kind of
tools are available now. I said, this is
20 years old on their way, more
sophisticated tools today
to give you some perspective as to what
is available, as you can also see through
the other talks or other tools that most
people didn't think existed.
Yeah, and there's other tools.
The other thing that's unique about
government is they are willing to spend
a lot of money to go after a single
target.
In the case of the U.S.
and the Soviet Union, back from, I think,
the 50s or 60s US built this great
embassy in Moscow and
they got a gift from the the Soviets
of a seal. A great seal of the United
States is really, really pretty.
And they did.
They thought, Oh, just have a microphone
inside it. It had no active components
or anything else inside. It was just this
nice seal. So they hung it up in one of
their sensitive meeting rooms.
And it turns out
it actually had a piece of metal inside
it that when you irradiated
it with RF from outside, the thing
from one of the Soviets facilities turned
it into a microphone that would remotely
transmit a thing.
So they spent, I don't know how much time
coming up with a thing for a single room
single attack, but pretty effective.
And there's no reason to think they
haven't continued doing that over time,
given the $50 billion budget
for this kind of stuff every year.
So it's it's pretty crazy.
But and the other reason why there's
this weird technical thing, so those are
the advantages government has, but they
also have some disadvantages.
One of their big disadvantages is
actually there. Their other strength is
that they're so big and they have so much
money and so much staff.
That means they've got a lot of insiders.
And one of the biggest risks to them
is that they have insiders that are going
to either accidentally not comply
with security policy or willfully not
comply with security policy and pretty
much over.
Recently, we've seen some of the
consequences of that.
So they have that threat, whereas
a small an individual certainly doesn't
have that threat. And a small
organization generally doesn't have that
threat as frequently.
And sometimes they just screw up like
they went to the US commerce
secretary, went to China on a big
meeting. They did everything right.
Most of the time and they just sort of
like left a laptop containing the
commerce secretary's left a bag
containing his laptop like somewhere.
And yeah.
So if the problem is, they have to be
right all the time, and if you screw up
once, that's so great.
So where do we go from here?
We have all these types of attacks and we
think we have all these defenses.
And it turns out they're really
not that good, especially when you don't
have a well-resourced entity to
take care of having a dedicated security
staff to train employees and everything
else. Well, the seals aren't the seal.
These kinds of seals, so
seals kind of in many shapes and sizes.
I actually I have
a particular way of describing them, but
where I used to work at the vulnerability
assessment team in Argonne, they have a
great description of tamper
evident devices, and I'm
going to read it right here.
So
tamper evident devices are used
to detect and report no unauthorized
entry. Let's take an idea of what it is
and perhaps discouraging.
Unlike intrusion or burglar alarms, seals
report unauthorized entry after the fact.
They must be inspected either manually or
electronically so they can be, you know,
tamper evident tapes.
Stickers, seals like the pull of an
orange is actually a temporary indicating
device.
If it looks like that the wrong color and
you don't eat it, that's his job,
but didn't help you prevent that.
And they also so
a seal does not need to resist a physical
entry. Actually, it's supposed to be
broken, but it's supposed to indicate to
the person that it has
been opened.
In other words, a seal is not a lock.
Indeed, some seals are made of paper
or plastic and can
be easily removed or cut off
certain security products and this
barrier seals.
They do provide a physical barrier to
entry.
But again, they're not also very often
reusable. These are hybrid devices.
Part lock and part seal.
Barrier seals should be used with care
barrier seals, often a compromise of
compromise of a product.
Neither optimum has a lock or as a seal.
It's a dual function tends to complicate
issues about how to best use the product.
So whether you use it on a laptop or in
your car, on a shipping container, et
cetera, et cetera.
SEALs also require a very strong
procedures to be put in place to be
effective. If you don't have a
policy of having someone check and
actually checking things, not just
looking at it, but seeing its serial
numbers line up does that.
It does the device look like it's been
messed with to peel back the change
color? Any of these different factors, if
you're not checking for those things
which can take it and require
a trained eye.
They're not effective.
And so you need to have procurement and
storage and recordkeeping procedures to,
you know, make these things work.
So anyway, turns out,
physical seals also really suck.
Aside from having what you think are a
good thing, good seals like you see on
the market, it turns out that
there's an event at DEFCON called the
Tampa Village, and they've been people
been taught last year.
And now this competition's about how fast
people can develop these seals.
