 Hello, Defconn. I'm actually going to break with tradition this time and start one minute early because I have so much shit to show you guys that I'm worried about how much I can fit in here. I have not counted, but I'm reasonably confident in saying that there are more explosions in this presentation than any other Defconn presentation in history. Which is crazy because it's like nearly a quarter century of Defconn. Can you believe it? That's totally blowing my mind. A lot of projects are not solo, but this one is very much not solo. I called in like so many favors in working on this project. So a lot of friends went above and beyond to help me out. So this is their old school ANSI splash screen. Hacker, thanks. I think the only person who made it to come this year is RF. So hopefully he's awake and watching. So I was inspired to do this by a talk at Defconn 19 by Bruce who just spoken here and Devian and Shane about they were running some kind of data center that had very valuable stuff on, you know, on the hard disk in that data center and they were sort of kicking around some ideas like, you know, it could really be a target for some criminals to come and steal everything. So could you have a switch that you could flip to destroy physically all of the disks in your data center? And I thought this was pretty cool and I really wanted to kind of do a follow up and do some experimentation of my own. And then four years later I thought about like, well, where are we now? We've actually had data centers be physically rated and have all their stuff stolen, tour mails, the multiple silk roads. And Snowden taught us that we don't really know how much we can trust crypto because our end points are so insecure. Your crypto is only as secure as the keys. So think about it. Do you know, does the NSA, when they get rid of encrypted drives, they just throw the drives away? No, of course they don't. They destroy them completely. So here are the goals. Flip a switch, drives are gone, no bits left standing. Protect your data center against highly motivated criminal organizations such as the three letter government agencies. And then, of course, the big one produced a lot of destruction prawn for the DEF CON audience, for all of you here. So that means more thermite, more high explosives and more voltage. So these are the rules that Bruce and Shane and Deviant came up with. And I'm going to mostly try and follow them. You have a 1U server with your equipment in it. You have 1U above and below for whatever you want. I personally, when I was doing this, tried to keep all the actual destructor equipment in 1U so that the other two U could be used for protection, hot gas extraction and so on. 60 seconds to completion. I really want to make a joke about Bruce and Deviant and Shane here, but I won't. Don't set off the fire systems. Don't set off the seismic sensors in the nearby banks. I don't really care about that, so don't worry about that. Contain the damage within the equipment and protect any nearby humans. A quick word on hard disk technology. Data centers still use a lot of spinning platters. These tend to be made out of aluminum and now more frequently glass, and glass smashes easily. So most of this stuff is with aluminum. Almost everything I do here will also work on glass. The coating is really interesting of hard disks. They have under layers of a cobalt-nickel-ion alloy. The magnetic alloy actually is cobalt chromium with platinum, and these layers tend to be separated by four atom layers of ruthenium. So very chemically unreactive actually, the surfaces of hard disks. And now of course, not so much in data centers, but we're starting to see solid state drives, so I wanted to do a little bit of stuff with them too. Here are the results from DEF CON 19. They did three categories, and they split it up between the three of them. So Deviant worked on incendiary, and their results were they had some regulatory issues with possible deployment, because they were working with tannerite, which is used for making explosive targets. And legally, to set off tannerite, you have to shoot it. And they did some melting of the aluminum platter hard disks using propane and matte gas. And what they discovered was the drive is an excellent heat sink. It's a big chunk of cast aluminum. The platters themselves off an aluminum, so they suck up heat like crazy, they're hard to melt. They did some chemical injection, and it was basically a total fail. They injected various corrosives, and the hard disks are quite chemically unreactive. And then the most fun they had was with physical tools. They used a lot of woodworking tools such as hole saw, spade bit, and grinding disk, and they got things hot and burned themselves a lot. You should definitely watch the talk. I was going to say that earlier. I don't want to say too much about the actual talk, just go online and watch it. It's very, very amusing. And then they did some electro-deplating of the platters, which worked great on the glass platters, completely failed on the aluminum ones. Just a word on how they destroyed drives industrially. When they decommissioned disks, they mostly degaussed them and then throw them into a threader. I was going to turn the sound down on that, but I forgot. Sorry. So when you're getting rid of drives, you want to predict your adversary. The TLA's are able to collect and exploit physically destroyed drives. I talked to a guy who did EOD work in Iraq, and he was under instructions from the NSA that if he found any hard disks that