Biohacker: The Invisible Threat

thank you cat uh i know it's been a long day um for those that that are still here the next gentleman coming to stage won't be disappointing um he's going to be presenting biohacker the invisible threat his name is leno and his message is resistance is futile i spent some time with len last night so i'm going to make sure i get this right for reasons that i'm sure all of you will get to learn as he goes through his presentation leno is a white hat and technical evangelist for cyber arc software together with the cyber art global solutions engineering team they are responsible for enabling internal staff and the starting point for escalation for all ses in the field

they are responsible for the global templates used by all ses and partners building new integrations and use cases for all engineers len is an international security speaker who has presented in over 29 countries and multiple major security conferences worldwide prior to 2001 len was a black grey hacker and learned most of his skills by practical application len has spent 20 years in the areas of web development system engineering administration architecture coding and the past six years focusing on information security from an attacker's perspective len is on the cutting edge of technology and recognized as a leader in the transhuman cyborg movement he has seven microchips under his skin that are used as offensive cyber tools

len has demonstrated the hacking abilities of augmented humans and provides information for security professionals to adapt to this new threat landscape he also actively participates in the activities of the information security communities in texas the autism society and many others ladies and gentlemen help me welcome and to the stage

how you all doing i like that woozer woozer happy uh as was just said my name is len no pronounced no opposite of yes and if you ask my parents i was named very very appropriately because i've heard len no no no pretty much my whole damn life so this is probably going to be one of the more out there talks but everything that you are going to see today is real so this talk was originally done last year with some mild modifications at the rsa conference but due to the fact that kovid kind of repressed all of us from being able to get out in the world and actually share this information i'd like to thank

besides cayman for giving me the opportunity to come here and present so let's go ahead and get started as i said my name is len noe i am currently a technical evangelist and white hat for cyberark software i've been with cyberark for nine years uh i've been breaking into computers since the commodore 64 days and you know to be honest there's really not much else i'm really good at um yes that is a qr code yes it is safe if i was actually trying to hack you this would probably be a very very career limiting move at a large event like this the only thing that that qr code is going to give you is basically my

contact information that you see right there so i'm going to start this chat by asking everybody here a simple question what do cyborgs look like you know i have no doubt that in in the heads of everybody out here maybe you're thinking darth vader maybe you're thinking a terminator but the truth is you might actually be friends with a cyborg and you don't even know it yet these are my hands as you can see from the x-ray here i have multiple implants in my hands and this x-ray is actually a little bit older i actually have quite a few more since the time this was actually done but i'm going to explain what i currently have and i'll tell you guys a

little bit more about what i'm doing on my roadmap to actually become more than human so i'm going to start off i have what is called a flex next this is a flexible membrane rfid and nfc chip with a very large coiled antenna this allows me to program the chip to anything that would fall under either low frequency rfid or high frequency nfc i have a next chip this one as you can see is a different form factor this was actually the very first implant that i ever got and the before i get the questions later yes all of my implants were actually implanted in my body for the purposes of offensive security the next chip as it was the first implant i

ever got it i discovered that i just didn't have enough distance in order to be able to perform you know any type of exfiltration or compromise of a mobile device and still make it look like it was a normal you know handling of a cell phone uh these two chips are essentially identical i use the very large one for defensive purposes the small one actually currently is the key to unlock my my office at home keeps my wife and my kids out of my office i have a flex m1 magic this is a myfair classic with the rewritable 1k chip so anybody that's using a myfair classic i can actually write that information directly down onto one of

the implants in my hands and for the record here's to the holiday inn i already downloaded your my favorite your my fair door card and it's actually already on my hand this is what happens when i get bored i have a vivoki spark 2. this is actually a cryptobionic chip that actually has a companion application on my phone as i and is actually part of a triple factor authentication to get into my crypto wallet since the time of these where these x-rays were taken i actually have what is a flex e-m in my wrist right here this actually allows me the ability to emulate uh indala prox pyramid diamond in terms of physical authentication protocols i

also have a uh titan biomagnet in my my hand you know and this is where i like to do this little trick here if nobody's ever seen it so i can actually pick up metal objects with my pinky you know it makes for a really cool bar trick but that's not what it was for this actually gives me the ability to feel electromagnetic currents and electromagnetic fields you know and i get the questions all the time well what does that do for you lynn i'm a pen tester so i also do physical pen testing i i'm a a very avid lock picker but let's talk about your your warehouses what type of locks are typically used in