As you see on the table over here in the
picture, you see a lot of plastic rafts
and beads, and those often are defeated
by, you know, shims made out of coke cans
of beer cans.
People also use solvents for
the paper materials and plastics
like hep tin acetone.
All of these things are over-the-counter.
And it turns out that it doesn't
take a very long time to defeat
seals that did a study
over the years, and they keep adding to
it as they do more seals that they
haven't seen. But as you can see here,
the average time to defeat average
seals, even high end ones, is around a
minute and a half, and
the median is even less than that.
Like I, I a lot of them I can defeat
around that time frame myself and I teach
that too.
And now I know the defenses for these.
And it turns out that's not really
expensive to do so.
Some some of them are really expensive.
But yeah, so.
So there's another problem is that users
are lazy.
This this requirement that seals be
verified by by the user
and have a big security policy and
everything else. We've we've got some
sort of analogs in the regular computer
security world. Things like SSL
certificate checking and SSA games and
everything else. People just click
through. They don't, they don't really
put any effort into it.
So when they've got a choice, they're
going to skip ahead.
So it's really unlikely
we're going to build a great system that
depends on users making correct
security decisions all the time.
There's another feature that be really
nice remote attestation.
It'd be nice like this whole cloud thing
with like remote services and all these
other things. Be nice of the cloud
service that actually had your data knew
that your laptop was secure before you
connected to it and did all this stuff.
So you need a way that
your computing device can prove
to the remote server in your organization
server or a commercial service or
whatever that it's actually intact.
There are devices that do this.
The problem is they're not really ideal.
One of the classes of devices is
something called a hardware security
module. They are basically
computers inside little safes.
They've got tamper evidence all over them
and tamper response.
So if you try to mess with them
physically or logically or anything else,
they erase the contents before you can
get to them.
The problem is they're like $20000 each,
and there's maybe two or three big
manufacturers of them, and they're big
defense contractors, slash government
vendors. So if an activist
organization were to try to buy one on
the website, one, they probably didn't
get one because their expert control,
too. If they were having one shipped
to them, it would be one of those
packages that would get sort of like
mysteriously delayed for a couple of
hours and replaced with one that's
actually evil.
So they couldn't trust it.
And they're so expensive that no one's
really going to do like a tear down
analysis of a $20000 device where
you got a burn like five or six of these
devices and everything else, like no
private organization is you.
No private individual is going to do
that. And you can't really trust like a
standards agency to do this for you.
Yeah. So there's also
smart cards, which are great.
They're cheap, they're in all your cell
phones or SIM cards.
They're in I.D. cards or in payment
cards, everything else from us, they
don't actually provide enough physical
protection for this threat model.
They provide protection for individual
credentials. But in this case, if you
compromise any of the systems, you're
going to compromise all of them.
So it's not so great.
There's also trusted computing, so it's
the the tag 20:00
text all these acronyms from people
that have been really around since, like
the mid late 90s.
It's inadequate.
It's inadequate for a few reasons.
One not really widely deployed doesn't
really work, but maybe we can fix that.
But second, it doesn't protect
the whole thing that you need to protect.
It was designed to do basically DRM
digital rights management to keep people
from pirating movie content.
We can see how well that's worked.
And it it's not
really designed to protect a single
machine, a single computer from a focused
attack. You can still attack the memory.
You can attack all sorts of stuff.
So it's insufficient and it's a pain.
So it's not really a great solution,
either. And certainly, it's not a great
solution if somebody has physical access
to your machine to do stuff with it.
So where do we go from here?
You know, people think it's a good idea
to, you know, take a notebook, write down
things and check it. But it's not really
objective.
You need machine verifiable and
repeatable tests.
So quick quiz for the
audience who can tell
me what is different about
these two pictures.
Raise your hand and I'll put you out and
you can yell at anybody.
Audience participation?
Anyone just shouted out what's different.
No one, I know it's kind of hard
up here. OK, maybe this will be a little
easier.
It's a technique called blink comparison.
What's changing now? Can you see it?
Right.
Yes, that's true.
This is a simple technique you can use
developed by astronomers many, many,
many, many moons ago.
And it makes it a lot easier for you to
tell it something's changed.
You can't just say I turn the screw 38
degrees. It's just not going to really
cut it unless you have, like, you
know, method photography, like
a mobile phone or some other device.
It's just you won't know if something's
been tampered with or just you're
paranoid, even if it's true.
So where do
we go from here?
Yeah. So the problem is
so this is a great check.