were not crushed and burnt, to send them in. They could get stuff off them. So if you want to nuke a drive from orbit, degauss it, crush and shred and burn. So here, since I'm in the 101 track, even though this is mostly original research, here is my 101 slide. So for anyone who's here actually for a 101 talk about how to destroy their own hard disks at home, you can leave satisfied after this slide. Open your drive, usually takes a Torx T8 bit, remove the platters, usually takes a Torx T6, rub it with a rare earth magnet to degauss it, crush, break, deform it by the method of your choice, then burn it, then separate the debris and don't dispose of it all in the same place. Separate it and throw it away. All right. So the rest of this talk, hopefully interesting to you, not necessarily useful. I, too, decided to use three different techniques with this. So thermal, kinetic and electric. So the goal of doing a thermal method with a drive is basically to exceed the curie point of the magnetic media. So for cobalt, that's 1115 degrees C. At that point, it becomes magnetically disorganized and theoretically nothing can be read from it again. Here's some things that I didn't do so that you can either try them or realize why I didn't do them. I really wanted to look at some flameless chemical reactions. I couldn't find any that got hot enough. Of course, you can make a kick-ass oven and bake a disk. That is not exciting to watch. You can inductively melt aluminum very easily. You can get a big, a big inductive furnace. It's nice. I've used them before. I would have liked, I guess, to drop a hard disk in one and watch it melt, but I didn't do it. So method number one, the good old plasma cutter. So it's starting off keeping things simple. I've used plasma cutters many times. I expected it to make much more of a mess with a hard disk, but as you can see, really nice. It completes in about 40 seconds and very, very easy to contain. You could build an array of plasma cutting heads that would match the disk. So it looks pretty good so far. Oh, this drive is powered up and spinning. I wanted to see if it would keep spinning and so just one insertion point would be enough to destroy the top platter. It'll start to leak out a little bit down the bottom to let you know that it's done. Very nice. This drive stayed hot for a long time. So this shot is after I repeatedly burned myself taking out the screws. And you can see that it has, you know, killed some of the top of that platter. Here's a close-up shot of it. So it spun for a little while but not for very long. It thermally seized up quickly and there was some damage to the top of that platter all the way around, but then it stopped and it just burned a big fat hole through there. And if you look at the lower platters, then the hole went through, but they're not damaged anywhere else. So you can't rely on the drive spinning for this method. You have to have multiple cutting head parts. So that's the fully disassembled thing. Didn't make a lot of a mess. Totally feasible, in my opinion. Next, I thought, well, you know, these guys use propane torches and nap gas and so on in the previous talk. What if we could just use the drive itself as the fuel? Like pump oxygen through the drive and start it off with a little magnesium or something and, you know, just see if the drive will consume itself. So here's oxygen injection. I drilled a little vent hole that you can see venting out there. Eventually I melt the oxygen hose and had to turn the oxygen off. So it didn't really go to completion. Here's a high speed shot with the FS-700. Is it going? No. So, you know, a little bit of a containment issue, but I feel like I could easily figure out an engineering solution to this with an extra 2U of insulation and air extraction. That's what it looked like before opening. And inside did make quite a mess. And, you know, this was, there it is after cleaning off the platter. And you can see the platter is like nicely melted on one side. And I feel like with some more engineering effort here and, you know, like just pumping a lot of oxygen through this narrow 1U space that I could make this consume the whole drive. So I'm going to call that potentially feasible. But I know what everyone's here to see. And it's the first thing anyone ever talks about when they talk about drive destruction, which is thermite. So what I really wanted to do here was create a slurry thermite that I could pump into the drive when you push the switch and it would just really fuck it up big time, right? So I experimented with doing some slurries. First of all, since this is 101, here's the thermite reaction. I know you all know this. Iron and aluminum swap their oxygen partners like they're at a swingers party. And it releases a lot of energy. You can get it up to about 2500 C. Three to one, iron oxide, aluminum by weight. If you use iron three oxide. So here I am stirring up a slurry. It looks really nice. You know, it's like very, very smooth and gooey and you could really easily inject it. So I thought this was great. But in retrospect, the bright silver color that you see there, right? Remember, it's like silver aluminum plus red iron oxide. I should have clued me into what was going to happen next when I tried this. So here I am trying to set off the slurry thermite with a blowtorch. And you can see this is eight times sped up, right? So it's really not reacting very pleasantly. It's not helping me out at all. And so what my theory is that the solvent is forming my cells with the oxide