warehouses and storage magnetic locks so that allows me on the outside i can actually run my hands over the outside of your building and i can find the electrical pathways to where that electric lock are which gives me better opportunities especially if it's an invasive pen test that i can actually shim your magnetic locks currently sitting at home right now i actually have two more implants that i'm just waiting to actually be put in i have a chip called the wallet more this actually allows me the ability to do tap to pay just like android wallet apple pay or your nfc credit cards i have an hid implant that will allow me to impersonate hid one two and three for

physical access cards and i have an nfc des fire two that i'm waiting on delivery and then i'll just go ahead and get all three of those implanted at once this will actually give me higher nfc capabilities up to and including using it as part of a multi-factor authentication on my computer so i am extremely heavily implanted so as i said augmented humans are not science fiction we're science fact we're here and we're not going anywhere and as the technology continues to evolve so will we so i've broken this talk today up into three separate parts uh we're going to start off with a little bit of history on the transhuman movement where we got our starts and

then we're going to move into today and then what the future holds for augmented humans and security around people like myself so when we talk about implant technology you know this is not a very long timeline the first cardiac pacemaker was actually installed in buffalo new york in 1952 and it was not a completely implanted device the power for the the pacemaker actually had leads coming out of the vic the subject's chest and was connected to a power external power supply that was actually the size of an old table radio the first implanted electric pacemaker happened in 1958 and this was actually done inside of a pig the first human implant wasn't until 1960. so i mean if you take a look we're

talking 70 years ago this is not a very long timeline uh 1964 gave us the first smart pacemaker this was a device that actually took bio feedback from the body and was able to actually make adjustments to its protocols based on that feedback through the 70s and 80s there was some some things that came out but nothing really major we didn't really start seeing a lot of improvement in the biotechnology for implants until the mid 90s to the 2000s where we started seeing smart prosthetics all the way up to where we have artificial intelligence now you know one of the things that's not on this list but there was actually a surgery done a couple of months ago

uh where there was a new microcontroller implant that was actually put on a paralyzed man's spinal cord and he actually has some ambulatory movement now i mean he's not jumping up and dancing and all but i mean this is some major scientific biomedical breakthroughs and this is where we are today so when we talk about today what is the biohacker all about today you know if you take a look at us we're called all kinds of different things biohackers transhumans grinders i was even called wet works a wetwork when i was in sweden about two weeks ago you know essentially we are the product of a gentleman by the name of julian huxley who coined the term transhuman back in

1957 and he actually started a movement and the transhuman movement is a social and philosophical you know movement dedicated to basically taking the human being beyond the physical form that we were born into you know so this can be very confusing sometimes because i am a voluntary trans human i chose to do this to myself i'm actually a very large guinea pig and i know it but if we take a look at the medical industry we have people with pacemakers pain stem pain management devices we have people with insulin pumps all of these people would be considered transhuman under julian huxley's definition these are people whose lives are either extended enhanced or saved through the use of technology

so the question i always get is where do we find implants let's be honest the same place we find everything else the internet if you're in the european you know there's a company called casec kscck if you're in the americas they're the big manufacturers of a company called dangerousthings.com out of seattle washington and when we talk about implants you know what kind of implants are there we have magnets both lifting as well as biosensing and when i talk about biosensing this actually does exactly what it sounds like so this this gives me that basically the spiderman spidey sense so i if i get too close to a magnet even a speaker i'll feel it in my hand

you know believe it or not the one thing that triggers it more than anything else is my my uh can opener back at home you know one of those big can openers you pluck you know my wife actually you know opens a can i can be at least three to four feet away from her and i can feel the energy that's in the field that's coming off of that but we have lifting magnets personally i don't see there's a lot of use case to these except you if you want to go to the bar and you know try and get some free drinks but hey to each of their own we have nfc and what you see here this is a flexible

membrane implant so as you can see from the top of this we have the chip and then everything below that is the antenna we have rfid we have bio glass encapsulation so what you see on the left is essentially the same thing as on the right but the difference is those bio glass encapsulated chips are about the size of a grain or long range uh long grain rice so the entire antenna is contained within that little glass cylinder so as a result of that your your distance for reed becomes much much smaller and you know the cayman island you guys seem like a bunch of party animals so if you like it we even have leds

