yarden chef here telling us about intel
cet and how to stop being scared of
french baking so we had some french
cooking now we're moving on to french
baking
thank you um yeah that is that was a
really good
order for the talks because french
baking is pretty different from french
cooking
um i'm going to talk about that and just
share my slides
so we're going to talk about two very
different things uh intel ct which is a
new security feature
on uh the recent uh intel processors
that are out for since the last few
months
and then we're going to talk about
french baking and
how to take something that seems really
complicated and
sound real and sounds really complicated
and make it
really really easy and creative and fun
and make people think like you put way
more effort into your baking than you
actually did
we'll start with intel ct
um first yeah who i am my name is joden
i'm a software engineer at crowdstrike
and i teach
windows internals classes mostly
together without
nesco and conferences and stuff
i used to be a pastry chef and now i'm a
hobbyist and pre-covered i also used to
be a circus artist and hopefully
will be again
um so we'll start with the security
related uh
topic which is intel ct that's a that's
a processor feature that
intel added into their newest
tiger lake processors which is meant
completely for security purposes
because there is a very common
uh relatively well well-known
exploitation technique called rock
return-oriented programming which is a
method to
um to hijack the execution of
application if you can of an application
of
process if you can't allocate and run
your own code in it
it basically uses existing instructions
in the process to create a
to create your own shell code without
allocating writing one um
there are a few different ways of doing
that rock is one of them
by overriding a return address because
when you when a call instruction happens
a return address is being pushed into a
stack
so if you as an attacker have control of
the stack through stack corruption
or anything similar to that you can
override the return address
and get the and when the function
returns it will
jump to whichever address you put there
which once you can control
you can use your stacker option to build
your own shell code
other ways are for example overriding
a function pointer in a function table
so
a call instruction will call the address
you put in there instead of the address
that's originally there um that's
something that's handled by
um through mostly through software with
cfg
or the newer xfg but uh
rop is something that cannot be handled
through software microsoft did try to do
that
it didn't really work so they
got rid of that was called rfg for a
while
but now we can have a hardware based
solution for that
um and because it's a hardware-based
solution it's not
as vulnerable to race conditions or to
other things that software-based
solutions
have the way it works
is it adds a second stack
there is the normal thread stack where
arguments go where return addresses go
the one that the thread uses when it
runs
but ct adds a second thing called a
shadow stack
that's a stack that the process or
thread itself is not supposed to be
using
and the only thing it has is return
addresses
whenever a call instruction happens the
return address
gets pushed into the normal thread stack
but it also gets pushed by the processor
into the shadow stack
and a shadow stack is protected memory
thread doesn't know where it is it's
not writable it's not modifiable
you can't tamper with it you can't um
corrupt it the same way you can corrupt
the normal stack
and then when the function returns it
reads the
ad it reads return address from normal
stack but the processor also reads the
return address from the shadow stack
and it comes and it compares them and if
it's not the same return address there
will be an exception
and the process could crash that depends
on the operating system
but generally ct can be used it does
implement a few other things not
only a shadow stack not only um rock
mitigation
it also allows for um
forward edge mitigations and a couple
other stuff but right now
operating systems don't implement that
the only thing that
the main thing that it's used for is as
mitigation to rock
and because i like diagrams um
we'll see here that what i'm going to
show now is a normal flow
we have a call instruction and the
return address is being pushed into both
stacks
it is the same return address uh now we
can imagine
the function running all sorts of things
happen
and then the function returns with a red
instruction now the red instruction
reads
the return address from both of the
stacks
compares them in this case they are both
the same
so we jump to the address and we keep
running
as expected what happens if
there's an exploit that corrupts the
stack is a call instruction happened
pushed both return addresses but while
the function is running
this exploit comes in and corrupts the
stack
this is a relatively simplified version
usually
you wouldn't just corrupt the return
address you usually
corrupt a lot more of the stack to for
example corrupt
multiple return addresses or control