inside and the flake aluminum sticking on the outside. And it's just preventing them from reacting very well. And I try a bunch of different solvents, such as glycerin, petroleum naphtha, and kerosene. And you can see afterwards, if I run a magnet over it, that very small amounts of elemental iron are being produced, not very much at all. So the reaction is just not really happening here. Probably the oxide is just being blown out with the smoke. And when I flip over that, this top that I was burning it on, there's no damage to it at all. It really didn't get hot enough. So total fail. So next idea was, well, if you open a disc, there's quite a lot of space inside it. So if we were really paranoid running a data center, we could hide thermite inside our drives just for when we needed to use it. So I pulled off some unused pins from the disc bus connector to use as an igniter. And I found that you can fit about 15 grams of thermite inside a drive. And you can still, the heads don't need to move into that space. You can still read and write to the drive with that in there. So this kind of thing always makes me feel like some kind of sketchy drug dealer or assassin when I do this. But it really makes me laugh, because you know when you go through the airport and they make you turn on your electronics, totally worthless, right? There's plenty of room for destructive shit inside electronics that still function. So here is the shot with a pre-inserted thermite. Three, two, one. Not too bad, right? We can deal with this inside 1U. But we open it up and you can see that a lot of stuff has burned and there's stuff all over the platters. But a little closer examination here. We start to see the nice, shiny, nonstick, chemically unreactive platters coming through. And when it's completely washed off, actually like bugger all has happened to those platters. Total fail. So all right, I wasn't ready to give up yet. And I know that in military thermite grenades, they actually don't use straight thermite, they use what they call thermate, which is 70% thermite and 30% barium nitrate. And what the nitrate does is produce extra gas to move everything around and spread it around. And it also burns hotter. So here's 15 grams of thermate. Much more violent as you can see. And here is a high-speed shot of that just to titillate everyone. The top of this drive, by the way, is screwed on really hard. But that doesn't matter for the thermite. It's happy to pop it open a little bit and spray out like crazy. Actually producing much more sparks and debris and so on than the plasma cutter. But you know, we could still probably deal with this if it works. This just goes and goes and goes. Don't remember the frame rate this was shot at. Probably 240 or 480. Anyway, that happens for a long time. So carefully opening it up with a glove this time. Actually did pretty good. Yeah, that's quite impressive compared to straight up thermite. I guess there's a reason why the military uses this formula. So I was I was high hopes. I was happy taking a closer look at the plato. There's all kinds of crud all over it. And you know, molten iron has been spread about the place. And then when we clean it off, though, you know, we see some good things. There's some some iron that's like attached itself, welded itself to the reed head. We got some, you know, pretty pretty good heat defamation of the plato there. And we've welded the platoes together over here. But ultimately, most of that plato is probably still recoverable by electron microscopy techniques and stuff like that. So once again, fail. Well, there are other types of thermite. For example, copper thermite. So exactly the same thing happens. It's copper oxide and aluminum. The oxide switches over four to four 4.4 to one copper oxide to aluminum by weight. It's a very aggressive thermite. So let's see what happens when we stick as much as we can of that. Oh, first of all, so I thought wow, that's stuff rules like that really surprised me how fast it went. So like maybe the slurry will work with this stuff. So made up a made up one of one of the best slurries. And um, we talked the shit out of it. And it's, you know, it burns a lot better than the iron thermite slurry. But still, the reaction is very much retarded by the glorification agent. Anyway, so let's stick some in a drive, not slurry version and see what happens. You know, we can work on the drive delivery mechanism some other way maybe. This is another high speed shot. So keep watching because right once again, the lid of this drive is really screwed down tight and you'll see the lid exiting stage right. But keep watching because you will also see the drive eventually coming from somewhere airborne. So this experiment coded most of my old sled lips workshop in copper. So everything in there now is going to have excellent conductivity. So that's the inside of the top plate. You could really make some nice art with this technique. So I'd like someone to tell Eddie the Yeti to really go and kick things up a notch over in the vendor area. And that's what the drive itself looks like. And you can see it's really, really got everywhere as you would expect from that shot. And looking closely at the platter, you can see that it's stuck a lot of things to the platter and you can see elemental copper has pulled it all around the drive. Looks pretty nice. So let's wash it off and see how things really look. Boo to you copper thermite. Some of it stuck right like it definitely made a bit of a mess. But ultimately, we have to say