start	end	text
0	4000	Two years ago, I was sitting in the Paris hotel,
4720	8020	the Thursday morning that DEFCON was to start,
8020	12140	and my phone rang. And I was a little nervous to answer it
12140	15460	because I kind of knew what the phone call was about.
15940	19280	And it was my doctor calling me back
19980	23680	to tell me that the biopsy that I had had on a lump in my breast
23680	27660	the day before I left for DEFCON had come back positive
27660	32220	and I had breast cancer. I share this with you
32220	35020	because it's what actually
35660	39760	ended up starting the research that I did that I'm going to share with you today.
41460	43700	For those of you who have never been
43700	47920	through chemo or don't know anyone who's gone through it, I think most people know
47920	51540	that the losing your hair, the throwing up,
51540	56080	pretty much everyone knows about that, but there's a lot of other side effects that come with chemotherapy.
56080	60120	And one of them is called chemo-brain.
60520	64080	And the regimen that I was on was
64080	68200	ACT, which is adriamycin, cytoxan, and
68200	72260	taxol. And another name for adriamycin is doxorubicin
72260	75620	hydrochloride. And that's the one that essentially
76480	80200	pretty much kind of tries to destroy the mitochondria
80200	84160	in your brain. It affects their energy levels and it results in
84160	87980	forgetfulness, memory lapses, difficulty concentrating
87980	92300	or focusing on tasks, trouble with recall, remembering words
92300	96200	or names. My team can testify to the fact
96200	100080	that there have been many of a time in a conference where I've been like trying
100080	104100	to put a sentence together and I cannot recall normal
104100	108100	everyday words that most people know. I can't pull them out of my head.
108240	111820	I'm getting better at it, but it still happens. And then also
111820	115240	struggling to do more than one task at a time.
117140	119560	As a hacker,
119560	123480	our mind is our most valuable tool.
123840	127600	So losing my hair, my eyebrows, my eyelashes,
127600	131600	even losing both breasts was not as traumatic
131600	135300	or devastating to me as starting to lose my mind.
135460	139740	So when the chemo ended, I kind of
139740	143200	was hoping that it would just kind of all go back to normal and it didn't.
143240	147700	So I started to try to research how to heal my brain.
148280	151740	And in the process of that, I stumbled upon some research
151740	156360	being done at Stanford, and I believe it was SRI International, they were partnered.
156760	159800	And they were talking a lot about using the mind for authentication.
160000	163860	And I kept kind of putting that to the side, like I really want to look at that
163860	167800	but let's get this fixed first. Once I felt a little better about
167800	171920	my own cognitive faculties, I went back and started looking at this research
171920	175700	because I was very fascinated by this concept and I wanted to know
175700	179740	how far along they were with it. How does it actually work? I mean, like
179740	183920	really, how do you implant a password? How do you do this?
184060	187620	So today I'm going to share kind of what I taught myself
187620	191720	and what I've learned and kind of some of the, like, hackability
191720	195720	of it or kind of the, like, where
195720	199340	they're at with it as far as actually being a viable option.
200960	201520	But...
202760	207720	So a little about myself before I start. I'm a security engineer and researcher with
207720	211800	Digital Cloak. And my undergrad is in sociology, which
211800	215300	is a psychology of group behavior as opposed to the individual.
215900	219780	My minor was deviancy, which has served me well
219780	223700	in this environment. My grad work and degrees
223700	227300	are in security management and cyber security. So I kind of came
227300	231520	into the security arena from the cyber area kind of late, but
231520	235640	it can be done. The agenda for this talk is going to kind of cover
235640	239680	some conceptual groundwork so you can kind of understand some of the research
239680	243820	when I share it. I still can't feel
243820	247640	the ends of my fingers either. It's neuropathy.
249380	251860	So last time I spoke at DEF CON I was
251860	256020	actually fortunate enough to have one of the researchers I cited that attended
256020	260100	my talk. So if any of the researchers I mention in my
260100	263980	talk actually happen to be sitting here, like jump up and wave your
263980	267720	arms so we can say hi and maybe have you come up and maybe
267720	270580	tell us about your research better than I can maybe.
273000	275980	So cognitive memory. This is
275980	280100	cognition is the mental action or process of acquiring knowledge
280100	284140	and understanding through thought, experience, or your senses or some combination
284140	288380	of them. It's knowledge, attention, memory, judgment,
288380	292200	evaluation, reasoning, problem solving, all of that.
292200	296200	And it can be conscious or sub slash unconscious.