variables or
have some more things but in this case
you just corrupt the return address
and now when the function returns if we
didn't have
cet it would just jump into the fake
return address
given our exploit code execution
by this case it reads both addresses
so they're not the same and it throws an
exception
now for an exception doesn't necessarily
mean that the process
is going to crash an exception is
just something the processor throws and
has absolutely no idea what's going to
happen to it
um and the operating system is supposed
to catch those exceptions and decide
what to do with them
system doesn't necessarily crash on
every exception there are a lot of
different types of exceptions
and you can even use for most exceptions
or for some of them you can even use a
try cat or try except depending on what
language you're writing in
to ignore your exceptions yourselves in
our case the operating system
needs to catch that exception and
what windows chooses to do is what it
does with a lot of different mitigation
it has uh several options
it can choose to crash the process
because
if we got a ct exception something bad
probably happened
on exploit overrode or step
we don't really know how to recover from
that
and that will crash the process but
that's a very
uh simplistic view of it um and for
anyone who's been in security for more
than a few years
i have had more than enough cases of
saying oh this is definitely what's
going to happen this is definitely a
malicious thing
we want to detect that always and then
you ship your product it runs on
exactly three customer machines and then
you get an angry phone call from a
customer saying
no our um our it has a script that does
exactly that
we we're injecting code into elsa on
purpose
we we wanted we want to do that why why
are you blocking our
powershell script so you can't really
crash every
process that has a ct violation um
because microsoft is a big believer
in backward compatibility and
there are a lot of things that actually
use rock as a
semi-legitimate technique some
security products use it as part of
their code injection
because code injection is messy even
some microsoft products have
built-in drop for all sorts of different
reasons so you can't just enable that
mitigation crash everything because it
will start crashing
a whole lot of things that use it as a
feature
and you don't actually want to start
crashing everything
so this has um
windows added um compilation flag like
like
it does with most mitigations uh this
compilation flag is slash ced compact
meaning ct compatible and
what it actually means is hey i am
building this application
knowing that it is compatible with ct i
know that my application
is not using drop as a feature there is
no reason
you will see this application dropping
anything
and if you do i want it to crash because
this is not supposed to happen so
something bad happened
so when you build your new applications
please do build them with
ct compat and
if you can't do that because your
application uses rock as a feature
i recommend to stop using that before
microsoft start enforcing this
in i don't know 10 years or so so we've
got some time
um so windows will for not only crash
applications running with built with ct
compact because otherwise you
can't really know but what it will do
is if your application is not built with
ct compact of course that all
only happens if you're running with a ct
compatible
processor and operating systems which
none of you probably do because it's
only been shipped like two months ago
um but if you're running with ct
compatible processor and operating
system
and your application
dropped but it is not built with ct
compat
windows won't completely ignore it but
it won't cross
it won't crash your process either
instead it's going to log that
into the windows event viewer
ah through an w event yeah this is what
it looks like for anyone not familiar
with the
windows event viewer it's very useful
for
um forensics for finding out what's
happening in the machine
what happened what could have caused a
crash
or security risk and
it has a few different channels uh ct
errors
uh errors and warnings um warnings
meaning the process did not crash errors
mean it did
so they're both logged into a
place called microsoft windows security
mitigations that has user mode in kernel
mode and ct goes into kernel mode
so in this case what we're seeing here
is an application
um some random application that was
running on my machine
that is not built as ct compatible
but did have a ct violation which is
um it would have been blocked from
setting context now that doesn't mean
it dropped it doesn't mean the return
addresses didn't match
i'll talk about what this warning means
in a minute but it would have been
blocked
but it didn't because it's not built as
ct compatible so we don't know that
is using the same assumptions we do
and obviously in this case it isn't
because this
was not an exploit this is just a
completely legitimate application
that does something that windows doesn't
currently agree with
second case is an application that
did um that was built with
ct compatibility part of vs code
