1
00:00:00,000 --> 00:00:09,560
Two years ago, I was sitting in the Paris hotel, the Thursday morning that DEFCON was to start, and my phone rang.

2
00:00:10,100 --> 00:00:15,460
And I was a little nervous to answer it because I kind of knew what the phone call was about.

3
00:00:15,940 --> 00:00:29,280
And it was my doctor calling me back to tell me that the biopsy that I had had on a lump in my breast the day before I left for DEFCON had come back positive and I had breast cancer.

4
00:00:30,280 --> 00:00:39,760
I share this with you because it's what actually ended up starting the research that I did that I'm going to share with you today.

5
00:00:41,460 --> 00:00:56,080
For those of you who have never been through chemo or don't know anyone who's gone through it, I think most people know that the losing your hair, the throwing up, pretty much everyone knows about that, but there's a lot of other side effects that come with chemotherapy.

6
00:00:56,080 --> 00:01:00,120
And one of them is called chemo-brain.

7
00:01:00,520 --> 00:01:09,220
And the regimen that I was on was ACT, which is adriamycin, cytoxan, and taxol.

8
00:01:09,220 --> 00:01:13,200
And another name for adriamycin is doxorubicin hydrochloride.

9
00:01:13,200 --> 00:01:20,960
And that's the one that essentially pretty much kind of tries to destroy the mitochondria in your brain.

10
00:01:20,960 --> 00:01:33,880
It affects their energy levels and it results in forgetfulness, memory lapses, difficulty concentrating or focusing on tasks, trouble with recall, remembering words or names.

11
00:01:34,180 --> 00:01:46,000
My team can testify to the fact that there have been many of a time in a conference where I've been like trying to put a sentence together and I cannot recall normal everyday words that most people know.

12
00:01:46,000 --> 00:01:48,100
I can't pull them out of my head.

13
00:01:48,240 --> 00:01:51,180
I'm getting better at it, but it still happens.

14
00:01:51,280 --> 00:01:55,240
And then also struggling to do more than one task at a time.

15
00:01:57,140 --> 00:02:03,480
As a hacker, our mind is our most valuable tool.

16
00:02:03,840 --> 00:02:15,300
So losing my hair, my eyebrows, my eyelashes, even losing both breasts was not as traumatic or devastating to me as starting to lose my mind.

17
00:02:15,460 --> 00:02:23,200
So when the chemo ended, I kind of was hoping that it would just kind of all go back to normal and it didn't.

18
00:02:23,240 --> 00:02:27,700
So I started to try to research how to heal my brain.

19
00:02:28,280 --> 00:02:36,360
And in the process of that, I stumbled upon some research being done at Stanford, and I believe it was SRI International, they were partnered.

20
00:02:36,760 --> 00:02:39,800
And they were talking a lot about using the mind for authentication.

21
00:02:40,000 --> 00:02:45,940
And I kept kind of putting that to the side, like I really want to look at that but let's get this fixed first.

22
00:02:46,160 --> 00:02:57,700
Once I felt a little better about my own cognitive faculties, I went back and started looking at this research because I was very fascinated by this concept and I wanted to know how far along they were with it.

23
00:02:57,780 --> 00:02:59,320
How does it actually work?

24
00:02:59,320 --> 00:03:02,600
I mean, like really, how do you implant a password?

25
00:03:02,720 --> 00:03:03,920
How do you do this?

26
00:03:04,060 --> 00:03:19,340
So today I'm going to share kind of what I taught myself and what I've learned and kind of some of the, like, hackability of it or kind of the, like, where they're at with it as far as actually being a viable option.

27
00:03:20,960 --> 00:03:21,520
But...

28
00:03:22,760 --> 00:03:25,660
So a little about myself before I start.

29
00:03:25,660 --> 00:03:29,100
I'm a security engineer and researcher with Digital Cloak.

30
00:03:29,180 --> 00:03:35,300
And my undergrad is in sociology, which is a psychology of group behavior as opposed to the individual.

31
00:03:35,900 --> 00:03:41,060
My minor was deviancy, which has served me well in this environment.

32
00:03:42,100 --> 00:03:46,360
My grad work and degrees are in security management and cyber security.

33
00:03:46,360 --> 00:03:53,200
So I kind of came into the security arena from the cyber area kind of late, but it can be done.

34
00:03:53,720 --> 00:04:01,680
The agenda for this talk is going to kind of cover some conceptual groundwork so you can kind of understand some of the research when I share it.

35
00:04:02,780 --> 00:04:05,360
I still can't feel the ends of my fingers either.

36
00:04:06,080 --> 00:04:07,640
It's neuropathy.

37
00:04:09,380 --> 00:04:17,300
So last time I spoke at DEF CON I was actually fortunate enough to have one of the researchers I cited that attended my talk.

38
00:04:17,300 --> 00:04:30,580
So if any of the researchers I mention in my talk actually happen to be sitting here, like jump up and wave your arms so we can say hi and maybe have you come up and maybe tell us about your research better than I can maybe.

39
00:04:33,000 --> 00:04:35,240
So cognitive memory.

40
00:04:35,300 --> 00:04:44,980
This is cognition is the mental action or process of acquiring knowledge and understanding through thought, experience, or your senses or some combination of them.

41
00:04:44,980 --> 00:04:52,200
It's knowledge, attention, memory, judgment, evaluation, reasoning, problem solving, all of that.