infeasible but fun. So right time to get serious here. And I thought well, the way that people really talk about thermiting drives is they get a whole bunch of thermite in a crucible above the drive and just try and melt straight through it. So I thought well, let's see if we can do this in one you. So I built a ceramic mold that would fit in one you if I'd made a little more carefully 250 grams of straight up iron thermite. So what I did was, you know, use a piece of styrofoam to fill the interstitial space in that ceramic material made it matched exactly to the drive so I could clamp it on and there it is the hollowed out all that all that area filled with thermite. So let's let's see if that's enough. So so as you can see, my careful containment works perfect perfectly. Incidentally, Miles Sledlip's workshop has a large area rug on the floor. This shot sent us set a significant portion of that rug on fire. So sorry, Miles. Well, you know, that that looks so impressive. Surely there can't be too much left of the drive that we just did that too. Once again, I'm now taking no chances with how hot things are after doing this stuff. So we can see plenty of elemental iron that's pulled into little little nodules and clumps on top of the drive and it's made its way through the top of the drive through that little hole there. And inside, it's certainly made a mass of the drive electronics. But we've got you know, I've already brushed that with my finger and I've seen that there's still plenty of nice clean platter in there. Look at that, you know, it looks looks almost good as new. So unreliable. So next time someone says, Oh yeah, like drive destruction, thermite, no problems. Just remember that they're a huge heat sink and you'll need a lot of thermite to do it properly. All right, moving on to part two kinetic. Goal here was to deform, spindle, mutilate the drive, basically severely retard any form of mechanical scanning to be done after the fact. And so obviously, as I said at the start, that would have to be used in conjunction with degaussing. Degaussing is not fun to watch. So I did not do that. So I had had a bunch of ideas that I didn't do all of them. One was to do a horizontal hydraulic crusher that would fit in one you and like just squeeze the drive to bits. I was pretty sure it would work. So I didn't bother doing it. I wanted to use some other high pressure cutting tools. But again, you know, that was just for fun because it's you know, to build a water jet cutter into your data system as you know, just probably a little bit infeasible. Instead, I wanted to start off with some like percussive methods. And one of my one of the tools that I've used a lot in my place is this concrete penetrating nail gun. So this uses a propellant charge basically a 22 caliber blank to drive nails into concrete. This happens so fast that at 480 FPS, you can't even really see the nail. It just is long gone through this, through this cinder block. Here's another shot with this. You have to hit it with a hammer, this particular tool to make it go, which is, you know, you have to do something a little different for actually doing on hard disks. But you can see there the plastic sub-bow that holds the nail in the barrel fly out and the nail kind of slightly can see it. So I milled the end off a drive so that we can see what happens while it's spinning and we hit it with the nail gun. Boom. No problem at all going through the cast aluminum bottom of the drive and all of, through all the platters, it actually cracks the cast aluminum drive part. There's a, there's a close up of it and you can see that it's, you know, you could build an array of these things that just punctured the disk in multiple places. So I think totally feasible. We also had around a pneumatic nail gun and I didn't have high hopes for the pneumatic nail gun because it didn't involve any form of chemical propellant or explosive. So I'm like, you know, how good is that going to be? But let's give it a shot anyway. I didn't even use a new drive for it, right? But it turns out it goes straight through the fucking drive. Really nice. And so it uses like a big flat, you know, pancake cylinder. So the one that's on this particular nail gun is big but you could quite easily build a low profile pneumatic cylinder that would fit in your extra 1U that you have according to these rules and just punch through the drive in a whole bunch of places. So quite nice. There's a close up showing that those nails just got all the way through and out the other side. Again, totally feasible. So thermite zero, nail guns two. But this is what we're really excited about, right? This is why we came here. There's no doubt that we can destroy drives with high explosives, alright? And we also get thermal factors as a bonus. We can do explosive welding. So the goals here really for me was, alright, let's see if we really could confine this explosion to the rack equipment. And I personally had been wanting for some time to experiment with some new techniques. A binary liquid explosive and 3D printing shape charges. And then another sub goal here was for me personally to pass go collect $200 and not go to jail for this. So let me introduce what I'm calling Felix. This is a commercial high explosive liquid binary. It is expensive. I did not want to pay for it. So I decided to clone it. So I'm not going to say its real name, but it rhymes with Felix and I'm calling it field expedient liquid explosive. It's very similar conceptually to tannerite and kind pack, which