and it has encountered a shadow stack
return address mismatch
and you can see here the process will be
terminated
so that's what happens if windows
decides that
no we really do want to crash this
application we're not okay with what's
happening here
we don't think this is a legitimate case
that's just like incompatible we really
do want to crash it
and this is a classic ct crash uh
because of a shadow stack
uh return address mismatch meaning the
address on the regular stack and the
address on the shadow stack are not the
same
but i want to go back to the previous
case for a second because here we don't
see
a return address mismatch we see would
have been blocked from
setting context because microsoft said
well if we have that shadow stack
and we have that capability there are a
lot of different
ways of hijacking the execution
of a process yes you can overwrite
function pointer which cfg handles
you can overwrite a return address which
is
you know the basic usage of ct but you
can also do things like
uh calling set thread context which lets
you
set the values for all the
for all the registers of a thread for
example
it's a stack pointer or it's instruction
pointer when you control those
you can control what the thread is going
to do you can tell it
what code it's going to run what part of
the stack it's going to call
another way is through exception
handling
because when an exception is thrown
inside of a process
it goes into a process exception handler
so
if you can control the address of the
exception handler and give it a fake one
while you control what the process is
running so
windows added a few more ct related
checks um for set thread context for
exception handling
um for uh unwinding
so i'm going to continue and it's a
it's a pretty complicated mechanism all
implemented inside the windows kernel
but if you have a ct compatible
processor if you're one of the
five lucky people who have a matching
computer yet
then you can open your event viewer you
can see all those warnings even if you
did not enable ct
for your um
for your applications all you need to do
is to set
ct to basic mode through the registry
and then you will get all those warnings
and you will see
uh what would have been blocked what
would have been terminated
what is acting funny and you'll see
quite a lot of
microsoft applications there because.net
is not yet supported
for ct um so for example powershell
is incompatible with ct visual studio a
whole lot of things for now
and you'll see some interesting things
things with event viewer
menu uses um pw so everything you see in
event view you can also get
through um etw events so if you have a
security product that wants to take
advantage of ct
you can register for the etw channels
get all the ct warnings and
try to decide for yourselves if it's uh
if it's just
an old incompatible application or if
it's
a malicious or if it's a piece of
malicious code trying to
take over a legitimate app
like the last thing i'm gonna say about
ct
is that uh all i've been talking about
for now is user mode ct
for user mode applications um because
that's what's been shipped
for now on windows there are plans for
kernel mode ct which will probably
be shipped sometime towards the end of
the year or early next year depending on
microsoft schedule
um but for now it's only
it's only relevant for user
modifications
um i can talk about cp for like another
two hours
uh alex messi and i wrote uh
i don't know 7 000 word paper on it
which only covers part of it
but i only have 20 minutes for this part
so we'll move on to the
non-infosec thing which i can talk way
more about
just cookies like i said i used to be a
pastry chef
i studied uh french patissoe for a while
i worked in it for a little bit
and then i decided to just make it into
a hobby and
as a hobby it's actually way more fun
because you get to experiment you get to
do
all sorts of fun things you get to
discover
what you can and can't do
and unlike french or
like french cooking or any kind of
cooking actually
um baking to me is a lot more of a
science
that doesn't mean that it's not creative
and fine experimental
but it is very much a science and i
actually love that because once you
learn the science you learn
what is set in stone and what you can
play with and change and in what ways
and you get to do all sorts of really
really really cool things
and this part i'll talk about one very
basic
um part of french sewing
use butter cookies those little round
butter flavored cookies that are always
covered in sugar
and made out of pretty much butter and
flour
they're very very very simple
they're easy to make every coffee shop
has them
and they're awesome and they're one of
my favorite things to make
and the reason they're one of my
favorite things to make is
as simple as they are you can do
a million different versions of them you
can make them into different flavors you
can add different things to them
but you can make them different colors
um with no food coloring
and when you have people coming over in
two
hours and you've got nothing at home and
you completely forgot to make something
but you still want to do something cool