42
00:04:52,200 --> 00:04:56,200
And it can be conscious or sub slash unconscious.

43
00:04:58,500 --> 00:05:06,180
It can be intuitive, which is the ability to acquire knowledge without understanding.

44
00:05:06,180 --> 00:05:13,980
So if you think of like instinct, or it can be conceptual, so based on ideas or concepts, like if you're in a classroom learning something.

45
00:05:16,850 --> 00:05:21,830
Consciousness can be defined from two different ways, biologically or philosophically.

46
00:05:21,830 --> 00:05:32,750
So your consciousness from a biological perspective refers to the idea of being like awake and aware of your surroundings and experiences in the people and things in your environment.

47
00:05:32,750 --> 00:05:37,590
And philosophically it can refer more to like having a soul or a sense of self.

48
00:05:37,590 --> 00:05:41,830
We're going to be focusing on the biologic consciousness here.

49
00:05:44,210 --> 00:05:51,830
Unconsciousness is when your ability to maintain an awareness of your environment or surrounding like stimulus is lost.

50
00:05:51,970 --> 00:05:57,330
And there's either a complete or near complete lack of responsiveness to your environment or any stimulus.

51
00:05:57,630 --> 00:06:03,370
There's a medical concept of being unconscious and a legal concept of being unconscious.

52
00:06:05,070 --> 00:06:18,710
So medically you can be unconscious kind of like from like a brain injury or perhaps like a drug induced unconsciousness that they'll do sometimes.

53
00:06:19,830 --> 00:06:32,510
But legally you can also be unconscious maybe if you're impaired from drugs or hypnosis or has anyone in here been like so tired that they just can't even anymore.

54
00:06:32,870 --> 00:06:39,710
You're awake and you're standing up and you're like able to function but your mind, you're just done.

55
00:06:39,890 --> 00:06:44,270
So that can kind of go into the area of like legally unconscious in a way.

56
00:06:44,470 --> 00:06:47,090
But I'm not a lawyer so don't try to use that in court.

57
00:06:49,490 --> 00:06:56,250
So Sigmund Freud in 1893 was the first to use the term subconscious.

58
00:06:56,890 --> 00:07:09,190
And what I thought was really interesting was when I was trying to figure out like where they really drew a line between subconscious and unconscious it turns out that Sigmund Freud actually used the terms interchangeably because in his native German it was kind of almost the same word.

59
00:07:09,450 --> 00:07:17,470
And now the argument seems to be more of a kind of a semantic grammatical thing than a definitive thing.

60
00:07:17,970 --> 00:07:30,590
In general unconsciousness typically tends to refer to a state of awareness from a medical perspective and subconscious tends to refer to an aspect of your psyche when discussing more of like a psychoanalytical environment.

61
00:07:31,250 --> 00:07:36,150
But if there's any shrinks in the audience who want to argue about it we can do that later.

62
00:07:36,350 --> 00:07:45,350
The best I can tell is it's more of a grammatical issue than a definitive one, but I am going to differentiate in them in this talk.

63
00:07:51,110 --> 00:07:57,150
So for now just think of subconscious as the part of your consciousness that is not currently in your focal awareness.

64
00:07:57,650 --> 00:08:00,710
And there was a psychologist named Edwin Locke who put it really well.

65
00:08:00,710 --> 00:08:04,790
I think he called it the alternative storehouse of knowledge and prior experience.

66
00:08:04,790 --> 00:08:07,650
And there's two main types of long-term human memory.

67
00:08:07,650 --> 00:08:11,030
We have explicit and implicit memory.

68
00:08:14,570 --> 00:08:18,310
That was my obligatory cat slide for DEF CON.

69
00:08:20,050 --> 00:08:23,050
Explicit memory is also known as declarative memory.

70
00:08:23,790 --> 00:08:29,070
It's conscious and there's two kinds, episodic and semantic.

71
00:08:30,950 --> 00:08:39,590
So episodic is more storing a personal experience like a kiss that really meant a lot to you or that you remember distinctly.

72
00:08:39,590 --> 00:08:45,030
And then semantic would be more like data about the kiss or a kiss.

73
00:08:49,280 --> 00:08:54,300
Implicit memory, is anyone here ride bikes or can you ride a bike?

74
00:08:54,300 --> 00:08:56,440
So that's kind of a good example.

75
00:08:56,440 --> 00:09:07,260
I do triathlons and we train constantly to get things into our implicit memory so that when you're in the middle of a race, it's just your instinct, it kind of takes over.

76
00:09:07,940 --> 00:09:14,380
So it's basically acquired and used unconsciously and it can affect your thoughts and behaviors.

77
00:09:14,680 --> 00:09:21,080
And this is kind of where when we get to talking about implanting, this is where they're putting the password.

78
00:09:21,300 --> 00:09:28,620
One of the most common forms is procedural which helps people performing certain tasks without awareness of actually performing it.

79
00:09:28,620 --> 00:09:35,740
People use explicit memory throughout the day like remembering an appointment or recalling an event from years ago.

80
00:09:37,180 --> 00:09:42,020
And implicit is more like an unintentional subconscious form.

81
00:09:42,020 --> 00:09:47,360
So if you remember a specific driving lesson you had, that's an example of explicit memory.