is ammonium nitrate and aluminum powder as a sensitizer. I reverse engineered it from the commercial product. It's based on nitromethane and used as a sensitizer, steric acid coated 5 to 50 micron aluminum. So that means these individual components are simply, simple to ship. They're just hazmat. They're not explosive until they're mixed. This is the stoichiometry. We actually, I still don't know the ideal ratios, but that's the reaction. So the nitromethane is the high explosive. It decomposes by itself. The aluminum acts as a sensitizer, but the aluminum then is consumed by the water produced by the nitromethane decomposition. So it adds energy to the mixture. So, all right, the legal thing, right? So I thought that with my friends who have a federal high explosives manufacturing license, that we'd be all sick because they have possession license, they have high explosive manufacturing. It turns out we found right before we were supposed to do this project that it's not just the feds who care about this shit and you have to get a state type two license as well. So we were like, oh, fuck, right? We're going to be able to do this in time. We just managed to get it done in time. So we were all legal and legit and we could do this stuff. The one thing, the big thing that we needed in the end was to have a range where we could do this because the state wants to inspect your manufacturing facility. And we said, well, you know, you understand what's going on here, right? This is these two things and wherever we mix them, that's the manufacturing facility. Too bad. They want to know where you're going to do it. So we ended up very, very luckily finding a local bomb squad that would let us use their range. So that was really nice. And as a result of all of this stuff, my friends and I are actually forming a consulting group. So a little plug here. If you want to ever do this kind of work, then talk to me because we can now do it. And even though it's kind of regulatory hell, being in prison. So the steric acid turns out to be a really important component of this explosive. And if you don't get that right amount right, it doesn't work. So this is a test shot using a pyro aluminum powder with its steric acid coated, but not that much steric acid. Here's a high-speed shot. And what you'll see there, the blasting cap just throws it around. That is a non- detonation, right? So that is a total fail. When you get the steric acid content approximately right, this is what it looks like. So I'm sure many of people here already know this, but you know this is 101. So let's talk a little bit about the Monroe effect. So that's what we, that's the name, the official name of the effect when we say a shape charge. What it means is you have a groove, often conically shaped, but it can be linear. For example, like a cutting charge in your high explosive. So when you put that with the groove facing the material you want to cut and you set it off, the cavity concentrates the shockwave and forms a kind of a jet. And you can actually line the cavity with copper or tantalum and form a liquid metal jet that will cut through whatever you're trying to cut through. Very, very useful technique. A lot of anti-tank warheads and all that kind of stuff use it. So here are a few like design tips for doing it. So what I was doing was I was laying out a cup to hold the Felix in open S CAD, plug for open S CAD. A few rules of thumb. Apex angle should be 40 to 90. The narrow the angle, the greater the penetration until your jet collapses and doesn't work. You want to standard off by about two to three and a half cone diameters and your explosive charge height should be a little bit more than the height of the cone. So first of all, what I thought was what about doing a linear shape charge in the shape of a ring and putting that on top of the drive and so you cut through the platters. So I designed this also to fit within 1U. So there it is viewed from the top, 3D printed and viewed from the bottom. So we can fit 60 grams of Felix in this little container and using a plastic cup there for the standoff. Don't concern yourself too much at this stage with the containment because I work on that later. This is shot at normal speed and then just slowed down. Here's another shot, same technique, same amount. You can see a bit of that drive exit stage, right? Here's the results. So not as impressive as I'd hoped, unfortunately. The first thing you'll notice is there's a lot of unconsumed aluminum. So that stoichiometric mix was not correct, that was over-aluminized. Turns out, you know, you don't need too much to sensitize the nitromethane. It stripped all of the platters off the spindle, which is pretty cool. And it has crushed the platters amongst themselves. So, you know, definitely it's done some damage. Definitely it would be difficult to exploit information for this drive. And there is one place where the shape charge has done its job and it's cut through, but that corresponds to where the cap was placed on that shot. So basically, we're doing the right thing with this charge, but we're having a problem capping it, which, because the charge is not propagating around the ring the way that we want it to. So I just thought about another idea. What about if we make our shape charges radial, coming out like that? So here's another open S-CAD model. And also, to try and stuff everything from flying around, we found a lot of aluminum around the place with those shots. I made a lid for it as well, with a little hole to feed some debt cord