298500	298900	It can be
301760	304180	intuitive, which is the ability to
304180	307860	acquire knowledge without understanding. So if you think of like instinct,
307860	311920	or it can be conceptual, so based on ideas or concepts, like if you're
311920	317690	in a classroom learning something. Consciousness can be
317690	321830	defined from two different ways, biologically or philosophically.
321830	325750	So your consciousness from a biological perspective refers to the idea
325750	329690	of being like awake and aware of your surroundings and experiences
329690	333590	in the people and things in your environment. And philosophically
333590	337590	it can refer more to like having a soul or a sense of self.
337590	341830	We're going to be focusing on the biologic consciousness here.
344210	345590	Unconsciousness is when
345590	349650	your ability to maintain an awareness of your environment or surrounding
349650	353750	like stimulus is lost. And there's either a complete or near
353750	357330	complete lack of responsiveness to your environment or any stimulus.
357630	361790	There's a medical concept of being unconscious and a legal concept
361790	363370	of being unconscious.
365070	367230	So medically you can be
367230	370430	unconscious kind of like from
371210	375590	like a brain injury or perhaps like a drug induced
375590	378710	unconsciousness that they'll do sometimes.
379830	383150	But legally you can also be unconscious maybe if you're impaired
383150	387610	from drugs or hypnosis or has anyone in here
387610	391410	been like so tired that they just can't
391410	394870	even anymore. You're awake and you're standing up and
395410	399710	you're like able to function but your mind, you're just done.
399890	403170	So that can kind of go into the area of like legally unconscious
403170	407090	in a way. But I'm not a lawyer so don't try to use that in court.
409490	411230	So Sigmund Freud in
411690	413910	1893 was the first to use the term
415450	419270	subconscious. And what I thought was really interesting was when I was trying to figure out
419270	423050	like where they really drew a line between subconscious and unconscious it turns out that
423050	427030	Sigmund Freud actually used the terms interchangeably because in his native German
427030	431270	it was kind of almost the same word. And now the argument seems
431270	435350	to be more of a kind of a semantic grammatical thing
435350	438830	than a definitive thing. In general
438830	443050	unconsciousness typically tends to refer to a state of awareness from a medical perspective
443050	446930	and subconscious tends to refer to an aspect of your psyche
446930	450590	when discussing more of like a psychoanalytical environment.
451250	454830	But if there's any shrinks in the audience who want to argue about it
454830	457950	we can do that later. The best I can tell is
459010	462930	it's more of a grammatical issue than a definitive one, but I am going to
462930	472030	differentiate in them in this talk. So for now
472030	475910	just think of subconscious as the part of your consciousness that is not currently in your
475910	479830	focal awareness. And there was a psychologist named Edwin Locke who
479830	484790	put it really well. I think he called it the alternative storehouse of knowledge and prior experience.
484790	487650	And there's two main types of long-term human memory.
487650	491030	We have explicit and implicit memory.
494570	498310	That was my obligatory cat slide for DEF CON.
500050	501490	Explicit memory is also known
501490	504950	as declarative memory. It's conscious
504950	509070	and there's two kinds, episodic and semantic.
510950	512950	So episodic is more
512950	516930	storing a personal experience like a kiss that really
516930	521030	meant a lot to you or that you remember distinctly. And then semantic would be more like
521030	525030	data about the kiss or a kiss.
529280	532460	Implicit memory, is anyone here ride bikes
532460	536440	or can you ride a bike? So that's kind of a good example.
536440	539580	I do triathlons and we train constantly
539580	543660	to get things into our implicit memory so that when you're
543660	547260	in the middle of a race, it's just your instinct, it kind of takes over.
547940	551940	So it's basically acquired and used unconsciously
551940	555780	and it can affect your thoughts and behaviors. And this is kind of
555780	559520	where when we get to talking about implanting, this is where they're putting
559520	563320	the password. One of the most common forms is procedural
563320	568620	which helps people performing certain tasks without awareness of actually performing it.
568620	572060	People use explicit memory throughout the day like remembering an appointment
572420	575740	or recalling an event from years ago.
577180	580160	And implicit is more like an unintentional
580160	584440	subconscious form. So if you remember a specific driving lesson
584440	588460	you had, that's an example of explicit memory. But if your driving
588460	592280	skill improves as a result of that lesson, that is more the
592280	596520	implicit memory. Okay, memory is a tool
596520	598440	versus memory is an object.