you know if you want to go clubbing at night one glow stick in this hand hold your phone in this hand the nfc reader actually starts lighting up your hand and you can blink you know hey to each their own personally i'm not into that but i don't i don't begrudge anybody for going out and partying on a friday night what can i say so when we talk about use cases this is what people expected these chips to be used for you know there's a an implant that if you drive like a tesla model 3 we can take the valet uh the valet option which is a subset of the original key that's used to actually start your car

you can write that to an implant chip so you can potentially walk in jump in your car don't have to worry about your keys and you can drive off no big deal we have fob replacements this is what most commercial grade implants are used for if you're a member of a gym maybe you have a garage shared type of services where you they give you some type of a puck you can actually put these down into an implant and actually go ahead go about your business that's kind of what they were originally invented for membership tokens like i said gyms you know maybe you're in an apartment complex and you have to be able to scan

into your in the front door these are normal use cases all the way up to and including contactless payments with the wallet more chip that was released in the uk we now have the ability to do tap to pay just like i said with it's the same technologies in any nfc based credit card android wallet or apple pay that's at home can't wait to get that one installed you know but unfortunately not all of us are friendly you know this introduces a new attack vector the human being you know when it comes to you know all of the people that have spoken before me today i agree with every single thing that they've said you know and even to cat's point you

know in threat modeling you know we're used to the normal attack vectors you know usb drives phishing emails spear phishing everybody's familiar with these but how do you deal with somebody that could potentially have an entire linux system inside their body doing unattended low energy bluetooth scans or metasploit auto pwn and the truth is you can't find us i can walk right through metal detectors i fly through international airports you will not find me the only way that you can detect on these is with frequency analyzers and you have to start actually looking for the frequencies of the individual chips and you have better have a wide enough a big enough feel energy field for me to

be able to be detected we're going to talk about that as we go along so this is a peg leg this is actually what i'm working on getting done next the only difference is i'm not actually using a raspberry pi zero w i'm working with a gentleman from the dallas hackers association who's a kicad designer and we're actually building a single board processing computer with multiple wi-fi for the sole purposes of implanting it in my my leg and as you can see we have a wireless power receiver on this and the reason being is because and this is the main problem with all implants currently on a commercial scale there is no internal power all of the chips that i have currently

implanted in my body they get their power from the receiver you know just like any nfc chip so this is both good and bad but when it comes to the peg leg what we've done is we've actually put an indirect power receiver on it with no battery so it's going to basically once it's implanted in my leg i take an external battery with rapid charging capabilities put it into my pocket it powers the device i can access that device through either ssh or https through the onboard applications i can stand next to you and do low energy bluetooth scans i can try and auto pone your anything that it can find i'm also looking at actually having

a slice down my leg and running copper wire between my thigh almost all the way to my ankle to act as an antenna so yeah i'm a little bit out there you know when it comes to the peg legs and you know this was a grass grassroots movement and there is no idea how many of these things are out there i know for a fact that i i know two guys that actually have done this particular implant but the issue comes into the encapsulation because this is a raspberry pi zero w they're using two part epoxy to try and do their bio encapsulation and as such it's not safe i know one guy who wound up with with

heavy metal poisoning because some of the the epoxy didn't seal correctly and some of the heavy metals on the circuit boards actually leached into his blood system had to have emergency removal surgery so that's why i'm actually working in conjunction with dangerousthings.com out of seattle and they're the ones that are doing my bio encapsulation on mine but the fact that there's at least one individual out there that has these types of devices embedded within their body should be more than enough to actually cause you know cisos and security admins to at least stop and take notice wrong button so let's get into the fun stuff we're gonna i told everybody that i'm gonna actually demonstrate three

separate attacks today utilizing the implants in my hands so the first one we're going to show isn't an attack that i've lovingly named handshake uh this is a physical access attack this uh would be around your access control inventory your keyless entries on your your physical locations so when i talk about cloning cards this is not something new the ability to clone a an access badge has been around for over 15 years the difference between what i'm doing and what has been done before me is the fact that before if you get caught in a restricted location there is going to always be some type of card a prox mark you're going to have something on you that you could use as

an indication of compromise when i write these down to my implants i can leave my programmer out in the car and if i get caught you can call the police on me i don't care you know they can search me they can go through my pockets there's no other card there's no electronic devices and from a blue team or a digital forensics and incident response perspective you're going to play hell trying to figure out how the hell i got in there so with that can i queue up video number one please and i'm going to go through this in real time with you guys so we're going to start off i'm going to open up my proxmart chameleon mini