through. So there's a 3D printed charge, 100 grams of Felix this time. It's a bigger physical thing. You can see the debt cord that we're using to set it off all around the place, 18 inches of 80 gram debt cord. Where did it go? This particular camera, by the way, that's the close camera. It's inside an ammo box with a one inch acrylic window on it, but you can see it gets a good shake from the shockwave. This is from a GoPro 120 FPS and you can see bits of that drive go in all directions. Nothing very big. So we had to search a bit to find the pieces. This one is interesting because all of the surface mount components have been ripped off the board. Here's part of the platters. Some more of the platters and we've actually got some explosive welding happening here. That's actually the top plate and the platters have been welded together. So very nice. So that made us think like, well, let's try and do some compression welding. Let's actually just try and exploit that alone. So this is just a straight up debt cord shot, 100 green debt cord in that top one and then the double sided version doing some on each side. So to have the shockwave move from the outside in and compress everything together. So I'm going to show you the single shot later on because we did another interesting experiment with that at the same time but this is the double shot. That's how we set it up. So actually the drive is not in frame anymore but it didn't move very far. It was actually quite well balanced. Here's a slowed down shot. Is it playing? No. There we go. So you can just see it just hop actually only a couple of feet but it's a sloped piece of land there. So it just drops down to where you can't see it in that shot. There's the drive. That's still got the plates on it. So when we took that top plate off you can see it did not strip the driver. Oh, so this is the number one shot. This is the single debt cord so it's not the shot we just saw but it's the number one shot. It didn't strip the platters off the spindle like the Felix shots did but it did compress together them very very nicely and explosively weld them. You can't see because they welded together but you can see that the reed head is welded to the top platter. And this is the double shot. Didn't do nearly as much damage. I mean, okay so the single shot is two and a half times the double shot in terms of total explosive weight. So this is 40 percent of the charge of the single shot. It did deform the platters quite nicely. It made this like really cool groove in them but we can see here that they were not welded together in any way shape or form. This is a seagate drive by the way so it just goes to show anything you do to a seagate drive doesn't work. But we do know that the charge we use the charge that we use to that we need to use to compress the platters and weld them is between those two levels somewhere. So they taught us something. Moving on, the bomb squad said to us, oh by the way we have hundreds of these oil well perforators that we want to get rid of. Would you like a few? These are like downhole perforators so they drill the well and they stick a pipe down it and then when it's all done they put a pipe with these things on it to blow holes. They basically punch little holes through that pipe and through the concrete surrounding the pipe and let the oil in so they can suck it up. So they're designed to go through steel and a full or so of concrete and so to paraphrase ghostbusters if the bomb squad asks you if you want to be friends and share their stuff you say yes. These are set off with debt codes so they're full of like a very fast high explosive like maybe hmx and there's just a little bit of foil at the top so to let the shock wave through and then you can see here the classic shape charge. So you've got your conical cavity lined with copper and this particular one that i'm pointing to there has a standoff so that it's just everything is right for it to cut three things. So here's a shot we did with two perforators pointing up just to just to get rid of them at the end of the day actually but i want to draw your attention to a steel frame from that right so you could never get this shot if you tried like a thousand times at 30 frames per second right. These are the jets from the perforators that's the blasting cap the shock wave has gone through the debt cord set off the cheap charges and it hasn't had time yet to break through the just the plastic shell of that debt cord right this is a miracle steel frame so here's how we set it up um on on the edge of the drive to see how much we can cut through um here's a shot so be camera shot you can see a chunk of the drive go flying off top left there you can see how it just basically cut straight through the cast aluminum casing um here are the platters straight through um there's all the bits we could find some of it went in the water but wait a second down the bottom right what is that that is where the drive was sitting that's a hole through the quarter inch steel plate underneath the drive that's the exit hole on the other side that's the hole at dug in the ground and that's the piece of wire we used to measure the hole 15 inches after going through drive and steel plate yikes so we took the bomb squad was interested in that they brought the next time the smaller version of the oil well perforators uh once again a seagate drive you'll remember these one and a half terabyte seagates if you do anything with disk drives because this is when the agent tsunami happened and quality