82
00:09:47,360 --> 00:09:53,760
But if your driving skill improves as a result of that lesson, that is more the implicit memory.

83
00:09:55,400 --> 00:09:58,440
Okay, memory is a tool versus memory is an object.

84
00:10:00,540 --> 00:10:03,000
They've put forth that you can use it kind of both ways.

85
00:10:03,000 --> 00:10:15,100
So memory is treated as an object when you're recalling or recognizing like an actual memory but then if you're talking about using it to serve as an authenticator this is more like where you would use it as a tool.

86
00:10:15,120 --> 00:10:16,760
And so why is this important?

87
00:10:16,760 --> 00:10:25,140
Because they're looking at this research as being considered potentially a subclass of behavioral biometric measurement.

88
00:10:26,640 --> 00:10:30,740
So this is where we're going to start to connect with the idea of implanting passwords as an option.

89
00:10:30,740 --> 00:10:33,860
So we're going to talk about encoding, storage, and retrieval.

90
00:10:35,300 --> 00:10:39,400
So with encoding, this is processing information into the memory.

91
00:10:39,520 --> 00:10:42,580
And there's several different ways of encoding information.

92
00:10:42,580 --> 00:10:45,800
There's structural encoding, which is how something looks.

93
00:10:45,920 --> 00:10:48,180
And an example would be if you had a word.

94
00:10:48,180 --> 00:10:48,860
Is it long?

95
00:10:48,860 --> 00:10:49,700
Is it short?

96
00:10:49,700 --> 00:10:51,700
Is it all uppercase or lowercases?

97
00:10:51,700 --> 00:10:52,620
Is it handwritten?

98
00:10:52,620 --> 00:10:53,720
Is it typed?

99
00:10:53,720 --> 00:10:56,580
Then mnemonic encoding is how something sounds.

100
00:10:56,580 --> 00:10:58,700
So like how does a certain word sound?

101
00:10:58,700 --> 00:11:01,600
And then semantic encoding focuses more on the meaning.

102
00:11:01,600 --> 00:11:05,760
And it requires a deeper level of processing than structural or mnemonic.

103
00:11:05,880 --> 00:11:09,780
And it usually results in a better memory because you're kind of creating an association.

104
00:11:11,320 --> 00:11:18,400
Storage is after the information enters your brain, it has to be stored or maintained or forgotten.

105
00:11:21,380 --> 00:11:26,020
So there's a three stage model that was proposed by Richard Atkinson and Richard Shiffrin.

106
00:11:26,020 --> 00:11:28,100
It's often used to describe this process.

107
00:11:28,100 --> 00:11:31,820
This is my attempt to make a representation of it.

108
00:11:32,240 --> 00:11:37,780
So essentially you have sensory memory, short term memory, and long term memory.

109
00:11:37,860 --> 00:11:42,040
Sensory memory stores the incoming sensory information in detail, but only for an instant.

110
00:11:42,040 --> 00:11:46,520
The capacity is very large but the information in it is unprocessed.

111
00:11:46,520 --> 00:11:49,040
Visual sensual memory is iconic memory.

112
00:11:49,040 --> 00:11:52,260
And auditory sensory memory is called echoic memory.

113
00:11:52,260 --> 00:12:02,360
So then you get to short term memory and some of the information in sensory memory can transfer into short term memory and that can hold information for about 20 seconds.

114
00:12:02,600 --> 00:12:07,080
And rehearsing is a way that you can kind of keep information in your short term memory longer.

115
00:12:07,320 --> 00:12:20,600
So an example is like if someone, like if you're parking your car and you're trying to remember like where did you park your car and you're walking to whatever and you're like P2, P2, P2, it's kind of like a way to kind of keep it in your mind and get it in there a little better.

116
00:12:20,600 --> 00:12:26,860
Short term memory has a limited capacity and it can store about seven pieces of information, give or take.

117
00:12:26,920 --> 00:12:34,420
And these pieces of information can be small, such as like individual numbers or letters, or larger like familiar strings of numbers or words.

118
00:12:34,420 --> 00:12:43,100
So like if you're trying to remember the word cat, you're not going to remember C-A-T, you're going to remember the word cat with the visual.

119
00:12:45,740 --> 00:12:50,780
So information can be kept in your working memory while you process or examine it.

120
00:12:50,780 --> 00:12:56,220
And then once you're done with it, it either is pretty much forgotten or it moves into your long term memory.

121
00:12:56,460 --> 00:13:04,060
Long term memory has an almost infinite capacity and the information usually stays there for the duration of a person's life.

122
00:13:04,060 --> 00:13:16,860
However, the big issue is it's there, but you're not always able to retrieve it, which is where the chemo kind of affected me was the data was in there, I was just not able to pull it out and that's what I was struggling with.

123
00:13:17,800 --> 00:13:21,800
So with retrieval, that's the process of getting the information out of your memory.

124
00:13:21,800 --> 00:13:27,140
And they have these retrieval cues and those are stimuli that can kind of help you remember.

125
00:13:27,620 --> 00:13:30,900
And they include associations, context, and mood.

126
00:13:33,260 --> 00:13:40,400
So context is you can try to remember an event by putting yourself in the same context you were when it happened.

127
00:13:40,480 --> 00:13:47,380
Such as if someone lost a paddle from last night and they're trying to remember where it is.