600540	604280	They've put forth that you can use it kind of both ways. So memory is treated as an object
604280	608060	when you're recalling or recognizing like an actual memory
608060	612580	but then if you're talking about using it to serve as an authenticator
612580	616760	this is more like where you would use it as a tool. And so why is this important?
616760	620020	Because they're looking at this research as being considered
621040	625140	potentially a subclass of behavioral biometric measurement.
626640	629060	So this is where we're going to start to connect with the idea of
629060	633860	implanting passwords as an option. So we're going to talk about encoding, storage, and retrieval.
635300	636940	So with encoding, this is
636940	641120	processing information into the memory. And there's several different ways
641120	644920	of encoding information. There's structural encoding, which is how something
644920	649180	looks. And an example would be if you had a word. Is it long? Is it
649180	653720	short? Is it all uppercase or lowercases? Is it handwritten? Is it typed?
653720	657760	Then mnemonic encoding is how something sounds. So like how does a certain word
657760	661600	sound? And then semantic encoding focuses more on the meaning.
661600	665760	And it requires a deeper level of processing than structural or mnemonic.
665880	669780	And it usually results in a better memory because you're kind of creating an association.
671320	673660	Storage is after the information enters
673660	678400	your brain, it has to be stored or maintained or forgotten.
681380	683560	So there's a three stage model that was
683560	687560	proposed by Richard Atkinson and Richard Shiffrin. It's often used to describe this
687560	691820	process. This is my attempt to make a representation of it.
692240	695500	So essentially you have sensory memory,
695500	699640	short term memory, and long term memory. Sensory memory stores the incoming sensory
699640	703640	information in detail, but only for an instant. The capacity is very large
703640	707560	but the information in it is unprocessed. Visual sensual memory
707560	712260	is iconic memory. And auditory sensory memory is called echoic memory.
712260	716440	So then you get to short term memory and some of the information in sensory
716440	720240	memory can transfer into short term memory and that can hold information for
720240	724440	about 20 seconds. And rehearsing is a way that you can
724440	728220	kind of keep information in your short term memory longer. So an example
728220	732240	is like if someone, like if you're parking your car and you're trying to remember like where did you
732240	736760	park your car and you're walking to whatever and you're like P2, P2, P2,
736760	740600	it's kind of like a way to kind of keep it in your mind and get it in there a little better.
740600	744500	Short term memory has a limited capacity and it can store about seven
744500	748720	pieces of information, give or take. And these pieces of information can be
748720	752420	small, such as like individual numbers or letters, or larger like
752420	756600	familiar strings of numbers or words. So like if you're trying to remember the word cat,
756600	760920	you're not going to remember C-A-T, you're going to remember the word cat
760920	763100	with the visual.
765740	768740	So information can be kept in your working memory
768740	772600	while you process or examine it. And then once you're done with it, it either
772600	776220	is pretty much forgotten or it moves into your long term memory.
776460	780760	Long term memory has an almost infinite capacity and the information
780760	784800	usually stays there for the duration of a person's life. However, the
784800	788780	big issue is it's there, but you're not always able to retrieve it,
788780	793260	which is where the chemo kind of affected me was the data was in there,
793260	796860	I was just not able to pull it out and that's what I was struggling with.
797800	800740	So with retrieval, that's the process of getting the information
800740	804640	out of your memory. And they have these retrieval cues and those are
804640	809420	stimuli that can kind of help you remember. And they include associations,
809420	810900	context, and mood.
813260	816780	So context is you can try to remember
816780	820400	an event by putting yourself in the same context you were when it happened.
820480	824380	Such as if someone lost a paddle from last night
824380	827380	and they're trying to remember where it is.
827780	832380	Sorry, that was for my boss. They could kind of go back to where they remember
832380	836140	they had it last and walk through if they can remember where they went next
836140	840280	and see if they can find it. Or you can do the same with your car keys if you've ever lost them.
841800	844520	Associations, this is our equal opportunity, gratuitous,
844520	848460	sexy photos. I hope I hit most everyone in the audience.
849900	852580	If not, I'm so sorry, but I only had so many
852580	856600	slides and so much time. But the brain stores information as networks
856600	860220	of associated concepts. So recalling a particular word can be easy
860220	864780	if another related word is recalled first. So here's an example
864780	868720	if I show you guys like these sunbathers on the beach and then I ask you
868720	872280	to spell the word bear, you may be more likely to spell
872280	876680	B-A-R-E instead of B-E-A-R because the picture
876680	880700	kind of primed you and associated you to that particular spelling.