And if you use a cell phone to do this
check, it's easy to do.
Cheaper to do everything.
But someone shouted,
OK,
so it's easy to do.
But the problem is it doesn't really
address the problem of users are pretty
lazy.
What you do is you'd ask a user to say
are the seals and tack on your machine.
Before you log into this website, please
check. Check this box if it's secure.
Yeah. You know how well it's going to
work. So what we did is
we came up with a way that we could make
the seal verification
basically like a two factor
authentication.
So if the machine check that
then sends something to a remote
server that's located in your in your
home data center verifies
the integrity of the seal and then sends
you back a short lived credential.
Right now, it's a Kerberos ticket, but we
could do SSL, sir.
We could do all sorts of stuff or just
allow you access the resource.
And this basically makes it non skip over
by the user. If the user doesn't
do the check, they don't get access.
Pretty fair and it works great.
It's cheap, uses cheap seals, uses
cell phones that everyone's got with
them.
The cell phone is considered to be secure
because you have it with you at all times
and it can protect.
And a lot of these scenarios that we've
outlined can go through the
business traveler. All these people.
Yeah. So how would you apply these
things to your own devices?
So first off of the business traveler,
nowadays people are starting to make USB
port plugs like ultra port plugs
like in your ThinkPads.
What you want to do is put them in to
disable the port. Physically, you'll have
to disassembled machine.
So if you're putting tamper evidence
stickers over all the control surfaces,
which are areas that you can open to get
internal access, it's a good start.
Then again, you've got to make sure you
have a tamper indicating device that
is very fragile.
You don't want something that could be
peeled back and put back very
quickly unless someone doesn't know that
that actually is a tampering to conceal.
Maybe you just have your EFI sticker as
an example and anything.
It's just decoration, but really, it's
you. It's to tell you that something has
happened and then activist
organizations at their headquarters.
Maybe just putting, you know, a pen
on a table in a particular way and then
you photograph it. You have to do like a
photograph. You can't just say, I placed
it there. It's you're really going to
miss stuff. And so what you do is to get
access to, let's say, a filing cabinet.
You maybe have to move something.
And if they don't play spec directly,
you'll know something has happened.
Someone has been there.
Just make sure if it's something light
like paper, you don't have a fan blowing
around and just knock things over it.
Be useless online gaming.
Or you can use the safe, but you should,
you know, use seals in the safe.
I didn't really cover covert traps, but
covert traps are, are,
you know, your secret tamper indicating
devices like a piece of hair like you put
it on doorjamb, like at place it.
It's very hard to see, very hard to
detect unless someone knows to look for
it. But then you have other seals around
just as distraction.
But they also are covering important
parts.
Journalists operating in dangerous
environments, they're kind of the same
thing.
But also, if you're going to go meet
somebody in a particular area,
you know, you clear it ahead of time.
You go check out. I mean, you're going to
be in a room where you know, no one will
be. But you want to make sure that after
the time between you clean it clear,
check it and you come back.
No one's been there. So you put seals on
doors. Maybe you move a chair in a
particular way so that you can check
again with a photograph.
And for people living in war zones, one
of the ways you could use this would be
when you're sending information or
sending physical items to people, you put
them in a sealed container that has seals
and you send them out of band through
email or through some other means.
The integrity information for that seals
they can verify the package hasn't been
tampered with and they receive it, so
they know it's actually from you.
It's basically a way to cryptographically
sign a physical item, which is kind of
cool. Yeah.
The problem with all these seals, we
think, are a great solution to this, but
they've got some definite problems.
The biggest problem is they can't go back
in time.
You know, you need to
if you've got a device and you just show
up with a new device and you ask me,
like, is this device tampered with?
There's no way I'm going to be able to
give you a good answer because the
there's so many ways you can tamper with
something. If you don't have a good
baseline measurement on that device, you
won't be able to compare it to anything.
So you'll be trying to find like vendor
specs for it. But there's Arata that
basically is going to work. I would just
tell you, buying a device the
and most of the devices, they're not
designed to be very tamper evident at all
because tamper evidence is like the enemy
of easy manufacturing and cheap
manufacturing.
So people want cheap stuff.
So the problem is we need to convince
people that they should be worried about
this in advance of having a problem and
sort of implement these policies earlier
on.
Operational security is not retroactive.
You've got to be doing it at the beginning
or something bad is going to happen.
On the line.