128
00:13:47,780 --> 00:13:49,600
Sorry, that was for my boss.

129
00:13:50,220 --> 00:13:57,620
They could kind of go back to where they remember they had it last and walk through if they can remember where they went next and see if they can find it.

130
00:13:57,620 --> 00:14:00,280
Or you can do the same with your car keys if you've ever lost them.

131
00:14:01,800 --> 00:14:05,500
Associations, this is our equal opportunity, gratuitous, sexy photos.

132
00:14:05,500 --> 00:14:08,460
I hope I hit most everyone in the audience.

133
00:14:09,900 --> 00:14:14,140
If not, I'm so sorry, but I only had so many slides and so much time.

134
00:14:14,560 --> 00:14:18,020
But the brain stores information as networks of associated concepts.

135
00:14:18,020 --> 00:14:23,760
So recalling a particular word can be easy if another related word is recalled first.

136
00:14:23,760 --> 00:14:40,700
So here's an example if I show you guys like these sunbathers on the beach and then I ask you to spell the word bear, you may be more likely to spell B-A-R-E instead of B-E-A-R because the picture kind of primed you and associated you to that particular spelling.

137
00:14:40,700 --> 00:14:42,060
And then there's mood.

138
00:14:42,060 --> 00:14:51,200
So if you're in the same mood you were during a particular event, you can have maybe an easier time recalling the event, like kind of a nostalgia type thing if you think about it.

139
00:14:52,940 --> 00:14:54,380
Here's our other cat.

140
00:14:54,960 --> 00:15:00,000
They told me I had to put so many cats in and so many sexy photos, so I tried to make sure I got them all.

141
00:15:00,940 --> 00:15:01,860
Next slide .

142
00:15:03,180 --> 00:15:09,440
Okay, the human brain has about a billion neurons in it and each neuron forms about a thousand connections.

143
00:15:10,240 --> 00:15:14,040
And this is about somewhere around a trillion connections I think.

144
00:15:14,060 --> 00:15:19,440
The challenge is if each neuron could only store a single memory, running out of space would be a huge problem.

145
00:15:19,520 --> 00:15:36,680
So you might only have maybe a few gigabytes of storage space, like about the same as an iPod or a USB flash drive, but because the neurons combine so that each one helps with many memories at a time, it exponentially increases your brain's memory storage capacity to something closer to about 2.5 petabytes.

146
00:15:36,680 --> 00:15:49,560
And the example, I think it was something like 300 million hours of television shows is about the capacity to store in there because of the way the neurons can connect.

147
00:15:52,640 --> 00:15:54,100
Time check?

148
00:15:54,280 --> 00:15:58,500
Alright, there are some limitations to memory.

149
00:15:58,640 --> 00:16:02,560
I think everyone in here has seen that gorilla basketball video.

150
00:16:02,900 --> 00:16:06,220
So that's like inattentional blindness or the illusion of attention.

151
00:16:06,220 --> 00:16:10,200
You focus so much on one thing, you completely miss other stuff going on.

152
00:16:11,200 --> 00:16:12,320
Sorry.

153
00:16:12,480 --> 00:16:14,100
There's false memories.

154
00:16:14,100 --> 00:16:19,740
There's the illusion of confidence, which interestingly enough, apparently that's the opposite of imposter syndrome.

155
00:16:19,740 --> 00:16:20,920
They have one.

156
00:16:22,240 --> 00:16:23,500
The illusion of cause.

157
00:16:23,500 --> 00:16:29,120
There's a tendency to make casual connections between related facts that maybe are not accurate.

158
00:16:33,410 --> 00:16:36,190
This is where I want to get into the research.

159
00:16:37,310 --> 00:16:41,770
One word, concept, vocabulary thing is called brain computer interface.

160
00:16:42,010 --> 00:16:48,810
So the initial motivation behind brain computer interfaces was to develop the communication devices for the severely disabled.

161
00:16:48,870 --> 00:16:57,230
Seeing as that I only have a limited time to speak, I won't go into the deep dive about how an individual can train their mu and beta brain waves to control a cursor.

162
00:16:57,230 --> 00:17:01,450
And there's some fascinating stuff around visual evoked potentials.

163
00:17:01,550 --> 00:17:06,650
But there's a plethora of research out there if you're super interested in that level of granularity.

164
00:17:07,070 --> 00:17:10,390
But I did want to point out there is some research by Dr.

165
00:17:10,390 --> 00:17:11,050
J.R.

166
00:17:11,050 --> 00:17:14,790
Wolpow and his research team as a starting point.

167
00:17:14,790 --> 00:17:15,910
And then Dr.

168
00:17:15,910 --> 00:17:19,050
Niels Birbaumer with the thought translation device.

169
00:17:19,050 --> 00:17:22,470
He's with the University of Tübingen in Germany.

170
00:17:22,470 --> 00:17:29,710
And he has created this device that allows users to compose phrases and sentences electronically just by thinking them.

171
00:17:29,710 --> 00:17:31,090
So he's neat.

172
00:17:31,090 --> 00:17:35,430
And you may also want to look at a paper out of Dartmouth College about the Neurophone.

173
00:17:35,490 --> 00:17:39,750
It's a brain mobile phone interface using a wireless EEG headset.

174
00:17:40,050 --> 00:17:46,150
And in their paper his team shares the details of a brain controlled address book dialing app they created.