880700	884940	And then there's mood. So if you're in the same mood you were during a particular
884940	889220	event, you can have maybe an easier time recalling the event, like kind of a
889220	893380	nostalgia type thing if you think about it.
893380	897340	Here's our other cat. They told me I had to put so many cats
897340	901420	in and so many sexy photos, so I tried to make sure I got them all.
901420	905380	Next slide. Okay, the human brain
905600	908480	has about a billion neurons in it and each neuron forms about a thousand
908480	912500	connections. And this is about somewhere around a trillion
912500	916480	connections I think. The challenge is if each neuron could only store
916720	920540	a single memory, running out of space would be a huge problem. So you might only
920540	924520	have maybe a few gigabytes of storage space, like about the same as an iPod or
924620	928600	a USB flash drive, but because the neurons combine so that each one helps
928600	932780	with many memories at a time, it exponentially increases your brain's
932780	936680	memory storage capacity to something closer to about 2.5 petabytes.
936680	940620	And the example, I think it was something like 300 million
941280	944680	hours of television
944680	948600	shows is about the capacity to store in there because of the way the neurons can
948600	954100	connect. Time check?
954280	958500	Alright, there are some limitations to memory.
958640	962560	I think everyone in here has seen that gorilla basketball video.
962900	967020	So that's like inattentional blindness or the illusion of attention. You focus so much
967020	970200	on one thing, you completely miss other stuff going on.
971200	975000	Sorry. There's false memories. There's the
975000	978660	illusion of confidence, which interestingly enough, apparently that's the opposite of
978660	982980	imposter syndrome. They have one. The illusion of
982980	987020	cause. There's a tendency to make casual connections between related facts
987020	989120	that maybe are not accurate.
993410	996190	This is where I want to get into the research.
997310	1000230	One word, concept, vocabulary thing is called brain
1000230	1004290	computer interface. So the initial motivation behind brain computer
1004290	1008810	interfaces was to develop the communication devices for the severely disabled.
1008870	1012390	Seeing as that I only have a limited time to speak, I won't go into the deep dive
1012390	1016190	about how an individual can train their mu and beta brain waves to
1016190	1020150	control a cursor. And there's some fascinating stuff around visual evoked
1020150	1024130	potentials. But there's a plethora of research out there if you're super
1024130	1028110	interested in that level of granularity. But I did want
1028110	1031390	to point out there is some research by Dr. J.R. Wolpow
1032110	1036290	and his research team as a starting point. And then Dr. Niels
1036290	1039770	Birbaumer with the thought translation device. He's with the
1039770	1044210	University of Tübingen in Germany. And he has created this device
1044210	1047830	that allows users to compose phrases and sentences electronically
1047830	1052170	just by thinking them. So he's neat. And you may also want to
1052170	1056230	look at a paper out of Dartmouth College about the Neurophone. It's a brain
1056230	1060230	mobile phone interface using a wireless EEG headset. And
1060230	1064010	in their paper his team shares the details of a brain controlled address
1064010	1068170	book dialing app they created. So the point is this is a super
1068170	1071970	huge area of research. But I haven't heard a lot of it on kind of our side of the house
1071970	1076190	as far as the security of these things. But I did want to share the four key pieces
1076190	1079830	of research that I found to be the most interesting and with the most potential.
1085570	1087050	First there's this...
1087050	1092000	wait, go back. So first
1092840	1097220	I'm going to murder this man's name, so I apologize ahead of time, but Hristo Bojanov
1097220	1101360	at Stanford was working with some cognitive scientists at Northwestern
1101360	1105020	University and they designed a game that looks similar to Guitar Hero.
1105260	1109040	And this is called CISL, Serial Interception Sequence Learning.
1109460	1113180	And it's an authentication procedure that
1113180	1117400	they created this testing experiment around. And they used Mechanical Turk
1117400	1120980	through Amazon to do their experiments. So
1121440	1125080	I'm not sure how well that looks as far as like
1125080	1129160	how you're able to look at your subject pool from an experimental perspective.
1132010	1135370	I'm trying. I'm like all up on it. I do want
1135370	1139350	to walk you through how it works, but I want to make sure I get it right, so I want to
1139350	1143470	read it. The process of learning the password involves the use of a specially
1143470	1147350	crafted computer game that resembles Guitar Hero. There are six buttons
1147350	1151350	S, D, F, J, K, and L. And the user has to hit the
1151350	1155770	corresponding key or note when the circle reaches the bottom fret.