So and so we've got some areas for
research by other people or us or
whatever.
So a major area is this is actually
policy. Knowing that you need to do this
or that isn't is a threat, that physical
attacks are a threat and you need to do
countermeasures computing devices
that are designed for better tamper
evidence in response, maybe a
computer that doesn't have a bunch of
ports on it and a bunch of direct dmaa
access memory ports external to the
system and things like that would be
nice.
Better ties between the SEAL technology
and trust computer technology.
So I sort of wrote off the TCG
trusted computing stuff from a physical
perspective, but it turns out
if you combine that with seals, you can
actually get some pretty good protection
that you wouldn't get with either alone.
And integration in an organizational
environment into things like your VPN
system, your mobile device management
network, access control.
Because if this is like a little separate
system that doesn't really touch the rest
of your systems, you'll ignore it and it.
What actually is it? But if you tie it
into your VPNs, you only get access to
your VPN. When the seal check is
verified, only get access to
other resources.
That way, it'll work really well, and
the seals we're using are not really
designed for this. They're sort of where
we were reusing seals, the the
sensor platform we have as a cell phone
that has a it's a decent camera, but not
a great camera, especially for macro type
stuff. And a lot of the seals
are designed to be inspected by humans
visually, like a very forensic level.
So nice to have seals that are designed
and optimized to be better,
sensible by the verifiable by phone
and maybe other kinds of thing rather
than visual.
So it's a bunch of stuff like that, and
I'm sure there's other areas of research
that are that are appealing as well.
So in conclusion, we're now realizing
that there's a much wider variety of
users at risk, it's not just government
entities and intelligence communities,
but it's basically everyone in this room.
New technical solutions are needed.
Most of this stuff and most of the
knowledge base is kept up in those
organizations, and there's not a lot of
that publicly available just yet.
There's a lot of people that are amateurs
playing this game, and some professionals
and I understand where I'm from.
I know most of them.
And there's not enough to go around to
start teaching everybody.
And also, remote verified seals are a
great solution because then you have
like, you know, our networked resource
that can do a little more verification
than the person locally can do and also
can cut them off from access.
And then also, it's slightly
complex enough that you may need a little
help just to get started.
And so there's other than just putting
seals on there, but having a good
baseline of policies and procedures.
So anyway, that's our talk.
So we'll open up the floor for a few
minutes.
Christine, yeah, hi.
OK. Yeah, we have.
We have time for questions.
Please line up at the microphones we have
for microphones.
I can't tell, are there microphones up
top?
And we're also taking questions from the
internet. So if you're watching our live
stream, haven't made it to the Congress
hall yet, please.
We are taking from Twitter and
IAC.
So let's get
started. How about Microphone two?
Hi, less a question
and more a very brief story
about physical access
that I'm pretty sure even you probably
haven't heard of.
I work at a robotics company.
We exist.
The company runs mostly on interns
and visiting researchers that come and
go.
And this actually happens.
One of the one of our interns,
we had him over for a semester
and first semester.
Great break did some great work,
decided to have him back, pulled
his physical access.
His hit key pulled his other
access. But because
this is an academic environment, you want
to encourage collaboration while they're
back at their home university didn't pull
the VPN keys.
Oops! Have him back for a second
term and he gets there.
All right. And he's very young,
industrious intern.
He gets back for his first day of
his second term, all bright eyed and
bushy tailed and realizes, hey, he
doesn't have door access yet,
but he does have his VPN keys
and he's sitting outside the office.
He's sitting outside the building.
And so he pops open his laptop
VPNs into the internal network
associates is into a robot,
drives the robot over the door,
over to the door and runs the door
opening program from the
inside.
OK.
Yeah, sounds like I want to hire him.
And and as.
And actually, we checked this.
There was
there was because it was from the inside.
There was no record in the hidden logs.
Yeah, yeah. And the FDA
doesn't do only a an SS each.
You can only tell he started a VPN
session. There's no logging of like what
machine he web VPN into because
the robot is basically a little Linux
box on wheels.
Yeah.
Interesting follow up to that, and that's
great story. Thank you.
That's very entertaining.
Yeah, a lot of companies, they don't link
their VPN with their
their, you know, other credentials and
systems like if someone's desktop fires
up, but they didn't walk into the
building and this they're supposedly
there, but they're not, you know,
the CTO and the CSO
don't actually talk to each other often.
So there's a lot of problems with that.