you can use one
one mixer bowl make four different kinds
of butter cookies that all
look and taste completely different and
seem like you made a huge effort and
started making things two days in
advance like you're such a
cool baker when you use one dish in one
recipe
so there are two principles
to making butter cookies once you have
those two
you can do anything with them the first
one is the ratio
of ingredients the only two ingredients
that matter
in butter cookies are butter and flour
the sugar is only there for flavor
egg is helpful to keep things together a
little bit but it's not necessary
um salt cocoa
powder vanilla all of that is just for
flavor the only two
ingredients of matter are butter and
flour
and for butter cookies to work you need
to use a ratio of at least
one to two meaning the weight of butter
has to be at least 50 percent
the weight of flour um
if you're if you're going to use 100
grams of flour you should use at least
50 grams of butter
that's the bare minimum you can go as
high as one to one if you'd like
i like using two to three um
i mean for a hundred grams of flour i
would use
around 65-70 grams of butter
that's individual it also depends on
exactly what butter and what flour
you're using
which do change a bit between brands and
between countries
when they say butter i mean butter that
has at least 82 percent fat
a lot of the common butter you'll find
in supermarkets
is sort of fake butter it has 80
fat i've seen as low as 75 which
i don't think is even legally allowed to
be called butter in france
um so you should look at that the more
fat percentage do you have
the more buttery flavor you're gonna
have
and also you can keep to the original
ratio if your butter percentage goes
lower it will change things up a bit
but the cool thing is when you
understand that understand that butter
is simply 82 fat and around 80
liquid and a barrel
and an amount of a really really really
small amount of protein
and some other stuff you don't
necessarily have to use
butter you can replace it with other
things now for butter cookies to be
successful
you need fat that is um
that is not liquid you need
you need a kind of oil or fat
that is a solid in room temperature
so you can't use olive oil you can't use
canola oil because they're liquid
but if you don't want to use a dairy
for whatever reason like i'm jewish my
family is religious we can't have
dairy after um after meat
so when i need to make desserts for my
family i can't use butter
for meaty dinners so you can replace
that with things like
coconut oil coconut oil is solid in room
temperature
so you can replace the fat part of
butter with coconut oil and the liquid
with
water milk coconut milk
orange juice coffee your favorite
bourbon
anything elegant flour
is white wheat flour but you can
experiment and replace it with any other
kind of flour
like gluten-free flour if you're
if you don't eat gluten this is the only
thing that
matters you wanna put those two things
your
butter or different fat and flour into a
mixer food processor process them
together and get dough
it's not going to be especially tasty
though because it's not going to have
much of a flavor
you don't have sugar in it you don't
have anything else but it is going to be
dough
then usually to keep it together a
little bit better you want to add
a bit of either either fat or
liquid um it's going to be an egg yolk
um
a bit of milk a bit of water really tiny
amount
but that's all you need for the dough
now the second thing
is you don't want just any dough you
want that
unique texture that butter cookies have
and that texture is kind of crumbly it
crumbles everywhere it breaks when you
take a bite out of
it if you compare it for example with
bread bread doesn't do that bread is a
lot more
the dough is more elastic the dough of
bread is a lot more chewy
you don't want to have the same texture
as bread
in your butter cookies but they're both
pretty much made of you know similar
ingredients
so here the difference is how you
process
it because that plastic
chewy texture that we get in bread that
comes from gluten
and gluten
when when we talk about
gluten people think you know people
talk about um flour having gluten
that's true but that's not
really accurate flour has the potential
for gluten
what flour does have is two
um is two other proteins
called gliadin and glutenine
which when they meet in the presence of
water
they turn into gluten gluten is what
gives us this elastic
stretchy chewy texture which we love in
bread
but we don't love in butter cookies
and the the way to create gluten is to
take flour add water to it and just
process it
mix it knead it for as long as possible
to make sure those two proteins will
meet
will have the largest potential of
meeting and creating gluten and
creating sort of a net that traps
water and air inside the dough now
because we don't want diet butter
cookies what we want to do
is to process the dough as little as
possible
so the potential for creating gluten
will be
as low as possible of course it will
still create gluten
um because that just happens but we'll
have less of it than we have in bread so
you want to