control went through the floor because all the facilities weren't working and so every single one of these seagate drives failed if you look at the statistics um so this time we're gonna do two perforators coming in at 90 degree angles see you see what kind of results we get there and this time lying the drive down this time we brought the FS 700 so we could shoot at 960 frames per second so you see a bunch of drive exiting to the top of the screen you get more of an impression of that um on this wide shot from the GoPro just so there out of the ballpark we actually didn't find enough pieces of that drive to really draw too many conclusions about it um we found this much and you can see that the drive case just very nicely quartered like that but we didn't find the platters so we had to do the shot again uh we we were we were all out of one and a half terabyte seagates uh so we used this one uh I'm not removing the label from this drive but I think I'm gonna avoid its warranty anyway um and this time we put the steel plate on top to just try and keep the fragments to where we could find them like the GoPro shot is nice of this one just a little graceful leisurely arc so there's uh there's what we found of that drive in terms of the case did it did also a really nice job going through to the center spindle and there are the platters so we cut through the platters but not through the spindle itself so I feel like we could probably tune these shape charges to go just through the hard disk and no further uh so I feel good about shape charges but there's one other charge I wanted to try uh which is the diamond charge the EOD folks use these a lot for cutting what you do is you create a flat high explosive and um you cap it at both sides and when you set it off uh the shock wave comes in from both sides meets in the middle and turns 90 degrees and you get a jet that comes out either side and cuts through whatever you want to cut through and what I wanted to use for this was this stuff it's uh data sheet it's pet and explosive sheet it's kind of like a high explosive fruit roll up and um I've used it before yeah all right uh we had some and I wanted to use this on the shoot but um it's difficult to transport you have to be placarded to transport this stuff based on the original packaging so no matter how much you actually have it's just what's written on the packaging so we had a small amount but the package said was a huge roll like a kitchen roll and so we couldn't move it we could get it but we couldn't transport it so instead I 3D printed again a container and filled it full of Felix and we capped it from both sides with that cord so here it is set up uh 60 grams of Felix and there it is good to go on the drive and this shot the diamond charge is underneath the big steel plate and we were also getting rid of again at the end of the day some surplus perforators under the uh uh big steel plate that's a half inch steel plate so um there's I think three of the small perforators under there that you'll need to know that for this video so that's the big plate coming down the the heavy plate is not in that shot but it is in this shot once again this was I think our last shot of the day so wait for it there's the there's the the what the quarter inch steel plate and there is the half inch one so it's a good thing we didn't need that anymore because it was gone uh but there's there's the uh drive it didn't actually do too much it just acted like a platter charge you can see the the edges of the diamond in it so it didn't cut it total failure um anyway it was interesting I'd like to try that again with the debt sheet because I know that works um so blast suppression all right we've had fun blowing things up but can we actually make this work inside equipment so we've got a couple to blast to the drive but we want to decouple it from our equipment that we're storing it again so we have the explosive against the drive and some kind of damping material between the explosive and the equipment shell what are we going to use to damp it with well we would be it'd be great if we could get some kind of nice substance that was an alternating compressible and incompressible matrix maybe like some kind of a liquid and gas foam be great if it was inexpensive and that we could actually inject it into the equipment when we wanted to so we don't have to have our equipment full of foam what where could we get such a wonderful like high-tech magic thing yes thank you Pyro so we learned this from the explosive engineering instructors they actually use this when they explosively punch out lock cylinders so they'll put a big big gulp cup full of this stuff over the explosive and just they'll punch out a cylinder and the shaving cream damps the noise and the frag so I said I'd return back to this shot the single 100 grain dashcode shot plus the shaving cream inside a box let's see how that did you can see the a camera there left of shot so all right you know this was a this was a shot in which the drive was really shredded and stuff definitely flies everywhere but let's take a look at some still frames from our two cameras on this shot that is the first detonation frame of the shaving cream shot with that with 100 grain deco this is the first frame without the shaving cream from a charge that was 40% the size of the left one right so the left one's two and a half times the explosive is the right here it is from the other camera so if nothing else we're definitely damping the the flame and heat pulse that's coming out of