So as an example, right there, you
don't have, you know, exit control,
access logs and also you're not
logging the robots.
So interesting use case.
But but yeah, that is a big problem.
OK, I understand we have a number of
questions from the internet.
That's just one really at the moment.
Oh, voice from above.
Christian Christian from Mercy.
Are you aware of any Open-Source
hardware security module or something
that you could build?
Ryan, you can take that schmuck
on in about a month.
I'm doing a presentation on that.
There are actually our four or five
projects to do something like
that one from a
DNA seq one.
There's a few people who use
like Raspberry Pi as they've used various
other devices.
They generally focus on separating out
the the focus on the logical
protection as opposed to high end
physical protection.
But ultimately, I think the best way to
do a and open source HSM
is to publish a great design that can use
commodity components because it's really
hard to tell if I have a I
see has been compromised.
But if you can use a variety of cheap
commodity components, you can.
You can put them together, you buy the
various sources and do stuff like that.
So yeah, there's there's some interesting
work in that area that that will be open
source and public.
OK. Microphone for
hello.
I have more
request. Not exactly a question.
Could you please show again the slide
where you compared those two photographs
because I didn't see anything?
Oh, sure.
Yeah, it's it's hard on the screen
because I don't think it is.
It's an app and it's not very
bright. So I'll
stand right over here and I don't have a
laser pointer, but it's that screw.
Sorry. And I'm going have a seizure
that screw right there. Can you see it?
You might need to get closer.
That's the thing. Like when blown up with
this contrast is really hard, but when
you actually look at your laptop screen,
it's very easy to tell.
So again, walk closer to the screen,
you'll definitely see it. But that's the
thing. The point was, it's a very minor
detail.
And if you aren't vigilant and if you're
just taking notes for something that's
practically useless, I mean, you're just
really going to go on the side of error
that something happened sort of actually
having proof.
OK, thank you. You're welcome.
OK. Microphone two,
the
description said something that you
will present something about physically
unclothed little functions for hardware
tempo detection if I understood you
correctly. Would you mind elaborate on
that? What what results you got there
and what kind of protection
you can achieve using that?
Yeah, so we did because of the time
constraint of the time we pulled out two
slides and one of them aside from
physical, physical and clinical
functions, which are in our context,
my context for work is, you know, devices
with unique characteristics of
manufacturing.
You know, we'll actually put it up in the
slides on the way out when we upload
them. We had to to change batteries.
So we had the same laptops
and the identical batteries.
But when you swap them and they're from
the same line, you could easily tell
back and forth which things are changed.
So if someone swaps out a component, it
turns out through, you know, plastic
manufacturing, you and milling, they'll
look slightly different.
But it's hard to tell visually side by
side. But if you do a quick blink
comparison, you can tell and it
seemed like, you know, the stickers the
stickers themselves are, you know, puffs.
You might be thinking more of the ones on
a chip level, but this is
more macro.
So we've also done non sticker
seals, basically paint special paint,
dynamic things like a metallic paint,
glitter, things like that.
Those are also a form of physical and
clinical function. There's also the array
of fiber optic cable where
it's sort of randomize
it really anything where it's you
physically can't copy it in the
manufacturing market. So there's
randomness in the physical manufacturing
process.
The technique of verifying and doing
remote verification works just the same
with us. We can't do this with
like chips because we don't have an
electron microscope on our cell phone
right now. But we could we could do this
soon where the goal is to be able to do
the sensors that will work with the
phone. So we have to do macro level type
stuff.
OK, so it's not about smart cards with
physical functions, it's just physical
changes with virtual photograph
of the device level things
not not a notch
further up the chain. They're both
physical and clinical functions.
They're just at different scales.
OK, then I have a follow up question
if I can. How
does it actually work in practice?
Because you leave your hotel room in the
morning, you come back in the evening,
you have different lighting conditions.
You cannot put the cell phone into
exactly the same position.
How does it work in this scenario?
I'll take that. That's actually really
easy to do. You close the shades, turn
the lights on so you have a consistent
lighting condition and that you put your
mobile device or camera device in in a
big format. So you find a surface
that you can but your camera up to and
lock it so you have like a shelf.
Push it against the wall, stand on the
side, take a photo and it almost every
single time. It'll be identical.
And then then you can correct it on your
on your laptop or other other devices.
And just over line, overlay them and then
flip them back and forth that you can
use, like for Macintosh preview.
And actually don't.
These windows, so
there's also registration marks that you
can put in the image to the system.