1155770	1159430	So during a typical training session of around 45 minutes,
1159650	1162830	a user will make about 4,000 keystrokes. And around
1162830	1167330	80% of these keystrokes are being used to subconsciously teach you a 30
1167330	1175830	character password. Before running,
1175830	1179670	the game creates a random sequence of 30 letters chosen from the
1179670	1183730	S, D, F, J, K, and L with no repeating characters. This equates
1183730	1187830	to around 38 bits of entropy. And the 30 character
1187830	1191850	sequence is played back to the user three times in a row and then padded out
1191850	1195490	with 18 random characters for a total of 108 items.
1195650	1199950	The sequence is repeated five times, and then there's a short pause, and the entire process
1199950	1203810	is repeated six more times. And by this point, the experimental results
1203810	1207830	suggest that a 30 letter password is firmly implanted in your
1207830	1211750	subconscious brain. The authentication requires that you play a round
1211750	1215850	of the game, but this time your 30 letter sequence is interspersed with other
1215850	1219850	random 30 letter sequences. To pass the authentication, you have
1219850	1223710	to reliably perform your sequence. The research shows that
1223710	1226850	even after two weeks, you're able to recall the sequence.
1228610	1231850	The next one is past thoughts. So this is from
1231850	1235710	Berkeley, 2013. This technique combines
1235710	1239730	three factors. Something you know, which is a thought, something you
1239730	1243830	are, your brain patterns, and then something you have, which is the EEG sensor for
1243830	1247970	measuring the brain waves. To authenticate with a past thought, you think your secret
1247970	1251810	key while using the sensor. The key can be just about anything,
1251950	1256050	a song, a phrase, or a mental image, and the thought itself is never transmitted,
1256050	1259890	just a mathematical representation of the electrical signals your brain makes
1259890	1265860	while you think it. Now, if someone else were to figure
1265860	1269820	out what you were thinking, they still couldn't impersonate your past thought in theory
1269820	1273040	because every person thinks the same thing differently.
1273420	1277720	So, you know, we could all think about the same song, but we're not
1277720	1281480	all going to think about it exactly the same way as far as being registered
1281480	1285700	electronically. Time check. Okay, so
1285700	1289680	this is how they did this one. The following tasks were repeated five times in
1289680	1293620	each session for each subject. They had a breathing task, so
1293620	1297760	they had to close their eyes and focus on their breathing for 10 seconds. They had a simulated
1297760	1301700	finger movement, so subjects imagined in their mind that they were moving
1301700	1305540	their right index finger up and down in sync with their breathing without actually
1305540	1309360	moving their finger. There was a sports task where they selected
1309740	1313700	a repetitive motion from a sport of their choosing, and they imagined moving their body
1313700	1317440	muscles to perform the motion. Then there was a song passage
1317440	1321660	recitation task, an eye audio tone task, an object
1321660	1325540	counting task, and then at the very end they had a past thought
1325540	1328920	which they were asked to choose their own past thought like
1329440	1333180	a password, but instead of choosing a sequence of letters or numbers, they thought
1333180	1337480	of a thought, like a vision of their wedding, or their child being
1337480	1341060	born, or the first time they got drunk, or what have you. And that
1341060	1345280	they had to think about that for 10 seconds, and then everything together became their
1345280	1352910	past thought. So this was some other interesting
1352910	1357110	research that was done that kind of fed into the next one. It was on the feasibility
1357110	1360410	of side-channel attacks with brainwave computer interfaces.
1361230	1365050	I do have these papers cited at the end of my slide deck,
1365050	1369010	so if you look them up on the torrent, they'll be there. But it studied
1369010	1373090	the possibility of side-channel attacks using commercial EEG types of headsets
1373090	1377290	to reveal users' personal information like their banks,
1377290	1381330	ATMs, or PIN digits. Their approach was similar to a guilty knowledge test
1381330	1385290	where items familiar to a user are assumed to evoke different responses as compared
1385290	1389170	to items that are unfamiliar. So for example, when a person was shown images
1389170	1393030	of many banks, the brain response to the image of their bank
1393030	1397150	had more of an interaction or evoked a higher
1398210	1401350	potential with the waves. The problem with their attack
1401350	1405130	setup, it was intrusive and it could be easily detected by the user,
1405130	1409330	but that brought us to PEEP. So PEEP
1409330	1413130	built upon their research, and what they tried to do was create
1413130	1417450	an actual keylogger-slash-malware.
1417490	1421110	And this actually was on phys.org in June
1421110	1424730	29th, and I'll read from the article. It's a quote.