that that's really interesting to me so we tried this again with a kind of a simulator of a one-year rack so here's 75 grams of Felix it's the annular shape charge thing again this is our one-year rack simulator the steel plate with the angle pieces welded to it set up here coated in shaving cream and then with the other plate on top of it with a sandbag so we're just kind of getting an idea about you know stuffing stuff into one U and what's going to happen so I personally think that's pretty impressive here's the FS 700 shot like stuff goes flying but markedly different from all those other undamped shots that we did here is the steel plate and yep it made a dent in the steel plate that's where the drive was and that's the other side of the steel plate so it was dented but totally non-perforated here's the other one didn't fit quite so well we did actually unfold the angle iron and split it a little bit but you can also see the the drive imprinted on the plate there but there's the summary here after damping stuff the high explosives with enough engineering effort it just might fucking work so I have to have to go really fast now with electric there's not too many things in there the goal was you know we've got electricity already in the data center so let's do it and especially I wanted to look at SSDs so things I didn't do nasty gousing, boring to watch I didn't want to put you through that EMP, microwave, IRF attacks might have been fun to do I may do that later first thing I wanted to do was exploding bridge wire so here's our sketchy capacitor bank and spark gap trigger this is how we charged up with good old-fashioned vacuum tubes and I could not find anyone that had SSDs that were broken that they would give to me because they're just too new and I am sorry I love you all but I am too cheap to spend thousands of dollars on SSDs just to blow them up so I'm just using flash drives it's very similar it's just a you know the SSD looks the same inside it's just flash memory chips soldered onto the board so I think we can draw some conclusions here so here's what happens when you dump a lot of high voltage through a wire here's a high-speed shot of that happens very very quickly so first thing I wanted to do is just to physically couple that to a to a drive and see if we could just use the force of that explosion to destroy things high-speed shot so you can see in the high-speed shot that it didn't work right it didn't there's nothing happened to that chip although when we look at it closely afterwards the memory chip itself fared just fine but we did decap the microcontroller on the other side that's actually blasted the potting material off the chip but we cannot rely on this method so what about if we have our drives in our data center and we were hooked up to power and ground and we can deliver a large voltage spike when we want to through like a spark gap or something like that so I sold it onto power and ground with these flash drives here is the three two real time nice shot high-speed so we can see in the high-speed shot that we really did some damage there and there we can see that we blew the flash memory chip right off the board you can see all the internal leads from the chip we broke the chip in half and decapped it so nice lot of damage to that the one thing we don't really know is how recoverable flash memory chips are when that's happened to them whether you can use microscopy techniques to get stuff back but I'll say potentially feasible to destroy things quickly that way at least to make it difficult to do a recovery effort on for regular drives that's an inductive defamation of a soda can so you can wrap a coil around something metal and you can do a shot through it and destroy the hell out of it that's 2000 frames per second here's another shot of that obviously there is a big difference between a soda can and a hard disk this is at 100,000 frames per second so you can see that this squeezes down very very quickly this is the other side so basically the whole time I've been talking over this slide 10 milliseconds have not yet elapsed there so you can destroy things really quickly and it would be really great to destroy hard disks that way but the necessary power levels to do with hard disks are currently unknown maybe we'll do some real mad science later on so here's the summary the most feasible methods in each category the plasma cutter worked great in thermal oxygen injection I think could could be feasible but it may require complex injection kinetic the nail guns were great the anti-explosive was really fun possibly failing the seismic part of the rules oh well who cares electric high-voltage power spike was good but we don't really know the forensics resistance of SSDs number of eyes lost zero now just before the goon drags me off stage here I just want to say one more thing mobile solutions right we've been talking about data centers but when they picked up Ross Ulbricht the dread pirate robits they basically mugged him in a public library they grabbed him they dragged him away from his laptop and it was unlocked and they harvested everything that they needed to put him away for life for federal crimes so we can these days very easily with commonly available open source hardware develop systems that are proximity connected to our computers right so using bluetooth or whatever so I just want you to consider this talk to me about all your ideas for doing this later on and then maybe we will make another death pun talk about this stuff another time thank you