give it as little time as possible
to create so we can have that crumbly
texture
now the other thing is that
one more way to prevent bloom from being
created
is with oil when you add oil into
the flour and water mixture
the fat wraps around the
wraps around those two proteins and
kind of it doesn't really stop them
from combine but it makes the frost a
lot slower
so when we add a whole lot of oil and
fat in the form of butter
into our flour then we'll we'll get less
glued
it also means if you're trying to make
bread and
you're making for example a brioche you
would want to add the butter
a lot later so you could first create
all your gluten
and then add butter so you don't prevent
it from being created
but in our case it's actually good
because we don't want a lot of gluten
in our dough
so that's part of what makes butter
cookies awesome by design
you need to work them really really
really little
you want to throw all your ingredients
into food processor
work it just until you get a something
that can barely pass as a ball of
add that little bit of oil or liquid
to to make it stick together
and then wrap it in nylon or
whatever and put it in the fridge um
or the freezer it doesn't matter too
much
but if you want to make it immediately
you'd want to wrap it and put it in the
fridge too for example um
roll it make all these shapes with your
cookie cutters which is awesome
um the industrial way to do that which
is
also the lazy person's way and my way is
to
make it into a roll wrap it in nylon
stick it in the freezer and then once
you want to bake it you take your frozen
roll of cookie dough you cut it into
cookie shapes and you bake it it's
really really really easy
you only get one shape this way a little
round um little circles um
if you're feeling creative you can try
to make your roll shaped like a square
or triangle
and then you get square triangle cookies
but that's about it you get one shape
but it's really easy
and really really really not messy
so that's for a science part you put
everything together right ratios
process it as little as possible and
stick it in the
fridge or freezer until you want to bake
it it's easy enough
but this way you only get one kind of
cookie and we didn't even talk about
sugar or anything that gives it gives it
natural flavor here's
the coolest thing because these
two principles are all you need to get
successful cookies
you can do pretty much anything to give
it flavor
you can add a little bit of sugar to get
those standard
light butter cookies
you can do anything else as long as you
know what kind of material you're using
if you're using something that is dry
and close to flour like cocoa powder or
um almond flour or hazelnut flour or
anything that is kind of
powdery all i need to do is replace a
little bit of the flour with it usually
10 to 15
if you put in cocoa powder replace 10 to
15
of the flour with cocoa powder and you
have chocolate cookies
if you want to add anything that is
liquid like coffee
or um mashed
strawberries fruit or counted as liquid
whatever you do with them they count as
liquid or
some kind of alcohol you want to add a
little bit of
whiskey to your cookies you want to add
some orange juice
that counts as liquid you add that
instead of
whatever liquid you're using if that's
milk or egg whites just replace it
if you want to add something that is fat
that is fat based like kind of
like some kind of nut butter um almond
butter or peanut butter or pistachio
butter
or um that's all
100 fat just replace a little bit of
your butter with that
and you'll get that flavor and you'll
also get that really nice color
one of the things i like to do to get
super colorful cookies
is makes is make some of them um
with pistachio butter that has like this
really nice
green to it or replacing the liquid
with um raspberry extract
not extra raspberry juice and then it
makes it pink
um you can add lemon zest or orange zest
or anything or vanilla extract
um you can replace the sugar with maple
syrup
because it's still sugar it counts as
sugar just replace with maple syrup and
you'll have like this maple
flavor to your cookies and you can also
add
um solid solid additions
like chocolate chips like chopped nuts
like
um raisins um
if you add those you just want to add
add those at the end
so they don't tear apart the dough just
add them at the end just mix them in
and they're there you don't need to
replace anything with them
now when you understand that talk about
the fact that they don't even have to be
sweet cookies
because butter and flour is very neutral
the the sugar doesn't
do anything other than flavor so we
don't have to make them sweet cookies
either
you can add pesto and make them pesto
flavored cookies
they come out green and gorgeous
you can add you can cook some
[Music]
or peppers or add tomato paste and make
it
red you can cook peppers and grind them
into a paste and add that
with some feta cheese or parmesan cheese
or any kind of cheese you like
you can add spices you can add cinnamon
or ginger um if you're making safer
cookies you can add paprika
which is really cool it also makes like
really red and awesome
you can do pretty much anything um a