software yes that's my real id and yes i look like every hacker clip art that you've ever seen in your life and the first thing we're going to notice is i grab a new uid for a tag so i'm going to go ahead and just make sure that we know what's what i'm going to name this lens id so we're going to go lens id now i'm going to go ahead and let's get a baseline so let's scan the the implant in my hand so we go ahead we click the button we receive a new uid we're going to name this one implant and if anybody wants to see this kind of thing hit me up after i've actually got

my programmer in the other room so at this point just to keep everything straight we're going to name this implant so as you if you noticed the only thing that was different was sector zero line a so at this point if i'm part of any type of hackers collective i can load this stuff up into google drive and i can share your data anywhere but that's not necessarily what i want to do so right out of the box i'm using a tool called the myfair classic tool i'm going to import those two dump files and then we're going to run a diff command against them you know keep in mind that if i'm part of a larger hacking group

i can share these with you know other people and now multiple people have access to your physical locations so we import both of those and we're going to go ahead and run a diff we're going to select the implant as the first option and my id is the second and you'll see that everything is identical except for sector 0 line a so anybody want to guess what we're going to do next we're going to write the card it's not that hard select all the sectors i can even do this through my cell phone write this back down onto the implant it finds the new tag select all sectors write the tag and at this point now just to prove it

once everything is written we're going to go ahead and we're going to remap there you go created the key map now i'm going to go back into my proxmart tool in this into channel 3 go ahead and scan my implant one more time we'll catch the uid and we're gonna name this one implant two and pay close attention you'll see that seven eight six eight nine i believe is the last four digits of sector zero line a six eight six nine now if we click implant two six eight six nine so at this point i now have an exact duplicate of the physical card written down to an implant on my hand you know one of the things that you know to kat's

point from her previous discussion we talk a lot about multi-factor authentication you know and the idea of mfa against any type of sensitive data this is something that's been beaten into our heads for for years why don't we do the same thing when it comes to physical access how many times do you see just a badge reader with no pin next to it if you have a single point of failure into your data center somebody like myself can actually compromise your data center sit there in your server room and you have no idea how the hell i got in there and the worst you can do is actually just happy trespassed off your property because technically if i tell you you

know the door was open you know i just walked in i thought this was part of the tour you know i can play stupid and it's not up to me it's up to the security on your physical access as to whether or not they want to try and go deeper they call the police go ahead i've been arrested before what are you going to arrest me for you know it was an open door i'm sorry you can't take me to jail you can't take me in and question me all you can do is tell me you don't come back on our property how do you know i haven't already dropped something in your server room

you don't so the next two use cases we're going to be discussing are around near field communication uh typical uses if you people aren't familiar with nfc pretty much built into every cell phone out there heavily used in iot and loosely connected devices we're going to show two different attacks today first one is going to be called leprosy and then the second one's going to be called flash hook so if we talk about leprosy this is kind of a social engineering attack but if anybody's actually hung out with me for more than five minutes you know i'm a pretty personable guy you know it's not hard so i'm actually going to talk this attack through for you guys in real time

this requires a little bit of social engineering this will also give me permanent persistence on the device because what i've done is i've actually created a malicious apk with mfs venom which is the utility to create callbacks for metasploit so i'm here in the cayman islands beautiful place love this place this place is awesome you know we've got b-sides going on if i was sitting out there in between sessions and you know started making a big fuss about you know something happening to one of my grandkids you know my phone was dead you know oh my god somebody help me i guarantee you that somebody would would actually give me their phone so let me show you what this looks like

in real life guys video two please so i'm gonna do this in real time you know what we have up on the top is my ngrok for obfuscation i like to explain everything bottom part of the screen we're actually going to be launching our metasploit loading it up with a resource file and starting a listener so let me do this in real time for you guys as soon as you see the phone here oh my god somebody help me out something happened to my grandkids you know i was on the phone with my wife my phone died thank you just thank you okay uh what is the what's the country code for the u.s it's plus one what's my wife's phone

number seven i mean who the hell actually remembers phone numbers anymore we all just go into our contacts so oh [ __ ] seven three seven three four yeah it's a seven three four area code because i'm from michigan what is the what is her phone number seven three four six six six one six two um you know all i know is that she said something happened to my granddaughter you know shoot man i'm gonna have to plug my phone in and go check it out i'm sorry i just can't remember give your phone back i've already popped the reverse shell on your device and here i can pop pull sysinfo i can dump your call logs i can dump all