175
00:17:46,310 --> 00:17:49,490
So the point is this is a super huge area of research.

176
00:17:49,490 --> 00:17:54,090
But I haven't heard a lot of it on kind of our side of the house as far as the security of these things.

177
00:17:54,170 --> 00:17:59,830
But I did want to share the four key pieces of research that I found to be the most interesting and with the most potential.

178
00:18:05,570 --> 00:18:07,050
First there's this...

179
00:18:07,050 --> 00:18:08,230
wait, go back.

180
00:18:11,160 --> 00:18:25,020
So first I'm going to murder this man's name, so I apologize ahead of time, but Hristo Bojanov at Stanford was working with some cognitive scientists at Northwestern University and they designed a game that looks similar to Guitar Hero.

181
00:18:25,260 --> 00:18:29,040
And this is called CISL, Serial Interception Sequence Learning.

182
00:18:29,460 --> 00:18:36,060
And it's an authentication procedure that they created this testing experiment around.

183
00:18:36,060 --> 00:18:39,960
And they used Mechanical Turk through Amazon to do their experiments.

184
00:18:40,560 --> 00:18:49,160
So I'm not sure how well that looks as far as like how you're able to look at your subject pool from an experimental perspective.

185
00:18:52,010 --> 00:18:52,990
I'm trying.

186
00:18:52,990 --> 00:18:54,570
I'm like all up on it.

187
00:18:54,710 --> 00:19:00,030
I do want to walk you through how it works, but I want to make sure I get it right, so I want to read it.

188
00:19:00,030 --> 00:19:06,350
The process of learning the password involves the use of a specially crafted computer game that resembles Guitar Hero.

189
00:19:06,350 --> 00:19:10,230
There are six buttons S, D, F, J, K, and L.

190
00:19:10,230 --> 00:19:15,770
And the user has to hit the corresponding key or note when the circle reaches the bottom fret.

191
00:19:15,770 --> 00:19:22,510
So during a typical training session of around 45 minutes, a user will make about 4,000 keystrokes.

192
00:19:22,510 --> 00:19:28,890
And around 80% of these keystrokes are being used to subconsciously teach you a 30 character password.

193
00:19:34,430 --> 00:19:42,870
Before running, the game creates a random sequence of 30 letters chosen from the S, D, F, J, K, and L with no repeating characters.

194
00:19:42,870 --> 00:19:45,930
This equates to around 38 bits of entropy.

195
00:19:47,010 --> 00:19:55,490
And the 30 character sequence is played back to the user three times in a row and then padded out with 18 random characters for a total of 108 items.

196
00:19:55,650 --> 00:20:01,770
The sequence is repeated five times, and then there's a short pause, and the entire process is repeated six more times.

197
00:20:01,770 --> 00:20:09,210
And by this point, the experimental results suggest that a 30 letter password is firmly implanted in your subconscious brain.

198
00:20:09,230 --> 00:20:18,050
The authentication requires that you play a round of the game, but this time your 30 letter sequence is interspersed with other random 30 letter sequences.

199
00:20:18,050 --> 00:20:22,090
To pass the authentication, you have to reliably perform your sequence.

200
00:20:22,290 --> 00:20:26,850
The research shows that even after two weeks, you're able to recall the sequence.

201
00:20:28,610 --> 00:20:30,990
The next one is past thoughts.

202
00:20:30,990 --> 00:20:33,970
So this is from Berkeley, 2013.

203
00:20:34,310 --> 00:20:37,050
This technique combines three factors.

204
00:20:37,050 --> 00:20:45,370
Something you know, which is a thought, something you are, your brain patterns, and then something you have, which is the EEG sensor for measuring the brain waves.

205
00:20:45,370 --> 00:20:49,890
To authenticate with a past thought, you think your secret key while using the sensor.

206
00:20:50,270 --> 00:21:01,250
The key can be just about anything, a song, a phrase, or a mental image, and the thought itself is never transmitted, just a mathematical representation of the electrical signals your brain makes while you think it.

207
00:21:04,140 --> 00:21:13,040
Now, if someone else were to figure out what you were thinking, they still couldn't impersonate your past thought in theory because every person thinks the same thing differently.

208
00:21:13,420 --> 00:21:22,620
So, you know, we could all think about the same song, but we're not all going to think about it exactly the same way as far as being registered electronically.

209
00:21:23,900 --> 00:21:25,140
Time check.

210
00:21:25,240 --> 00:21:27,080
Okay, so this is how they did this one.

211
00:21:27,080 --> 00:21:31,580
The following tasks were repeated five times in each session for each subject.

212
00:21:31,580 --> 00:21:36,920
They had a breathing task, so they had to close their eyes and focus on their breathing for 10 seconds.

213
00:21:36,920 --> 00:21:46,980
They had a simulated finger movement, so subjects imagined in their mind that they were moving their right index finger up and down in sync with their breathing without actually moving their finger.

214
00:21:47,060 --> 00:21:55,520
There was a sports task where they selected a repetitive motion from a sport of their choosing, and they imagined moving their body muscles to perform the motion.

215
00:21:55,740 --> 00:22:12,680
Then there was a song passage recitation task, an eye audio tone task, an object counting task, and then at the very end they had a past thought which they were asked to choose their own past thought like a password, but instead of choosing a sequence of letters or numbers,

216
00:22:12,680 --> 00:22:20,560
they thought of a thought, like a vision of their wedding, or their child being born, or the first time they got drunk, or what have you.