personal tip
is you can use you can do
you can make as many different types of
cookies you want in the same bowl
you don't even have to wash it in
between uh my tip would be to start with
the
lighter colored and flavored cookies and
make that batch put in the fridge then
make the next one that's a little bit
darker or with stronger flavor than put
that in the fridge
because then you don't it doesn't get
mixed up in a way that
um mixes up the flavors like i'll start
with
simple vanilla cookies then i'll make um
coffee flavored cookies that'll make
chocolate flavored cookies because the
chocolate ones are the darkest so
if i have leftovers on the on the bowl
i don't want to get them mixed up into
the next batch
that way i make like the five different
types of cookies
in one go in one bowl
in 20 minutes and you can experiment you
can do whatever you want with them
here i really wanted to either have a
live demo but i'm not using my own house
so i don't have the materials in my
kitchen
and i'm a much better baker than a
photographer
so the pictures of my cookies are not as
pretty
as those random ones i found on google
search
so you'll have to just trust me
then you can also you know match it for
your dietary restrictions if you can't
have sugar you can
replace the sugar with whichever
substitute
you like best if you can't have dairy
like i said you don't have to use butter
coconut oil is magic
if you have if you can't eat gluten you
can use gluten-free flour
i'll just say that any kind of
pastry does need a little bit of gluten
to hold it together these cookies still
have gluten
so gluten-free flour will give a much
more um much more crumbly cookies that
won't hold together as well that's just
the
downside of using gluten-free flour um
there are ways to improve that but i'm
not really an expert on that so
i can't really say much other than that
um see i can keep talking about cookies
for like three more hours but i think
that's our time
so i'll open it up to questions from
anyone
yeah so you you have some time for
questions the first question we had
there's lots of clicky questions people
people were amazed and odd and a little
overwhelmed with cet but
they want to know how long cookie dough
stores in the fridge
oh in the fridge it stores up to three
days
and in the freezer up to three months
and you can also put it in the freezer
for as long as you want after three
months
um and as a disc or something and then
move it to the fridge for six to twelve
hours
and then you can roll it and do whatever
you want with it for example use it as
pie dough
perfect thank you um a bunch of people
want to know a little bit more about
making whiskey or bourbon cookies
because you brought them up and they're
really excited about them
can you give them a few tips on that yes
absolutely
if you're going to add alcohol to
cookies you really don't need much
if you use too much the alcohol might um
mess up the ratios a little bit
you want to add um if you're using let's
say 100
150 grams of flour you want to have
probably up to
two spoons of alcohol um
you want to use that instead of liquid
because alcohol is still mostly liquid
after you bake the cookies there won't
there shouldn't be any alcohol left in
them
because we do bake them in pretty high
temperatures um
around 170 degrees celsius i do not know
how much that is in fahrenheit
um and try using alcohol with
slightly um slightly stronger flavor
than you would drink normally alcohol
like
bourbons or whiskeys that are very
smooth
uh the flavor will probably get um
a lot lighter inside the cookie so you
do want to use
either a little bit more or a little bit
um
stronger flavor than you would drink
thank you so much and a personal tip uh
it works really it's a bit of
counterintuitive it works
great with coffee flavor
wow i never would have guessed uh
we have a cet question um it's kind of a
broad one so maybe you can take a crack
at it it's
how effective do you think it'll really
be at
dealing with recent past windows
exploits
um but my answer to that is going to be
a tiny little bit cynical
but it can be very effective if it's
enabled
but i don't really see it being
generally enabled
by default on windows builds anytime
soon
um first no one has a processor yet it's
it's newly shipped but also microsoft
has tendency to
not enable new mitigations for a long
long long time
and not enforce them you still see um
applications running out there without
stuff like aslr
which have been around for 12
15 years at this point um so i think it
will be a pretty long time until we see
an
actual effect there until people update
their system
people update their processors and
microsoft actually starts
enforcing the use of the use of that
that's certainly the very pragmatic
answer i think that's
all the questions we have i want to
thank you again for giving
two amazing talks in a short amount of
time
[Music]
thank you so much for having me um it's
super fun
an awesome conference and i'll i'll be
around slack on and off during the day
feel free to ask me questions on slack
or twitter or any other
medium where you can find me
perfect perfect thank you so much