of your sms i can even spawn a shell and actually navigate your entire file system it's not that hard you know how do you as security professionals protect against an attack vector if you don't know that it's even conceivably existing you know this is not star wars this is not star trek this is 2002 and we're real to that point you know the last attack vector we're going to show today is one called flesh hook anybody here familiar with the beef sweet i got one person i love beef beef is the browser extension exploit framework so i'm assuming we've all heard that old adage of be careful you know don't don't log into you know bad websites because

if you do the the bad guys can get into your computer just by getting to that website this is that website it basically utilizes java and within the the header of the web page and actually puts a hook into your device this one all right let's be honest how many people in here are iphone people androids yay android people we're all screwed to my iphone friends out there you guys are okay for a little bit longer apple has a proprietary nfc chip that is currently being challenged in the courts in europe right now if they lose you're going to be just as vulnerable as the rest of us android people and the only difference is the fact that

androids will do native reads and writes of nfc on an iphone you actually have to gain access to nfc through an app but if they lose you guys are just as susceptible as we are and this particular attack is the only attack that i've got in my repertoire that i'm willing to show today that actually can be used against an iphone because all i'm doing is utilizing the nfc and chip in my hand to actually redirect them to an actual website that i own so details around this one it does require some social engineering and essentially like i said we're going to trigger the url from the implant and we're going to point them at one of my

servers video three please so again i'm very very honest and blunt in my demonstrations i want people to learn so you'll find that it actually takes longer for me to actually load up the beef suite than it does to actually compromise the device so in five four three two one yay here we go all right we're gonna go ahead and we're gonna open up firefox and log into the beef control panel go in as an admin if you've never used this this is an amazing tool and because i deal with mostly technical people what i've done is i've actually cloned the putty website and all i have to do is get the phone into my hands hey man check this out you know

i got a youtube video i want to send you you know let me pull it up for you meantime all i'm what i'm doing is i'm triggering you to go into my website hand you your phone back it looks like putty but if you take a look now i've got a new online device from the icons you can see that it's an android from the main page i can get pretty much most of the information about that device in terms of what type but now i actually have the ability to run predefined modules so let's let's have some fun let's do some geolocation so i can actually identify where you are in the world just by you logging into a website

and if we take a look here we'll see that it'll show that i'm in the united states in texas in the city of flugerville which is where i was when i created this video if you're connected to a network i can do complete ip enumeration and i can ride your into your vpn right back into your your corporate environment i can even do spear phishing attacks on the device itself we're going to go ahead and launch a ping sweep here so this will start at whatever the subnet is and go from 0 to 255. and i can turn around and use that to the whatever i want and the whole point is all of this was

initiated from implants that are inside my hands so we are here we're not going anywhere and the truth is if you don't start taking a look at the fact that these are real attack vectors you might be putting your self as well as your corporate environments in a very vulnerable position when we talk about the trans-human movement what will we become tomorrow you know when we talk about the future of grinders and trans humans like myself it's almost like we're trying to write a brand new science fiction movie you know we have tesla with the neural ink and if you thought they were the only ones that were trying to do the brain implants they're not

their biggest competitor actually started human trials last week uh tesla actually released information that they had implanted the neurolink into 13 chimpanzees and seven of them unfortunately did not make it so before anybody asks would len len will you get a brain implant quite possibly but i'm not going to be the guinea pig for that one we have things like the will it if you haven't heard about it this this is actually a bluetooth transmitter and receiver that has no internal battery and actually takes its energy from the atmosphere beyond that when it comes to internal bio bio implants there's been major breakthroughs over the last two months that now we have the ability to power

implants with the body's internal thermal heat so as you if you remember when i was talking about the peg leg we had that indirect power charger because the truth is we can't have a battery inside of us yet at least from a commercial scale i mean we could but has anybody ever used like uh you know one of those rapid wireless chargers on your cell phones if you put that your phone on that pad and leave it there for about 45 minutes when you pick it up what does it feel like hot very hot so as such that is not something that i personally would like to feel inside my body to that point you know anyone that thinks that having

magnets in your hand is just a really cool thing still you know i i'm this everybody tells me i'm this rather you know intimidating looking gentleman i don't necessarily agree but you know what my biggest fear is mris is up there yes mris are definitely up there but honestly magnets you think you know pain imagine you know my brother is a love loves to be a prankster he actually put an earth magnet in my pocket one day imagine being pinched from the inside and the outside of your skin it is not a pleasant feeling you know so yeah finally you know we can talk about things like the neura grain this one to me is the we have definitely left the