217
00:22:20,560 --> 00:22:26,440
And that they had to think about that for 10 seconds, and then everything together became their past thought.

218
00:22:30,890 --> 00:22:35,990
So this was some other interesting research that was done that kind of fed into the next one.

219
00:22:35,990 --> 00:22:40,410
It was on the feasibility of side-channel attacks with brainwave computer interfaces.

220
00:22:41,230 --> 00:22:48,390
I do have these papers cited at the end of my slide deck, so if you look them up on the torrent, they'll be there.

221
00:22:48,410 --> 00:22:58,890
But it studied the possibility of side-channel attacks using commercial EEG types of headsets to reveal users' personal information like their banks, ATMs, or PIN digits.

222
00:22:58,890 --> 00:23:06,970
Their approach was similar to a guilty knowledge test where items familiar to a user are assumed to evoke different responses as compared to items that are unfamiliar.

223
00:23:07,230 --> 00:23:20,170
So for example, when a person was shown images of many banks, the brain response to the image of their bank had more of an interaction or evoked a higher potential with the waves.

224
00:23:20,170 --> 00:23:27,270
The problem with their attack setup, it was intrusive and it could be easily detected by the user, but that brought us to PEEP.

225
00:23:28,230 --> 00:23:37,450
So PEEP built upon their research, and what they tried to do was create an actual keylogger-slash-malware.

226
00:23:37,490 --> 00:23:43,990
And this actually was on phys.org in June 29th, and I'll read from the article.

227
00:23:43,990 --> 00:23:44,730
It's a quote.

228
00:23:44,730 --> 00:24:00,150
Researchers at the University of Alabama at Birmingham suggested that brainwave sensing headsets, also known as EEG, need better security after a study reveals hackers could guess a user's passwords by monitoring their brainwaves.

229
00:24:00,170 --> 00:24:15,710
So in contrast to the research I mentioned on the previous slide, the folks at the University of Alabama wanted to test out a more surreptitious, less intrusive approach that only required passive monitoring of brain signals as the user's type pins or passwords.

230
00:24:15,730 --> 00:24:23,050
And so they called theirs PEEP, which is passively eavesdropping private input via brainwave signals.

231
00:24:23,050 --> 00:24:28,170
And this was University of Alabama and I think one gentleman from California Riverside.

232
00:24:29,890 --> 00:24:40,470
Now, they extensively referenced the research of the previous group with the side channel attacks, and they named their keylogger PEEP.

233
00:24:40,470 --> 00:24:51,150
And so according to their paper, as the use of these devices, which they're referring to the EEG gaming and entertainment devices, headsets, for any of you who game, it becomes mainstream.

234
00:24:51,150 --> 00:24:57,990
A user may enter passwords or private credentials to their computers or their mobile phones while they're wearing these devices.

235
00:24:58,190 --> 00:25:08,990
And so they were studying the potential of introducing a malicious app to capture those EEG signals and then process the signals to infer the sensitive keystrokes.

236
00:25:09,310 --> 00:25:18,090
So the gentleman and his team used one regular store-bought EEG headset that anyone could buy at or what have you.

237
00:25:18,090 --> 00:25:21,970
And then they also used a clinical grade headset in their experiment.

238
00:25:21,970 --> 00:25:28,230
And they were able to demonstrate how easy a malicious software program could passively eavesdrop on your brainwaves.

239
00:25:28,250 --> 00:25:34,290
So while typing your inputs, it could sense all of this.

240
00:25:34,330 --> 00:25:50,010
And I think he saw a quote from the article, in a real-world attack, a hacker could facilitate the training step required for the malicious program to be the most accurate by requesting that the user enter a predefined set of numbers in order to restart the game after pausing it to take a break,

241
00:25:50,010 --> 00:25:54,430
similar to the way a CAPTCHA is used to verify certain users are logging in.

242
00:25:54,430 --> 00:26:07,010
The research showed that after a user entered 200 characters, algorithms within the malicious software program could make educated guesses about new characters the user entered by monitoring the EEG data recorded.

243
00:26:07,070 --> 00:26:23,250
The algorithm they created was able to shorten the odds of a hacker guessing a four-digit numerical pin from 1 in 10,000 to 1 in 20, and increase the chance of guessing a six-letter password from about 1 in 500,000 to roughly 1 in 500.

244
00:26:31,760 --> 00:26:36,400
So... security posture versus a rubber hose type of cryptoanalysis.

245
00:26:36,400 --> 00:26:46,680
The challenge in testing their hypothesis is that as far as I know, especially at Stanford, there's no studies that actually allow you to beat people during an experiment.

246
00:26:47,700 --> 00:26:51,460
So I think in a way they were kind of sexifying their paper title.

247
00:26:51,460 --> 00:26:53,140
You know, no shade.

248
00:26:53,200 --> 00:27:12,720
But after a long discussion with a psychologist friend, my current opinion with CICEL, which is the guitar hero in past thoughts, is there seems to be some dependence on the consistency of the entry of the authentication, and by introducing an actual rubber hose type attack or some other similarly traumatic level of extraction,

249
00:27:12,720 --> 00:27:15,480
this could affect the brainwaves themselves.