1424730	1429270	Researchers at the University of Alabama at Birmingham suggested that brainwave
1429270	1432790	sensing headsets, also known as EEG, need
1432790	1437210	better security after a study reveals hackers could guess a user's
1437210	1441130	passwords by monitoring their brainwaves. So in contrast
1441130	1444850	to the research I mentioned on the previous slide, the folks
1444850	1448970	at the University of Alabama wanted to test out a more surreptitious,
1448970	1452890	less intrusive approach that only required passive monitoring of brain
1452890	1456870	signals as the user's type pins or passwords. And so they called theirs
1456870	1460890	PEEP, which is passively eavesdropping private input
1460890	1464610	via brainwave signals. And this was University of Alabama
1464610	1468170	and I think one gentleman from California Riverside.
1469890	1472790	Now, they extensively referenced
1472790	1477030	the research of the previous group with the side channel
1477030	1480790	attacks, and they named their keylogger PEEP. And so
1480790	1484970	according to their paper, as the use of these devices, which they're
1484970	1488790	referring to the EEG gaming and entertainment devices, headsets, for any of you who
1488790	1492710	game, it becomes mainstream. A user may enter passwords or
1492710	1496810	private credentials to their computers or their mobile phones while they're wearing these
1496810	1500430	devices. And so they were studying the potential of
1500430	1503850	introducing a malicious app to capture those EEG signals
1503850	1508990	and then process the signals to infer the sensitive keystrokes.
1509310	1512310	So the gentleman and his team
1512310	1516930	used one regular store-bought EEG headset that anyone could buy at
1516930	1520610	or what have you. And then they also used a clinical grade headset
1520610	1524750	in their experiment. And they were able to demonstrate how easy a malicious software
1524750	1528730	program could passively eavesdrop on your brainwaves. So while
1528730	1532890	typing your inputs, it could sense
1532890	1536730	all of this. And I think he saw a quote from the article,
1536730	1540690	in a real-world attack, a hacker could facilitate the training step required for the
1540690	1544590	malicious program to be the most accurate by requesting that the user
1544590	1548630	enter a predefined set of numbers in order to restart the game after pausing
1548630	1552250	it to take a break, similar to the way a CAPTCHA is used to verify
1552250	1556510	certain users are logging in. The research showed that after a user
1556510	1560810	entered 200 characters, algorithms within the malicious software
1560810	1564570	program could make educated guesses about new characters the user entered by
1564570	1568710	monitoring the EEG data recorded. The algorithm they created was
1568710	1572330	able to shorten the odds of a hacker guessing a four-digit numerical pin
1572330	1575950	from 1 in 10,000 to 1 in 20,
1575950	1580110	and increase the chance of guessing a six-letter password from about 1 in
1580110	1583250	500,000 to roughly 1 in 500.
1591760	1592880	So... security
1592880	1596940	posture versus a rubber hose type of cryptoanalysis. The challenge
1596940	1600800	in testing their hypothesis is that as far as I know,
1600800	1604840	especially at Stanford, there's no studies that actually allow you to beat people
1604840	1609000	during an experiment. So I think in a way
1609000	1613140	they were kind of sexifying their paper title. You know, no shade.
1613200	1616680	But after a long discussion with a psychologist friend, my current opinion
1616680	1621020	with CICEL, which is the guitar hero in past thoughts, is there seems
1621020	1625840	to be some dependence on the consistency of the entry of the authentication,
1625840	1628960	and by introducing an actual rubber hose type attack
1628960	1632920	or some other similarly traumatic level of extraction, this
1632920	1636900	could affect the brainwaves themselves. So the ability to perform the
1636900	1641580	action or the entry in a manner consistent with the password was set up.
1641600	1644920	It could affect that, thus rendering it, you know, even if you
1644920	1649080	have it, it's not going to work because it's not matching the brainwaves. Because if you're relaxed
1649080	1653040	when you're going through the implantation, but you're being beaten with a rubber
1653040	1657460	hose, even if they get the string, it's going to be different.
1658420	1660920	So starting with the CICEL or
1660920	1665020	the guitar hero, they were able to test retrieval, but not
1665020	1668980	under stress or trauma. And they were able to test
1668980	1673140	basic coercion, trying to fool
1673140	1676860	the system, and that went pretty well. The potential
1676860	1680980	attacks against that one involved the use of remote authentication approach, whether or not
1680980	1684840	the attacker is allowed multiple extraction attempts, if there's performance
1684840	1689000	gaps, eavesdropping, none of this stuff's been tested, just the retrieval
1689000	1693160	has been tested. With past thoughts,
1693240	1696960	a hacker might be able to defeat the system by using a phishing scheme that would trick you into
1696960	1701460	thinking your past thought, capturing the output, and maybe later playing it back.