reservation and we're going out into uncharted waters the neuro grain is an implantable wi-fi transmitter and receiver and the mission statement of this company is to basically turn the human population into the world's largest wi-fi mesh network you want to talk about hacking your neighbor's wi-fi being a completely new terminology and this is what we're looking at you know we've seen massive improvements in graphene battery technology over the last five to six months you know we also have the ability like i said to generate energy from the body's thermal heat we have all of this technology and the only thing that's stopping the the transhuman movement is internal reliable power well it's common so if you're the security admin at your

facility or you're the you know the ciso how do you deal with the fact that human beings are now putting these types of things in their bodies you know one of the questions i love to ask is is does the fact that somebody has an implanted technology automatically make them a threat anyone if somebody was to say get an implant of an rfid or an nfc chip and they're using it for the purposes like i said on the standard use cases you know maybe they're using it to access a garage or a gym does that automatically make them more of a threat from a ciso or a corporate environment's perspective than your standard joe average

you know my concern being a transhuman is the fact that you know people don't understand this i mean i've had people ask me for starters you know just to give you all some a little you know ha ha you know some of the questions i've been asked are absolutely hysterical you know len is that what happened after you got your coveted vaccination yes if if you want to ask me that question then the answer is yes you know is that the same chip that's inside my cat or my dog sure if that's what you think go ahead you know to be honest i've even caught the the the attention of some extreme religious groups i've actually i

this is no joke i actually didn't even know they did this but i actually found an article that was written quote you know utilizing some of the data that was put out there in some of the interviews that i've done and i've actually been basically labeled as having the mark of the beast i'm not trying to be disrespectful to anybody's faith or or their their philosophies i'm really not you know i can freely tell you i am not a demon well if you ask my wife she might say differently but no i'm not i'm not anything like that i'm just a guy who decided that i love technology to the point where i wanted to be able to trigger

things and do things that most normal people couldn't but my fear is that as people like myself become more and more open about this you know there are there are tens of thousands of modified human beings out there in the world right now and the truth is most people don't say anything due to the stigma that is associated with implanted technologies i don't care you know if you want to say that i have the mark of the beast go ahead i don't care if you want to say that i'm a freak again i don't care whether i'm a freak or not is irrelevant to the fact that i i have the ability to do these types of things and if you are

the security professionals within your organizations you need to learn how to adapt to deal with me because don't quote me on this next part because i'm still trying to get the actual correct term but back in the day before the tsa in america was the ones that handled the airplane security i worked for a company that did similar i did that job of tsa before tsa and yes i know that that kind of carbon dates me a little bit but the magnetometers in airports are looking for a specific amount of metal that's why sometimes you can get away with wearing a necklace but you can't wear your belt the total amount of metal that is within

my implants is below that threshold you will not detect me i've been through the standard magnetometers i've been through the x-rays you can't catch me the fact that i'm working on low frequency and high frequency rfid and nfc which means that you would need to have some type of a spectrum analyzer broadcasting on those exact frequencies of the chips that i have in order to be able to detect me and the idea of putting one of those in front of every single one of your doors and your entry points on your physical locations is not manageable so that being said how do we address people like me i i can't say it enough it's security

and layers you know as far as your mobile devices you know identity security multi-factor any of your accounts to the point where if i get in it's not going to i'm not going to be able to lateral and escalate with those when it comes to our physical on-prem locations you know how many people here use multi-factor authentication to access sensitive data on their networks okay pretty much common sense we've all been doing this forever how many of those you know and if you don't want to answer this next question i understand how many people have a server room with a single badge in with nothing else and we hear the crickets go you know this is the issue

these are the types of attacks that are going to be coming forward uh i haven't the next iteration of this talk is actually coming out in september if you find this stuff interesting keep an eye on me because i've actually figured out how to drop ransomware through my implants and i can deploy crypto miners with my implants on top of the fact that i'm bringing three new implants on just to see what i can do with them but it's all about security in layers ladies and gentlemen and anything in between you know let's take advantage of the fact that now you know now i've made you aware what you do with it up to the after this