250
00:27:15,480 --> 00:27:21,580
So the ability to perform the action or the entry in a manner consistent with the password was set up.

251
00:27:21,600 --> 00:27:28,000
It could affect that, thus rendering it, you know, even if you have it, it's not going to work because it's not matching the brainwaves.

252
00:27:28,000 --> 00:27:37,460
Because if you're relaxed when you're going through the implantation, but you're being beaten with a rubber hose, even if they get the string, it's going to be different.

253
00:27:38,420 --> 00:27:46,980
So starting with the CICEL or the guitar hero, they were able to test retrieval, but not under stress or trauma.

254
00:27:47,040 --> 00:27:56,260
And they were able to test basic coercion, trying to fool the system, and that went pretty well.

255
00:27:56,260 --> 00:28:10,180
The potential attacks against that one involved the use of remote authentication approach, whether or not the attacker is allowed multiple extraction attempts, if there's performance gaps, eavesdropping, none of this stuff's been tested, just the retrieval has been tested.

256
00:28:12,100 --> 00:28:21,460
With past thoughts, a hacker might be able to defeat the system by using a phishing scheme that would trick you into thinking your past thought, capturing the output, and maybe later playing it back.

257
00:28:22,460 --> 00:28:28,980
And it was pointed out by the research team that the approach being used by them and the side channel attacks

258
00:28:32,220 --> 00:28:34,000
my brain just went dead.

259
00:28:35,600 --> 00:28:51,860
The stuff is generated for implantation with a random generator so you could probably go after it from the source by going after the random generator that issues it versus the actual person who has it, if that makes sense.

260
00:28:56,800 --> 00:29:03,660
As to CICEL and past thoughts, they're still in a mostly theoretical stage as far as research and experimentation goes.

261
00:29:04,120 --> 00:29:19,780
I didn't really see anyone addressing how memory could be affected by such things as drug use or injury or even degradation, such as if you have an employee that's going through chemo and suddenly their brain is affected, would they even be able to use any of this?

262
00:29:19,780 --> 00:29:22,720
Would that affect the authentication pattern?

263
00:29:24,180 --> 00:29:30,980
I don't really see this being viable for use at large right now until some of those questions are answered.

264
00:29:34,280 --> 00:29:52,520
We're all here at DEF CON, so what happens if you have the password implanted while you're sober at work but then you've had a couple drinks and you need to finish a proposal, are you going to be able to authenticate or will being drunk or kind of drunk or even just slightly impaired affect that ability?

265
00:29:52,520 --> 00:29:55,540
And that was another thing I didn't see addressed.

266
00:29:56,300 --> 00:29:58,180
Cost was another big thing.

267
00:29:58,180 --> 00:30:03,440
It's all well and good to propose this, but what's the exact cost associated with implementing something like this?

268
00:30:03,440 --> 00:30:06,820
And would it be realistic to deploy?

269
00:30:07,020 --> 00:30:12,280
So with SISL, the training or encoding time was noted to be 45 minutes.

270
00:30:12,400 --> 00:30:16,480
And with PastThoughts, it was two 40-50 minute sessions.

271
00:30:16,480 --> 00:30:29,760
And so if you have a small organization, 5-10 people, that might be okay, but I'm trying to picture Lockheed Martin or something trying to do this with thousands of people trying to put each one of them through that.

272
00:30:30,700 --> 00:30:39,040
With SISL, there are certain people this probably would work best with, but factors such as mental capacity or psychological issues.

273
00:30:39,040 --> 00:30:45,860
My sister-in-law works with special needs adults who do stuff at the airport and have to go through security checkpoints.

274
00:30:45,860 --> 00:30:53,540
So especially with the Guitar Hero type of thing, would there be certain people that just wouldn't be able to authenticate this way?

275
00:30:53,540 --> 00:30:57,540
Just legitimately, from a handicap perspective, they can't do it.

276
00:30:57,540 --> 00:31:06,640
Even some of our wounded warriors who don't have hands to do this intricate type of authentication.

277
00:31:07,080 --> 00:31:12,780
And then things like Parkinson's seizures, what if the individual is blind and can't even see?

278
00:31:12,780 --> 00:31:18,660
I didn't really see any of this addressed as far as using it in a real world on a large scale.

279
00:31:19,720 --> 00:31:25,200
All in all, I think it's fascinating with potential, but the research is still in a pretty early stage.

280
00:31:25,920 --> 00:31:38,920
The sample groups also, if anyone here grad school, scientific research, test groups, so the CISIL-CISE experiment number one was done with 35 participants.

281
00:31:39,520 --> 00:31:52,780
Number two had two groups, 32 and 80 participants, for a total of 147, but they didn't clarify if any of those were duplicates from the first to second experiment, so it actually might have been a smaller group number.

282
00:31:54,020 --> 00:32:01,000
Based on my own experience, I'm not sure 147 represents a solid sample, other than whether or not it warrants further study.

283
00:32:01,000 --> 00:32:05,360
I do think it warrants further study, but so far it's still very theoretical.

284
00:32:05,360 --> 00:32:12,120
The past thoughts material I read was based on research on a group of a total of 15 subjects.

285
00:32:12,460 --> 00:32:20,620
The side channel attack research had 28 subjects, and the PEEP research had a whopping 12 subjects.