1702460	1705060	And it was pointed out by the research team that
1705060	1708980	the approach being used by them and the side channel attacks
1712220	1713120	my brain just
1713120	1717060	went dead. The stuff
1717060	1720880	is generated for implantation with a random generator
1720880	1724960	so you could probably go after it from the source by
1724960	1728600	going after the random generator that issues it versus
1728600	1731860	the actual person who has it, if that makes sense.
1736800	1740780	As to CICEL and past thoughts, they're still in a mostly theoretical stage
1740780	1744920	as far as research and experimentation goes. I didn't
1744920	1748900	really see anyone addressing how memory could be affected by such things as drug
1748900	1753160	use or injury or even degradation, such as if you have an employee
1753160	1756940	that's going through chemo and suddenly their brain is affected, would
1756940	1760820	they even be able to use any of this? Would that affect
1760820	1762720	the authentication pattern?
1764180	1768940	I don't really see this being viable for use at large right now until
1768940	1770980	some of those questions are answered.
1774280	1776940	We're all here at DEF CON, so what happens if you
1776940	1780940	have the password implanted while you're sober at work
1780940	1784960	but then you've had a couple drinks and you need to finish a proposal, are you going
1784960	1789200	to be able to authenticate or will being drunk or kind of drunk
1789200	1793120	or even just slightly impaired affect that ability? And that was another
1793120	1797000	thing I didn't see addressed. Cost was
1797000	1801140	another big thing. It's all well and good to propose this, but what's the exact cost
1801140	1804840	associated with implementing something like this? And would it be
1804840	1809040	realistic to deploy? So with SISL, the training or encoding
1809040	1812740	time was noted to be 45 minutes. And with
1812740	1816860	PastThoughts, it was two 40-50 minute sessions. And so if
1816860	1820760	you have a small organization, 5-10 people, that might be
1820760	1824660	okay, but I'm trying to picture Lockheed Martin or something trying to do this
1824660	1828840	with thousands of people trying to put each one of them through
1828840	1832620	that. With SISL, there are certain people
1832620	1836540	this probably would work best with, but factors such as mental capacity
1836540	1840740	or psychological issues. My sister-in-law works with
1840740	1844680	special needs adults who do stuff at the airport and have to go through security
1844680	1849260	checkpoints. So especially with the Guitar Hero type of thing,
1849260	1852560	would there be certain people that just wouldn't be able to authenticate
1852560	1856660	this way? Just legitimately, from a handicap perspective, they can't
1856660	1860640	do it. Even some of our wounded warriors who
1860640	1864200	don't have hands to do this
1864200	1869060	intricate type of authentication. And then things like Parkinson's
1869060	1872780	seizures, what if the individual is blind and can't even see?
1872780	1876840	I didn't really see any of this addressed as far as using it in a
1876840	1880900	real world on a large scale. All in all, I think
1880900	1886700	it's fascinating with potential, but the research is still in a pretty early stage.
1886700	1888580	The sample groups also, if anyone here
1888580	1892620	grad school, scientific research, test groups,
1892620	1896720	so the CISIL-CISE experiment number one was done
1896720	1900640	with 35 participants. Number two had two
1900640	1904800	groups, 32 and 80 participants, for a total of 147,
1904800	1908680	but they didn't clarify if any of those were duplicates from the first
1908680	1912780	to second experiment, so it actually might have been a smaller group number.
1914020	1916720	Based on my own experience, I'm not sure 147
1916720	1921000	represents a solid sample, other than whether or not it warrants further study.
1921000	1925360	I do think it warrants further study, but so far it's still very theoretical.
1925360	1928740	The past thoughts material I read was based on research on
1928880	1932120	a group of a total of 15 subjects.
1932460	1936460	The side channel attack research had 28 subjects, and the
1936460	1940620	PEEP research had a whopping 12 subjects.
1940640	1944700	So again, this is still really kind of in very theoretical
1944700	1948560	stage, and a pool of 12 subjects to me
1948560	1953400	is not a huge sample size from a research perspective,
1953400	1956540	except for maybe to do further research.