is up to you but there are people like me and i can tell you for fact that i know a couple of guys that work on red teams in the united states that have these same type of capabilities and they use them during red team engagements as your initial foothold you know as more and more people are doing more corporate type activities from their mobile and loosely connected devices most of the time we'll see a vpn or some type of a secured transport layer back to their their company if i get into your mobile device i can ride that all the way in and get an initial foothold within your on-prem and from there i can actually launch

advanced persistence attacks lateral movements privilege escalations hell i can even try and go for a complete domain takeover and throw a golden ticket at you but the only way to stop this is to to get in front of it now we layer that security remove single points of failure look into locking down anything on your mobile devices and for god's sakes if you're using not using nfc on your mobile device turn it off i mean that's honestly the smartest advice i can give you people you know it comes up a lot with iot if you're not using nfc turn it off keep your updates on your phone make sure you get all your security patches for physical access

look into uh shields look into pin codes do not allow a single point of failure and with that i'm going to go ahead and usually i have a lot of questions so let's go so i'm gonna push back a little on one of your statements go forward

oh hi uh so i'm going to one push back and and a question people are walking around with cochlear implants with rods and rods in their brains with the electricity to prevent practice you're talking about the artist yeah i've seen parkinson's and and you know and other augment all other things to augment with normal normal human function i i think the what you're describing is just things that people aren't use used to that they don't see like an obvious obvious thing that they can see with their with their eyes correct per se so i i don't think that people are are seeing they augment itself as something strange or new is just what devices that is in somebody

the idea i i think i see where you're coming from and the truth is you know like i said i know two guys that actually have peg legs so they have full linux distros in their legs and multiple people i know in the red team world use the the nfc implants as their initial footholds on to get into a larger environment and the point behind what i'm trying to just to present to you guys today is not the idea that i'm not giving you anything that hasn't been done before i'm just giving you something that's been done before in a different way you know because if we take a look at you know what the way things used to be

the ability to clone id cards and badges like i said has been around for almost 15 years but up until this point you if you got caught and this is the big thing about these attacks is the lack of indications of compromise so for your digital forensics and your incident response teams this becomes a major issue you know because unlike before where you know i would have a badge that i've cloned or i would have some type of a device that i could use to emulate a card that i was able to scrape there's nothing you can strip search have the cops strip search me and there is nothing that they're gonna find but yet i was still in the middle of

your server room how do you how do you address that how do you follow up after that okay i hear you my one question has to do with uh secure encaps on like i said on phones or on devices that have nfcs and you know secure on case that have to do with certificates and so forth and things like that would the attacks that you describe work on on those devices that have those secure on cables depends on the settings of those devices i mean to be honest the secure enclave devices are good but you have the ability to modify the the policy sets on them and you can white list things so the one thing about my chips is i have

the ability to modify the uid and i can change them from i mean some of these i can actually have appear as multiple different types of contactless technology so it's a matter of just continuing to flip the uids and the device identifiers until i find one that your device will read okay thank you absolutely good question got one in the back all right i get a lot i i'm the and for the record ladies and gentlemen i i do not believe that there is anything as a dumb question so go ahead and ask whatever's on your mind i know i'm i'm way out there in left field man no i was just wondering are you in the uh the dangerous things

discord i am you are okay yeah so i also am i'm i'm uh the one developing the keyless entry system for toyota and lexus all right now on the way to go dude yeah i've got the s i id or whatever it's called in the left hand yup so here's another part of my clue you know don't that he's trying to do you know work for actual access does that make him dangerous but at the same time how do you differentiate between a gentleman like him and somebody like me you know my hopes are to at least educate you guys on the existence of these type of attack vectors and you know take this back and and do

something with it you know we have no way that we can actually stop single points of failure talk to me the funny thing is i am doing something about it because just a couple months ago i started working on a new talk on the human threat threat model and when i met you today i'm going holy crap he's i'm living proof yeah you're kind of where i came from this was reading about various different implants and what they could do and i took it to that level was how do we mitigate against that and that's going to be a talk i'm bringing out i'd love to work with you on it because the truth is you know there are

many people out there like me and you know as security professionals we need to be able to account and and mitigate these new vectors i mean we all know not to click on links in emails we know not to just plug random usb devices in but you know these are the same types of technologies that can be launched through bioengineering implants what's the impact sorry so i didn't catch that i apologize um what's the um health impact having these implants um so far i have had zero rejection so i did have a little bit of an issue uh these are to put in the bio glass encapsulated chips it's not that hard they come pre