We have some not very great open
CVV code right now that try to do this.
Yeah, that
which shall be open and released the
you can put registration marks in to make
this process a lot easier.
The problem is you have SKU and stuff on
the camera, so it's actually a fairly
complicated problem.
But it mostly
works and there is a product in the
iPhone store that does blink comparison.
The problem is it's it's
very inaccurate because it wants you to
hold it, and a human is not going to be
able to replicate the same, you know,
you know, parallax for your shot every
time it's going to be slightly off and
it's going to be very I've used it.
It's not very great.
And so as I said, like basic things like
find something in the room that's a
movable that probably hasn't moved.
The desk may have moved, but find
something is nailed down like a a shelf.
And then you can just do that shot and
you get a very reproducible
and yeah, and certain kinds of seals
are going to be much, much easier to
verify than other kinds of seals.
Large.
Thank you for the question.
OK, do we have a question from the
internet?
Another question from the internet is
how would you make your own seal?
And if you were to get to see
what? What would you be looking for
into a good seal?
So a good seal, you want something that's
easily for tangible, but it's not going
to break by accidentally use.
Like, I don't want
to give away all the traps because then
that gives my adversaries an advantage,
but a good one, which is easy to use as
a pearlescent paint or nail polish.
Put it on all your screws.
Take a photograph, specifically
ones that have a lot of glitter in it
because it's going to be very difficult
to replicate that.
Yeah, there's really two classes of big
classes of attacks.
There is taking an intact seal, removing
it from a device, tampering with the
device or tampering device without
breaking the seal. And there's
counterfeiting the seal itself.
Conventional seals A lot of cases depend
on like mass manufacturing being really
hard and unit one quantity one
costing the same as a quantity 10000000.
That's not so much true anymore.
With a lot of manufacturing technologies,
I can copy something pretty easily.
So I take your device protected
by a seal.
Cut the seal off, destroy your seal and
just make a new one and put it back on
and you can be able to tell that's
that's a threat. But certain kinds of
things like the glitter are going to be
very difficult to do that with,
and it's incredibly cheap, too.
And it looks pretty good and cheap is a
major, major problem.
Also, it used to be fairly durable
because you don't want it to break
incidental use. There's some tricks you
can do to help against
that.
But yeah, yeah.
So stickers like cheap, crappy stickers.
One of the things we've been coming up
with is actually time decay stickers,
where if when you think it with
a VPN service, these
you apply the seal and it will the
color will fade away and when you
take it, the system, of course, will know
what the general decay should have been.
So someone will have to have like a
hundred or a thousand seals prepped over
time, consistently fading to
to know to get it at the right time.
But also, if they, you know, they could
time out or not get the right one after
three tries and then you'd know that you
won't be able get back in the system.
And that's that's a good thing.
OK.
Microphone for
the discussion, you just had reminded me
of a paper from Princeton University, I
think from last year about pieces
of paper, and they found
that pieces of ordinary paper
were actually more at the microscopic
level, quite physically distinct from
each other. Yeah, I think an ordinary
scanner was able to reveal patterns
of wood fibers in the paper that
were distinct from a piece of paper or a
piece of paper or a piece of paper.
I believe that.
And that was quite scary from a privacy
point of view because, for example, the
company that the paper could actually
have internal serial numbers of the
sheets of paper
that it's like banknotes are your printer
cartridges.
Huh?
Yeah.
So I guess from a seal's point of view, I
wonder if with a sensor that
people might have, if you could
actually use maybe sheets of paper and
the wood fiber patterns in them?
Yeah, that is physically on clinical
function.
There's definitely a legitimate method.
Yeah, I would guess that is a legitimate
method, though having a flatbed scanner
with you on your trip seemed a little
more unlikely. So we do our best to find
ways to use the tools available to you
currently so that you can do that.
Do you think there's a prospect?
I don't know what level of magnification
you need that the cameras in phones
at some point soon might actually be able
to get some of that pattern.
You could do the conditions.
Yeah, definitely. If you had one of those
external little like 30 dollar macro
lenses on your camera, you'd be you'd be
pretty well served there.
We can look and look at this.
It actually looks like an interesting
thing. Yeah, actually.
Send us an
e-mail. We'd love to chat more about
that, too.
Yeah.
OK. Do we have one more question from
the internet?
Oh, OK.
Sounds like real good.
All right, well, you guys, thank you
again for having us.