1956840	1961820	My thoughts around hackability, CISIL refers to the rubber hose,
1961820	1964820	I just really don't see that,
1964820	1968680	I don't see how they really addressed it, I think they just used the word
1968680	1972640	because it sounded cool. The theory that the
1972640	1976620	knowledge is not consciously accessible to the individual, I'm still
1976620	1980660	not sure on that. I have a psychologist friend, and he's
1980660	1984880	in agreement with me, like, if you can put it in, you can take it out.
1985560	1987860	And there's ways to do that.
1989660	1992560	For CISIL, a good potential attack factor might be
1993060	1997100	again, like I said, the random number generator, or the random password generator.
1997160	2000660	And in their paper, the past thought team pointed out they were not
2000660	2004560	vulnerable to shoulder surfing because their system was invisible,
2004560	2008420	but they felt they were very vulnerable to both social engineering and dictionary attacks
2008420	2012500	as their system stood. However, it was their hope that with advances in signal
2012500	2016600	recording and processing technology, it would allow for a much more detailed capture of the thought
2016600	2021340	itself, and that would protect better against some of the dictionary attacks.
2021340	2024980	And they also felt they were fairly vulnerable to phishing attacks,
2024980	2028700	where if you could get someone to click on something and record their thoughts
2028700	2032480	while they were clicking, they were kind of vulnerable from that perspective.
2033500	2036540	CISIL's not designed to prevent eavesdropping or shoulder surfing
2036540	2040480	attacks, so I imagine a good video recording of them
2040480	2044380	performing the sequence could allow an attacker to replicate it.
2044380	2048880	And considering how many security video cameras are insecure,
2048880	2052640	this is definitely a distinct possibility. And I believe they did say that
2052640	2055820	in some of the experiments, the
2055820	2060020	error ratio was just enough that if someone
2060020	2064020	knew that person's sequence, there were times they were able to
2064020	2065420	impersonate it.
2067340	2071620	I talked to my psychologist friend about using hypnosis
2071620	2075840	to potentially extract it. That I've done a little more research
2075840	2079100	into, and I'm not sure that's really a viable vector.
2079480	2083740	But he and I are actually still discussing that at length, so maybe I'll have more on that
2083740	2087680	in the future. Another thing, CISIL's a flash application.
2088500	2091140	So I'll just put that right there.
2093820	2095620	That was my first big like,
2095620	2098700	okay. And CISIL's authentication
2098700	2103020	process is potentially vulnerable to attack
2103740	2107320	if even an untrained person is able to
2108600	2111620	mimic or degrade their performance to match
2111620	2114100	the person they've watched authenticate.
2116860	2119640	And then the authentication based on keystroke dynamics
2119640	2123620	is similar to authentication based on the past thoughts.
2124880	2126940	So it looks at their typing rhythm
2127620	2130620	and what they're thinking at the same time.
2132260	2136300	So I think they just still need to do more research.
2136480	2139400	So in closing, I think much of this is still in the experimental
2139400	2143420	stage, and it's going to be really interesting to see if anything actually comes of it,
2143420	2147460	especially considering trying to deploy it across a large
2148140	2151440	environment or organization, or a very
2151440	2155340	varied population, like a bigger sample size than 12.
2157040	2158260	Check my time.
2159840	2163440	Some of my research, I have the papers. There are links
2163440	2167520	to them, but you don't have to click them. You can just Google the name of the
2167520	2170680	paper in Google Scholar. It'll come right up.
2172440	2175680	And then the last thing I wanted to leave you with is
2175680	2179020	it was kind of interesting, about halfway through my research
2179020	2183280	someone mentioned to me, oh my god, have you read this? It's a book called
2183280	2187180	Hard Boiled Wonderland and the End of the World.
2187180	2191220	And it was written by Haruki Murakami.
2191300	2194900	And it's actually from 1985.
2196640	2198920	And what I thought was really interesting is
2198920	2202840	I'm not going to spoil it if you want to read it, but it's a parallel narrative
2202840	2207520	type setup. One of the narrators is called a calcutech.
2207520	2210460	And it's a human data processor encryption system
2210460	2215220	who's been trained to use their subconscious as an encryption key.
2215780	2219080	And the other narrator is a newcomer to a strange
2219080	2222920	isolated town. And I'll leave it there so I don't spoil it.
2222920	2226700	But if you find this interesting, I actually thought it was pretty fascinating
2226700	2229780	that back in 1985, even
2230800	2234700	fantasy authors were thinking about the idea of using the mind to authenticate
2234700	2238920	and for encryption. So that's all I have.
2239640	2242720	I can do questions now if anyone has them.