most of the time they come pre-sterilized in like a hypodermic needle that's a little bit larger that you know that would normally be used for like body piercing but the flex membrane implants these are actual surgeries so they they cut me open they use dermal elevators they separate the skin from the muscle tissue below they create a pocket they insert the the microchip and then it gets sewed shut and i'm surprised nobody's asked me the question about doctors that's usually one of the first ones to come out no len does not go to a doctor len does not trust doctors however len has no problems with trusting a large polynesian gentleman with facial tattoos named pineapple

but the only health concerns that i've ever had was anyone that's ever had any type of you know medical surgery you know they tell you to get on you know anti-inflammatories prior to your your surgery i was the smart ass and did not do that so when i had the large one implanted here i developed a bit of a hematoma under here went to the doctors and was like you know hey i just need some prescription grade advil so i can get the swelling to go down they were like we need to schedule a surgery and get that out of you it's like dude i just spent 350 bucks putting that in you're not taking it out

sir all right uh i think there are two problems with what you have what you have going on there first one is that as you uh begin to implant those things especially since they're running uh operating systems they're not well i mean like with peg let's say and you run a linux on a on a system in your body it would carry an ip address and it would become hackable itself um to that point there is no ip address because these are nfc and rfid however they are anyone would have the ability to write and close the chips um i actually have faraday gloves that i've made for myself so that i can attend functions like defcon black hat

you know and protect myself there is nothing that someone could do to any one of my implants that could cause physical harm to me but what they could do if you've been around long enough that you remember the old rewritable cd-rom days yeah i know there's a few of us that here that just laughed you know you could essentially close the tag and then i would not be able to rewrite it with anything new and i would need to basically have it removed and replaced in order to get something else there so that is something that is a concern of mine to the point where like i said i actually paid a seamstress to take a pair of

racing gloves and line them with faraday fabric so that i can turn my hands off because they are as i said these are nfc and rfid they have no internal power right and and speak into that um a lot of the technology now that depends on uh power that you don't have to have a battery for is based on inductance so like that bluetooth chip is like you move your hand through the air it's basically metal moving through to its magnetic field it charges things along i'm sorry i'm having a i'm gonna i'm gonna walk over here and no disrespect i'm just having a hard time with understanding and i want to give you the

correct answer no what i'm saying is um [Laughter] you all can laugh at me i miss the day when in the united states they said okay we're switching to the metric system on tuesday and i just we never did so somebody who wants to do the conversion for me the large implant i can get about two and a half to three inches with right so what i was asking is a lot of the these chips or even the bluetooth you were showing uh in your presentation a lot of the power that it it it uses is based on metal moving through the magnetic field in the air the its magnet so it right so it is able to use small

amounts of energy through inductance magnetic inductance yes so essentially to stop your you from being uh we just have to run a massive magnetic field through the building and even faraday gloves yeah yeah fair you know yeah yeah electromagnets are not my friend so yes but no yeah but real let's be honest and realistic about it though the idea of trying to submit the human body to large magnetic fields is probably not a good idea i mean i'm not saying that this actually happened but i mean there was a big thing about you know the u.s embassy uh embassy in uh tell me out here in haiti you're not haiti but uh cuba cuba you know where everybody was getting

sick and they were like oh we think it's sonic or you know some type of sound type thing so i mean could it happen yeah but my whole point to you guys is just because somebody has one of these doesn't make them a threat you know and if we go forward with just the thinking that you know anybody with a microchip instantly becomes you know a potential cyber threat that to me is very discriminatory because there are i'm one of a very very few select people that have chosen to use the implants in this way you know i would rather just bring them out bring it out and say look guys these type of attacks can happen so let's

let's layer our security approach in front of this to take care of the potential bad actors and the threat actors but still allow you know tom and jane and to go ahead and use their implants to get into their gym and it's not a big deal so rather than focusing on the potential attacker i think as security professionals we need to look at our own security stacks and put enough controls in front of it that it becomes a non-issue but a very very good point is there anything any other questions out here today well if that's the case i'd like to thank you guys very much for attending my session uh if you have any questions

or anything please feel free i'm i'm really really active on social and uh they shut my presentation off already but i'm very active on social look me up on linkedin i've got a youtube channel and i do a lot with the transhuman movement so please feel free to reach out thank you cayman islands besides for giving me this opportunity and i hope you guys enjoy the rest of the conference thank you ladies and gentlemen for coming uh get a good night's rest we got it i'll do it all over again tomorrow

you