286
00:32:20,640 --> 00:32:36,540
So again, this is still really kind of in very theoretical stage, and a pool of 12 subjects to me is not a huge sample size from a research perspective, except for maybe to do further research.

287
00:32:36,840 --> 00:32:50,000
My thoughts around hackability, CISIL refers to the rubber hose, I just really don't see that, I don't see how they really addressed it, I think they just used the word because it sounded cool.

288
00:32:51,420 --> 00:32:58,120
The theory that the knowledge is not consciously accessible to the individual, I'm still not sure on that.

289
00:32:58,580 --> 00:33:04,880
I have a psychologist friend, and he's in agreement with me, like, if you can put it in, you can take it out.

290
00:33:05,560 --> 00:33:07,860
And there's ways to do that.

291
00:33:09,660 --> 00:33:17,100
For CISIL, a good potential attack factor might be again, like I said, the random number generator, or the random password generator.

292
00:33:17,160 --> 00:33:30,100
And in their paper, the past thought team pointed out they were not vulnerable to shoulder surfing because their system was invisible, but they felt they were very vulnerable to both social engineering and dictionary attacks as their system stood.

293
00:33:30,100 --> 00:33:41,340
However, it was their hope that with advances in signal recording and processing technology, it would allow for a much more detailed capture of the thought itself, and that would protect better against some of the dictionary attacks.

294
00:33:41,340 --> 00:33:52,480
And they also felt they were fairly vulnerable to phishing attacks, where if you could get someone to click on something and record their thoughts while they were clicking, they were kind of vulnerable from that perspective.

295
00:33:53,500 --> 00:34:04,380
CISIL's not designed to prevent eavesdropping or shoulder surfing attacks, so I imagine a good video recording of them performing the sequence could allow an attacker to replicate it.

296
00:34:04,380 --> 00:34:11,300
And considering how many security video cameras are insecure, this is definitely a distinct possibility.

297
00:34:11,300 --> 00:34:25,420
And I believe they did say that in some of the experiments, the error ratio was just enough that if someone knew that person's sequence, there were times they were able to impersonate it.

298
00:34:27,340 --> 00:34:33,820
I talked to my psychologist friend about using hypnosis to potentially extract it.

299
00:34:34,380 --> 00:34:39,100
That I've done a little more research into, and I'm not sure that's really a viable vector.

300
00:34:39,480 --> 00:34:44,740
But he and I are actually still discussing that at length, so maybe I'll have more on that in the future.

301
00:34:44,740 --> 00:34:47,680
Another thing, CISIL's a flash application.

302
00:34:48,500 --> 00:34:51,140
So I'll just put that right there.

303
00:34:53,820 --> 00:34:56,720
That was my first big like, okay.

304
00:34:57,460 --> 00:35:14,100
And CISIL's authentication process is potentially vulnerable to attack if even an untrained person is able to mimic or degrade their performance to match the person they've watched authenticate.

305
00:35:16,860 --> 00:35:23,620
And then the authentication based on keystroke dynamics is similar to authentication based on the past thoughts.

306
00:35:24,880 --> 00:35:30,620
So it looks at their typing rhythm and what they're thinking at the same time.

307
00:35:32,260 --> 00:35:36,300
So I think they just still need to do more research.

308
00:35:36,480 --> 00:35:52,900
So in closing, I think much of this is still in the experimental stage, and it's going to be really interesting to see if anything actually comes of it, especially considering trying to deploy it across a large environment or organization, or a very varied population,

309
00:35:52,900 --> 00:35:55,340
like a bigger sample size than 12.

310
00:35:57,040 --> 00:35:58,260
Check my time.

311
00:35:59,840 --> 00:36:02,340
Some of my research, I have the papers.

312
00:36:02,340 --> 00:36:05,700
There are links to them, but you don't have to click them.

313
00:36:06,040 --> 00:36:09,260
You can just Google the name of the paper in Google Scholar.

314
00:36:09,260 --> 00:36:10,680
It'll come right up.

315
00:36:12,440 --> 00:36:22,520
And then the last thing I wanted to leave you with is it was kind of interesting, about halfway through my research someone mentioned to me, oh my god, have you read this?

316
00:36:22,520 --> 00:36:27,180
It's a book called Hard Boiled Wonderland and the End of the World.

317
00:36:27,180 --> 00:36:31,220
And it was written by Haruki Murakami.

318
00:36:31,300 --> 00:36:34,900
And it's actually from 1985.

319
00:36:36,640 --> 00:36:43,980
And what I thought was really interesting is I'm not going to spoil it if you want to read it, but it's a parallel narrative type setup.

320
00:36:44,140 --> 00:36:47,520
One of the narrators is called a calcutech.

321
00:36:47,520 --> 00:36:55,220
And it's a human data processor encryption system who's been trained to use their subconscious as an encryption key.

322
00:36:55,780 --> 00:37:00,940
And the other narrator is a newcomer to a strange isolated town.

323
00:37:00,940 --> 00:37:02,920
And I'll leave it there so I don't spoil it.

324
00:37:02,920 --> 00:37:15,980
But if you find this interesting, I actually thought it was pretty fascinating that back in 1985, even fantasy authors were thinking about the idea of using the mind to authenticate and for encryption.

325
00:37:16,460 --> 00:37:18,920
So that's all I have.

326
00:37:19,640 --> 00:37:22,720
I can do questions now if anyone has them.